Basic Pen Tests support rapid, basic vulnerability discovery, while Standard Pen Tests provide compliance-driven testing to meet requirements for Web apps, APIs, and networks.

SAN FRANCISCO, June 6, 2022 /PRNewswire/ -- Bugcrowd, the leader in crowdsourced security, today announced a significant expansion of its Penetration Testing as a Service (PTaaS) product line to include new offerings—Basic Pen Test and Standard Pen Test—purpose built for today's digital business where continuous testing must keep pace with continuous and agile development. These strategic additions expand the use cases covered by Bugcrowd's PTaaS suite to cover the gamut of customer needs, from basic assurance for simple web apps and networks to continuous, crowd-powered testing of complex apps, cloud services, mobile apps, APIs, and IoT devices for maximum risk reduction.

Most pen test providers today offer cumbersome, ad hoc consulting offerings that do not identify all risks and are hard to execute at scale in a consistent and configurable way for buyers as well as pentesters themselves. PTaaS solutions have emerged to address these issues, but most don't go far enough—only Bugcrowd delivers a modern, platform-powered approach, enabling organizations to keep innovating without compromising security.

With Bugcrowd's expanded PTaaS product line, pen test buyers now have an option for meeting every requirement, and for every asset type:

*   **Basic Pen Tests** for rapid, basic vulnerability discovery and reporting
*   **Standard Pen Tests** for easy-to-launch, compliance-driven testing packaged to meet most customer requirements for common use cases for simple web apps, APIs and networks
*   **Plus Pen Tests** for meeting special needs around targets, testing times, geographic requirements, etc.
*   **Max Pen Tests** for continuous, maximum risk reduction

"We have a diverse set of use cases for pen testing, ranging from basic vulnerability discovery for very simple web apps to intensive and continuous risk reduction for business-critical ones," said Jason Frost, Manager, Security Assessment, Paychex. "These new additions to the Bugcrowd PTaaS product line fulfill all our needs in one platform."

The Bugcrowd Security Knowledge Platform™ enables pen tests to run alongside Bugcrowd's managed bug bounty, vulnerability disclosure programs, and other solutions as a fully integrated and orchestrated experience blending data, technology, and human intelligence, with all findings flowing directly into the software development lifecycle. Bugcrowd's PTaaS suite allows customers to:

*   Activate precisely the right crowd at the right time leveraging the platform's CrowdMatch ML technology, delivering a 2x increase in high-impact findings versus manual matching methods
*   Launch tests in days instead of weeks and continually get fresh eyes-on-target from Bugcrowd's broad and diverse crowd
*   Utilize historical information to create standardized tests that reduce the need for contracted SOW discussions, while getting the intelligence of the aggregated experience of the platform, customer needs, and researchers to conduct the most relevant pen test scope
*   Get high-impact results that go beyond compliance checkboxes
*   See prioritized results and methodology progress in real-time via a rich PTaaS Dashboard experience

"Traditional penetration testing often delivers noisy, low-impact results, often takes weeks or even months to produce results, and offers no visibility into test progress," said Ashish Gupta, CEO, Bugcrowd. "We provide real-time visibility into pen testing results and vulnerabilities being found that allow our customers to continuously reduce risk and secure their environments, helping them stay ahead of a breach with solutions tailored to meet their needs."

Click here to learn more about these additions to Bugcrowd's PTaaS.

Click here to learn more about the Bugcrowd Security Knowledge Platform.

"Bugcrowd", "CrowdMatch", and "Bugcrowd Security Knowledge Platform" are trademarks of Bugcrowd Inc. and its subsidiaries. All other trademarks, trade names, service marks and logos referenced herein belong to their respective companies.

**About Bugcrowd  
**Bugcrowd is the leading provider of crowdsourced cybersecurity solutions purpose-built to secure the digitally connected world. Today's enterprise demands an offensive approach to cybersecurity—and Bugcrowd offers the only solution that orchestrates data, technology, and human intelligence to expose blind spots. The Bugcrowd Security Knowledge Platform™ enables businesses to do everything proactively possible to protect their organization, reputation, and customers with products like Bug Bounty, Penetration Testing-as-a-Service, and more. Trusted by organizations across the globe, Bugcrowd uncovers and remediates vulnerabilities before they interrupt business by leveraging expert ingenuity and the knowledge of world-class security researchers. Based in San Francisco, Bugcrowd is backed by Blackbird Ventures, Costanoa Ventures, Industry Ventures, Paladin Capital Group, Rally Ventures, Salesforce Ventures and Triangle Peak Partners. Learn more at www.bugcrowd.com.

Bugcrowd Expands Pen Testing Solutions with New Platform Services

The tool underpins cybersecurity capabilities including SIEM, SOAR, compliance automation, and vulnerability management.

Cybersecurity teams can now use Snowflake as their data platform for a range of critical use cases, making it possible for security teams to deploy a security data lake and unify their security data in one place.

Snowflake's Cybersecurity workload offers customers access to cybersecurity capabilities including security information and event management (SIEM), security orchestration, automation, and response (SOAR), compliance automation, and vulnerability management through connected applications that run on top of their existing Snowflake environmentx.

Snowflake serves as the security data lake, providing scalable storage, while analytics enable security metrics for live insights into an organization's security posture.

Partners including Hunters, Panther Labs, and Securonix offer security capabilities on top of Snowflake accounts through connected applications, removing the need for the homegrown tools security teams used to rely on to build for scale.

**Context Is Key**

"Whether it's spotting risky configurations or catching threat actors in the act, security insights depend on available data," explains Omer Singer, Snowflake's head of cybersecurity strategy. "Less obvious is the need for context and cross-source correlation."

He says many risks and attacks cannot be identified just by looking at a single finding or event log, with unified visibility the key to fewer false positives and false negatives.

For example, a vulnerability may have a CVSS score of 8.0 and be not so concerning if it's affecting a test system without Internet access. "The same issue may be super critical, on the other hand, if it affects a publicly facing Web server that handles customer financial transactions," he adds.

Another example is around user deprovisioning, which Singer calls "a real scourge" for many security compliance teams.

"Has access been revoked from all systems for all terminated employees? If not, has a terminated employee taken advantage of their access?" he asks. "It takes unified visibility to answer these questions."

**Consolidated Data Shows the Whole Picture**

Singer explains that Snowflake is enabling an alternative to typical security tools that operate in a silo and place the burden of connecting the dots on overstretched security teams.

"Our customers kept telling us that their traditional SIEM solutions didn't consolidate security logs — the legacy SIEMs actually create silos since their cost for comprehensive ingest and retention is prohibitively high," he says. "The result has been that security teams struggle to achieve necessary prevention, detection, and response outcomes."

Prabhath Karanth, senior director of security, compliance, and trust at TripActions, says that Snowflake has helped the company with log aggregation, better triaging, removing noisy alerts, faster threat detection and response, applying new threat intelligence to data, and continuous compliance.

"All of this ultimately results in better security assurance and building customer trust," Karanth says. He adds that the adoption of Cybersecurity workload is central to most of the company's data and strategic security initiatives.

"The platform allows us to leverage one single source of truth for multiple use cases," Karanth explained. "It helps us collect all data sources in a centralized location and run analytics on top, both for our business and security use cases."

In addition, integrations with Snowflake partner tools like the autonomous threat monitor Hunters and the compliance program Anecdotes on top of the Snowflake security data lake has helped TripActions further enhance some security use cases.

**The Importance of Compliance**

On the security compliance side, Karanth says TripActions is looking to achieve near-real-time controls automation using Snowflake's Cybersecurity workload and continuous compliance.

"We push all security tooling data into Snowflake data lake," he says. "This includes tools like cloud security posture management, application security posture management, and endpoint security tooling. Most of the compliance controls belong to one of these domains."

He adds that the company can get a unified view of the controls posture to meet compliance requirements like SOC2, ISO, PCI, and others by integrating with Anecdotes.

"This helps us identify control effectiveness from an audit perspective, quicker metrics reporting to leadership, and remediation activities," he says. "From a threat detection and response standpoint, again security tooling is the basis for all of this."

Karanth explains that the deviation from the desired state of assets can be identified from the data the platform collects, and integrations with autonomous tools like Hunters help his company respond with corrective action in a timely manner using custom-built and prebuilt alerts.

"Our ultimate goal as a security team is to enable our business and protect our customers' data," he says. "The need of the hour is to enable our business and at the same time reduce risk. We need to protect our customers' travel data both from a security and privacy perspective. We take customer trust very seriously. It's the foundation for how we do business."

Snowflake Debuts Cybersecurity Workload to Aid Visibility, Automation

FortiRecon combines machine learning, automation, and human intelligence to continually monitor an organization’s external attack surface.

**SAN FRANCISCO, Calif., – RSAC 2022 - Jun 6, 2022**

**John Maddison, EVP of Products and CMO at Fortinet**

“The sooner in the attack cycle you identify and stop an adversary, the less costly and damaging their actions. Employing a powerful combination of human and artificial intelligence, FortiRecon provides organizations with a view of what adversaries are seeing, doing and planning. FortiRecon’s vendor agnostic SaaS delivery model combined with an intuitive interface and easily digestible reports enable executives across the organization to quickly understand the risks posed to their company, data, and brand reputation, while our team of FortiGuard Labs cybersecurity experts enhance the offering with takedown services, guidance on prioritization of remediation efforts, and targeted threat research and intelligence.”

**News Summary**

Fortinet® (NASDAQ: FTNT), a global leader in broad, integrated, and automated cybersecurity solutions, today announced FortiRecon, a complete Digital Risk Protection Service (DRPS) offering that uses a powerful combination of machine learning, automation capabilities, and FortiGuard Labs cybersecurity experts to manage a company’s risk posture and advise meaningful action to protect their brand reputation, enterprise assets, and data. FortiRecon uniquely delivers a triple offering of outside-in coverage across External Attack Surface Management (EASM), Brand Protection (BP), and Adversary-Centric Intelligence (ACI) to counter attacks at the reconnaissance phase – the first stage of a cyberattack – to significantly reduce the risk, time, and cost of later stage threat mitigation.

**Organizations are Overwhelmed in the Fight to Protect their Network, Data, and Reputation and Mitigate Risk Early**

Before attacking an organization, a cybercriminal’s primary objective is to gather as much intelligence about their target as possible. This phase of early reconnaissance arms the adversary with everything they need to determine if and how they would exploit an organization. They will test a company’s defense and response tactics, look for unpatched systems, use social media to learn more about its employees and their normal behavior, and go as far as researching business partners, recent acquisitions, and any other third-party affiliation that could lead to a successful compromise. As organizations digitally accelerate their businesses and deploy hybrid IT architectures that expand the attack surface, identifying and mitigating these threats has become increasingly more difficult. In response to the velocity of threats, cybersecurity best practices have evolved from point-in-time evaluations to continual monitoring, ongoing reviews, and continuous enhancements to an organization’s security posture.

**Taking a Page Out of the Adversary Playbook to Mitigate Risk**

With the introduction of FortiRecon, Fortinet provides enterprise organizations with a powerful tool to understand how the adversary views an organization from the outside to help inform cybersecurity teams, the C-Level, and risk and compliance management on how to prioritize risk and improve the company's overall security posture. FortiRecon offers companies consistent and comprehensive coverage across three areas:

*   **External Attack Surface Monitoring:** Empowers organizations to understand their risk profile and mitigate risks early. Provides an outside-in view of an organization and its subsidiaries to identify exposed known and unknown enterprise assets and associated vulnerabilities, and prioritize the remediation of critical issues. EASM identifies servers, credentials, public cloud service misconfigurations, and even third-party partner software code vulnerabilities that could be exploited by malicious actors.
*   **Brand Protection:** Enables organizations to protect their brand and identify risks to their customers. Proprietary algorithms detect web-based typo-squatting, defacements, and phishing impersonations, as well as rogue mobile apps, credential leaks, and brand impersonation on social media, all common techniques used by cyber threat actors. The early detection of malicious activity allows teams to quickly take action (such as website or application takedown) to stop and prevent damage.
*   **Adversary-Centric Intelligence:** Increases the security awareness of an organization’s SOC team with industry and geography specific coverage to better understand their attackers and protect assets. FortiGuard Labs cybersecurity experts assess the underground and imminent threat risks posed by active cybercriminals to an individual company by proactively monitoring public and private forums, open-source, dark web, and other cybercriminal domains. By engaging in human intelligence collection, FortiGuard Labs experts assess and curate custom threat intelligence, providing recommendations specific to the company, industry, and geography.

For partners, FortiRecon can be sold on top of the Fortinet Security Fabric or as a stand-alone, vendor-agnostic solution that delivers easily digestible reports and enables their customers to quickly understand the risks posed to their company, data, and brand reputation. FortiRecon also extends the categories of risk for which partners can provide insight to customers and increases the opportunity to land new customers that have only invested in more traditional security solutions.

**Enhancing Fortinet’s Early Detection and Response Portfolio and Industry Leading Security Services**

FortiRecon complements Fortinet’s robust portfolio of early detection and advanced response products, including FortiNDR, FortiXDR, FortiDeceptor, in-line sandboxing, as well as advanced automation with FortiAnalyzer, FortiSIEM and FortiSOAR.

Fortinet is firmly committed to the success of SOC teams and the protection of organziations and offers an extensive portfolio of outsource services ranging from cybersecurity assessments and readiness, playbook development, tabletop training, Incident Response, MDR and SOC-as-a-service. This combined offering, alongside the many enhancements across the Fortinet Security Fabric and extended ecosystem deliver simplification and automation to help SOC teams regain focus, control, and speed by strengthening an organization’s SOC with FortiGuard Labs cybersecurity tools and experts.

**Get a demo of FortiRecon in the Fortinet booth at RSAC 2022**

Fortinet will be a Platinum Sponsor at this year’s RSA Conference and will feature product demos, a live theater, and a Fortinet Expert Bar at booth #5855 in the Moscone Center North Hall. Stop by the booth to get a demo of FortiRecon and other recent product, solution, and services innovations from Fortinet. Learn more about Fortinet at RSA and presentations featuring Fortinet executives in the media alert.

**Additional Resources**

*   Read our blog to learn more about the value security services can bring to any organization and find out more about Fortinet’s robust portfolio of AI-powered Security Services.
*   Learn more about Fortinet’s advanced detection offerings for the SOC: FortiNDR, FortiDeceptor, FortiXDR, and FortiGuard In-line Sandbox Service
*   Learn more about Fortinet SOC-as-a-Service.
*   Learn more about how the Fortinet Security Fabric delivers broad, integrated, and automated protection across an organization’s entire digital infrastructure.
*   Learn more about FortiGuard Labs threat intelligence and research or Fortinet’s AI-powered FortiGuard Security Services portfolio.
*   Learn more about Fortinet’s free cybersecurity training which includes broad cyber awareness and product training. As part of the Fortinet Training Advancement Agenda (TAA), the Fortinet Training Institute also provides training and certification through the Network Security Expert (NSE) Certification, Academic Partner, and Education Outreach programs.
*   Read more about how Fortinet customers are securing their organizations.
*   Engage in the Fortinet User Community (Fuse). Share ideas and feedback, learn more about our products and technology, and connect with peers.
*   Follow Fortinet on Twitter, LinkedIn, Facebook, and Instagram. Subscribe to Fortinet on YouTube.

**About Fortinet**

Fortinet (NASDAQ: FTNT) makes possible a digital world that we can always trust through its mission to protect people, devices, and data everywhere. This is why the world’s largest enterprises, service providers, and government organizations choose Fortinet to securely accelerate their digital journey. The Fortinet Security Fabric platform delivers broad, integrated, and automated protections across the entire digital attack surface, securing critical devices, data, applications, and connections from the data center to the cloud to the home office. Ranking #1 in the most security appliances shipped worldwide, more than 580,000 customers trust Fortinet to protect their businesses. And the Fortinet NSE Training Institute, an initiative of Fortinet’s Training Advancement Agenda (TAA), provides one of the largest and broadest training programs in the industry to make cyber training and new career opportunities available to everyone. Learn more at https://www.fortinet.com, the Fortinet Blog, or FortiGuard Labs.

Fortinet Unveils New Digital Risk Protection Offering

Crackdowns are driving down ransomware profits, and analysts see signs that operators are pivoting to business email compromise attacks, security researcher warned.

RSA CONFERENCE 2022 – San Francisco – Law enforcement crackdowns, tighter cryptocurrency regulations, and ransomware-as-a-service (RaaS) operator shutdowns are driving down the return on investment for ransomware operations across the globe. 

Abnormal Security threat researcher Crane Hassold, in a presentation at the RSA Conference, laid out his latest analysis of the ransomware threat landscape, predicting that there will be a pivot from ransomware toward renewed interest in basic business email compromise (BEC) attacks in the next 6 to 12 months. 

**RaaS Operator Crackdowns**

Ransomware attacks grab headlines and have been supercharged by a few prolific RaaS operators, Hassold explained. But crackdowns on just one group can make an enormous dent. 

"Ransomware is a centralized ecosystem with small numbers of operators responsible for the majority of attacks," Hassold said. 

He pointed to the recent disappearance of Pysa, leaving just two groups, Conti and Lockbit, with more than 50% of the share of the total ransomware attacks in the first half of 2022. BEC groups, on the other hand, are diffuse and scattered, making them much harder to eradicate, Hassold added. 

Although they're not as quick to make the headlines, BEC attacks have cost business more than $43 billion since 2016, according to the FBI, and make up $1 out of every $3 lost to cyberattacks, far outpacing ransomware losses, Hassold said. 

**Cryptocurrency Supercharged Ransomware**

Ransomware has had a moment over the past couple of years, Hassold explained, in part because once threat actors were able to abandon arcane wire transfers to collect ransoms and rely on cryptocurrency, caps on transactions were lifted and it became simple to collect much larger amounts. But new crypto regulations are chilling the ability of these cybercriminals to rely on its infrastructure to do business, adding what Hassold called "friction" to the transactions. 

BEC attacks, by comparison, rely on social engineering to corrupt a business's financial supply chain to get employees to willingly part with the cash, making them exponentially harder to track and stop.  

**Social Engineering Works**

By far, the most-used BEC tactic is the standard gift-card swindle, tricking employees to buy bogus gift cards, meaning the tried-and-true grift is still working. But Hassold said the BEC landscape is shifting from impersonating internal employees to posing as external business contacts. 

Once inside a business email account, attackers will wait and gather intelligence that can help them impersonate a trusted source. Today's BEC attacks are aimed at a company's financial supply chain, and once threat actors are inside, they will look for opportunities to spoof vendor emails to send payments to controlled accounts, change direct deposit information of executives to steal their paychecks, and even order aging reports showing which vendors owe the company. Once they have an aging report, an attacker will simply try to reach out to partners and collect any outstanding balances. 

In short, social engineering works. 

"BEC, in my opinion, is the clear threat to enterprises everywhere," Hassold warned. "These attacks disproportionately impact business." 

He added there is already evidence that ransomware operators and West African BEC attackers have already started comparing notes. 

"They're not collaborating, but interacting," Hassold said. "Those relationships might harden in the future."

Ransomware's ROI Retreat Will Drive More BEC Attacks

A panel of CISOs at the RSA Conference outlined what a successful first 90-day plan looks like, and it boiled down to effective communication and listening.

RSA CONFERENCE – San Francisco – A trio of high-powered CISOs talked about the first 90 days in their roles, and whether the aim was getting board of directors' buy-in or building rank-and-file credibility, they all said how they communicated was what mattered the most. 

The RSAC panel included Allison Miller, Reddit's CISO and VP of Trust; Olivia Rose, Amplitude's CISO and VP of IT; and Caleb Sima, CISO for Robin Hood. Chenxi Wang, founder of the Rain Capital venture capital fund, moderated the discussion.

Practically, Sima opened up by explaining how during his first few days with Robin Hood he gathered simple data points he labeled "top challenges" and "things that scare me."   

But Rose interjected that in many instances blunt statements like that could end up offending and alienating critical engineering and IT teams right out of the gate, which can make a CISO's job much harder. 

**The Internal Comms "Dance"**

"It's a dance," Rose said. "You have to be careful not to offend those who have been handling this before you got there." 

Rose suggests meeting members of other departments where they are. 

"Whether its infrastructure or executive, talk their language," she said. "And be very clear and persistent." 

Sima disagreed, adding with a bit of a chuckle, "If you don't have any haters, you're not doing the right thing."

Regardless of the approach, both of them, as well as Miller, spent time early in their positions trying to sell a security program to internal teams often not in line with their strategies. Miller and Rose said legal and compliance became their most natural partners inside the business.

"You've got to have allies," Rose said. There's often friction with engineering, infrastructure, IT, product, customer service, and others, but the legal and compliance teams have a clearer vision of the consequences of a security incident and can be invaluable in communicating them to the wider enterprise. 

**Communicating With the Board of Directors**

Beyond everyday internal wrangling, these CISOs unpacked their communications approach with their respective companies' boards of directors. Sima explained he relies heavily on narrative to tell the story about where his team is right now and where it's heading. The techie stuff he drops in the appendix in case someone wants more detail. 

When it comes to providing boards with data they can digest and use, Rose said she relies on the CMMI Cybermaturity Model and Sima and Miller said they lean on the NIST CSF framework. 

"It's an easy way to visually show people who don't understand security where you need to be and why," Rose said. 

Moderator Wang sits on a company's board of directors and suggested the boards should requisition a third-party validation assessment so they can be assured that the information the CISO is providing is correct.

"The first board meeting should be about setting expectations," Sima added. 

But for all the competing messages and audiences CISOs regularly juggle, during the first 90 days in the CISO chair, talking as little as possible is the best bet, Rose explained.

"You first 90 days you should just shut up," Rose said. "You have to listen to what's going on."

Communication Is Key to CISO Success

CMS helps minimize the impact a cyberattack has on business operations, finances and reputation.

SAN FRANCISCO, June 6, 2022 /PRNewswire/ -- As organizations grow and evolve, so does the threat of cyberattacks. This creates the need to readily identify and protect critical security assets as part of an effective cyber strategy. To help clients strengthen their resiliency in this area, Optiv — the cyber advisory and solutions leader — today launched its new Cyber Recovery Solution (CRS) at the RSA Conference.

Optiv, the cyber advisory and solutions leader, has launched its Cyber Recovery Solution (CRS). Focused on protection and rapid recovery, CRS enables organizations to be resilient during data loss events and helps them get back to business faster.

Optiv's CRS helps organizations get back to business faster by providing strategic and tactical advisory and technology solutions for cyber readiness while enabling rapid recovery to a secure state. CRS identifies and prioritizes the protection of critical assets through automated workflows that backup business-essential data, systems, and applications and supports the implementation of a vaulted, data-isolated, air-gapped backup solution that reduces the risk of data loss.

**Key Benefits of CRS:**

*   **Business/technology alignment:** Identify, prioritize and build a cohesive connection between business and technology.
*   **Enhanced recovery:** Create custom playbooks, defined in advance of an incident, to enable rapid recovery to a secure state.
*   **Reduced risk of business impact:** Minimize the impact a cyberattack has on business operations, finances and reputation.
*   **Cyber resilience:** Build a framework that anticipates and efficiently responds to cyberattacks for better business continuity.

CRS is part of Optiv's holistic approach to cybersecurity and information technology, where business operations are connected with the technology that enables it. CRS is applicable to Zero Trust initiatives, Managed Extended Detection and Response (MXDR) capabilities, supports cyber insurance requirements and more. The application of CRS runs across all technology domains and security initiatives.

"Cyber resiliency is no longer just an IT problem. It's an opportunity for every organization, starting at the top, to implement tools like CRS to better identify threats while readily protecting its security posture," says David Martin, executive vice president and chief services officer at Optiv.

As part of CRS, Optiv works with clients to identify and classify mission-critical business processes, visualizes and prioritizes supporting systems, data and applications, and then develops step-by-step playbooks to quickly restore technology assets. This allows business operations to continue with minimal disruption when a cyberattack occurs. Organizations utilizing CRS can create a stronger cyber resilience framework.

"What matters most today is being able to reduce risk to your business from any threat, in any form" said Jessica Hetrick, senior manager, cybersecurity and enterprise resilience at Optiv. "CRS helps you proactively identify, prioritize and protect critical assets in your environment. This informs your ability to detect, respond and subsequently recover when a cyberattack happens — culminating in a truly resilient organization that can better withstand the most advanced cyber threats."

**Explore More About CRS:**

*   CRS Field Guide
*   CRS Infographic
*   CRS Service Brief
*   Video: CRS Explained

For the latest news and updates from Optiv, visit https://www.optiv.com/newsroom/. **Follow Optiv**  

https://www.optiv.com/explore-optiv-insights/blog

**Optiv Security:** **Secure greatness.™**

Optiv is the cyber advisory and solutions leader, delivering strategic and technical expertise to more than 7,000 companies across every major industry. We partner with organizations to advise, deploy and operate complete cybersecurity programs from strategy and managed security services to risk, integration and technology solutions. With clients at the center of our unmatched ecosystem of people, products, partners and programs, we accelerate business progress like no other company can. At Optiv, we manage cyber risk so you can secure your full potential. For more information, visit www.optiv.com.

Optiv Launches Cyber Recovery Solution Focused on Protection and Rapid Recovery

New SmallID offering brings cloud-native data privacy and protection to organizations of all sizes.

SAN FRANCISCO, June 6, 2022 /PRNewswire/ -- BigID, the leading data intelligence platform that enables organizations to know their enterprise data and take action for privacy, security, and governance, today announced the availability of SmallID: the first pay-as-you-go cloud data security platform.

Now more than ever, the world runs on data - and it's difficult to have a clear understanding of all data assets across the company.  On top of that, evolving data protection and privacy regulations means that accumulating data without proactively protecting introduces more risk than ever. 

SmallID brings cloud-native data privacy and protection to organizations of all sizes, making it easy to find and mitigate risk across their entire cloud environment. Customers can easily reduce their attack surface, identify high-risk data, and automatically discover dark data across the cloud - without impacting business.  

Customers can now use the first on-demand cloud data security platform to manage their cloud risk posture, by benefitting from years of ML innovation from BigID, packaged up in a lightweight, on-demand platform in SmallID.

With SmallID, customers can:

*   Automatically discover and classify their data by sensitivity, type, regulation, policy, and more
*   Drastically reduce their attack surface
*   Identify shadow data and dark data
*   Improve security posture across the cloud
*   Simplify regulatory compliance with a data-first approach

"Cloud-native organizations leave themselves vulnerable to bad actors and a host of other complex issues when they don't have insight into what kind of data they are collecting," said Tyler Young, Chief Information Security Officer at BigID. "SmallID is a huge step forward for organizations of all sizes to have on-demand cloud protection that reduces the attack surfaces through allowing teams to identify and mitigate risk across their entire cloud environment."

Visit BigID at RSAC 2022 to see SmallID in action, or try it for free today.

**Learn more:**

*   Visit BigID's Data Protection HQ at RSAC2022 - save your spot
*   Visit SmallID-sponsored Cloud Data Security Panels June 7 & 8, with CISO led discussions from Amplitude, Blackstone, Clearsky Cybersecurity, Datadog, Highspot, Optiv, Relativity, Servicenow, ServiceTitan, Wiz, and more
*   Visit Booth #4529 in the North Expo Hall

**About BigID**

BigID's data intelligence platform enables organizations to know their enterprise data and take action for privacy, protection, and perspective. Customers deploy BigID to proactively discover, manage, protect, and get more value from their regulated, sensitive, and personal data across their data landscape. BigID has been recognized for its data intelligence innovation as a 2019 World Economic Forum Technology Pioneer, named to the 2021 Forbes Cloud 100, the 2021 Inc 5000 as the #19th fastest growing company and #1 in Security, a Business Insider 2020 AI Startup to Watch, and an RSA Innovation Sandbox winner. Find out more at https://bigid.com.

BigID Introduces Cloud Data Security On Demand

Randori’s attack-surface management software will be integrated into IBM Security QRadar extended detection and response (XDR) features.

RSA CONFERENCE 2022 – San Francisco – IBM plans to purchase attack-surface management firm Randori in a move that ultimately will expand IBM's extended detection and response (XDR) family of products to incorporate the "attacker's view" of the IT infrastructure.

The buy also will bolster IBM's X-Force with automated red-team functions and add to IBM's threat detection services within its Managed Security Services, the company said.

Randori, which is backed by Accomplice, .406 Ventures, Harmony Partners, and Legion Capital, offers visibility into on-premise and cloud exposure, including risk prioritization features. This is IBM's fourth acquisition of the year.

"Our clients today are faced with managing a complex technology landscape of accelerating cyberattacks targeted at applications running across a variety of hybrid cloud environments – from public clouds, private clouds and on-premises," said Mary O'Brien, general manager at IBM Security, in a statement. "In this environment, it is essential for organizations to arm themselves with attacker’s perspective in order to help find their most critical blind spots and focus their efforts on areas that will minimize business disruption and damages to revenue and reputation."

Financial terms were not disclosed. The deal is expected to close in the coming months, pending closing conditions and regulatory reviews.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

IBM to Buy Attack Surface-Management Firm Randori

But valuations have dropped — and investors are paying closer attention to revenues and profitability, industry analysts say.

Cloud security vendor Lacework's recent announcement that it will reduce head count as part of a restructuring plan — just months after it secured $1.3 billion in a record-setting funding round — may have shocked the high-flying cybersecurity sector, but industry analysts say the layoffs do not signal any broad, imminent industry slowdown.

General economic conditions appear to have made investors a bit more cautious, however: Private equity (PE) investments — which accounted for nearly 40% of merger and acquisition activity last year — are down compared with the same period in 2021, as are company valuations overall.

Even so, M&A and venture capital activity in the cybersecurity industry remains robust and shows little sign of a major slowdown. Just in the last few days, for instance, ReliaQuest announced plans to purchase Digital Shadows for $160 million; Netskope acquired WootCloud for an undisclosed sum; and Lookout acquired SaferPass. In late May, Broadcom announced its intent to buy VMware for $61 billion in a deal that, if approved, will bring VMware's Carbon Black security under Broadcom's roof.

**Multiple Drivers**

"There are multiple dynamics at play for M&A" activity in the cybersecurity space, says Fernando Montenegro, an analyst with Omdia. "The established vendor being acquired for their cash flow. The adjacent technology being acquired by a security vendor to enter a market. The technology tuck-in and/or 'acqui-hire' into an existing vendor," he adds. Expect VCs, private equity, and corporate development teams to be a little more cautious, but still active, he notes.

"The industry has had a strong pace of acquisitions and fundings over the years, and we expect that to continue," Montenegro says. "What is changing is that there appears to be much more focus on demonstrating actual capabilities and momentum while being mindful of run rate."

There's also the understanding that too-large funding rounds raise expectations on delivery that may be more difficult to attain in a tightening economic environment, he notes.

Richard Stiennon, chief research analyst at IT-Harvest, says Lacework's decision to downsize and restructure may, in a way, be the result of its own success. The company experienced hypergrowth of some 272% last year and went on a hiring spree. After that, the company might have thought it wise to pause and consolidate while it catches up with expectations on sales growth, Stiennon explains. "There is categorically no broad consolidation in cybersecurity and there will not be until threat actors give up and go home," he says. "We will always need new ways to counter new threats."

That said, the antivirus space for the first time is now truly consolidating, according to Stiennon. Thanks to Microsoft giving away good-enough security with Windows Defender and the availability of stronger endpoint protection capabilities from vendors such as CrowdStrike and SentinelOne, the traditional AV vendors are fading away, he says.

**Fast and Furious Pace**

Data that S&P Global Market Intelligence compiled earlier this year showed there were 42 cybersecurity transactions through March 18, 2022, with a median deal value of some $97 million. Google's $5.4 billion purchase of Mandiant was easily the biggest of those deals and accounted for most of the $6.77 billion in total transaction value of announced deals in the cybersecurity industry through that date. In comparison, there were 36 transactions over the same period in 2021, with a median deal value of $185 million. In all, in the first quarter of 2022 there were 59 deals compared with 49 last year. But total deal value at $9.3 billion was significantly smaller than last year's $17.6 billion, according to S&P Global Market Intelligence.

Rising interest rates, inflation, and concerns over potential economic headwinds appear to have driven down security vendor valuations compared with last year, says Garrett Bekker, an analyst with S&P Global Market Intelligence. Even so, investors appear willing to pay hefty multiples to acquire security firms and the appetite for buying them does not appear to have diminished significantly, he says. That's because most existing drivers remain in place, such as cloud adoption, the move to zero-trust access models, and the proliferation of ransomware and other malware.

One potential red flag is the slowdown in private equity investments so far this year, Bekker says. For the past two decades, there has been a steady increase in PE-funded mergers and acquisitions — from 40 in 2002 to 80 in 2010, and 209 in 2021 — or 37% of all transactions in the space, he says. There has been a near 20% drop-off in PE transactions in 2022 compared with the same period last year, Bekker says. 

"It's a fairly large drop-off," he notes. "We'll be looking to see whether that persists or is an aberration."

**Closer Scrutiny**

Speculation about potential recession and recent turmoil with tech equities is causing venture investors to scrutinize funding more carefully, says Joseph Blankenship, an analyst with Forrester Research. Many investors are also advising the firms they've invested in to slow their burn rate and concentrate on building revenue, with an eye toward profitability. "I do predict that the increased scrutiny, reduced risk appetite, and decreased funding will lead to fewer startups entering the cybersecurity market." It will also push existing firms to find faster exits.

"What we’re seeing now is a continuation of the M&A activity," Blankenship says, At the same time, he adds, buyers are looking to consolidate vendors and the technology portfolios from major cybersecurity vendors are more attractive than they've been previously.

Cybersecurity M&A Activity Shows No Signs of Slowdown

The buzz on the show floor during RSA Conference is about aligning the organization's security priorities with the right technology. Will Lin, managing director and founding member at Forgepoint Capital, weighs in on the biggest security priorities for 2022 — and what kind of tech senior-level executives are looking for.

At Forgepoint Capital, I have the unique, ongoing privilege of asking for help from the best and brightest in the cybersecurity space. Aggregating insights from a variety of expert sources provides a clear view of what works, what doesn’t, and where the industry is headed.

Our recent CISO Security Priorities Model report goes a step further and democratizes access to information on cybersecurity priorities and trends. For the report, we surveyed senior-level executives (CISOs, CIOs, CSOs, CTOs, CDOs, etc.) across different sectors and organization sizes.

The survey revealed several interesting patterns on cybersecurity spend, differences between small and midsize (SMB) business and large enterprise priorities, and the strategic direction organizations expect to take over the next several years. The goal of the report is to answer these three questions for 2022:

*   What are CISOs top security priorities?

*   What NIST cybersecurity framework priorities are CISOs focused on?

*   What areas of control are CISOs focused on?

Key insights from the report include:

*   **Large enterprises are focused on digital transformation and incident response, and SMBs are focused on people.** While some overlap exists in security concerns across organizations of all sizes, there are stark differences between priorities for large enterprises and SMBs. For example, CISOs at large enterprises report incident response as a top priority, while that was near the bottom of the list for SMBs. SMBs tend to prioritize human aspects of cybersecurity, such as talent development and security awareness instead.

*   **Cloud and digital transformation is now a CISO priority.** Cloud and digital transformation have traditionally been the domain of CTOs and CIOs. CISOs at large enterprises are now reporting cloud, business, and digital transformation as their top priority, so clearly that paradigm has shifted.

*   **CISOs are spending on areas where they can make a measurable impact.** Security budgets are growing — 76% of CISOs expect to see a security budget increase — and organizations are being very intentional with their spend. Decision-makers are prioritizing areas where they can see ROI and impact. In practice, that means focusing on areas where teams can move quickly, which tends to vary by industry. For example, security hygiene is a key focus for professional services, while healthcare is prioritizing software supply chain security and third-party risk.

*   **New areas of control are growing in popularity.** Traditional security control areas like network, endpoint, identity, and data remain important priorities for many enterprises. However, digital transformation is bringing new areas of control to the forefront. Specifically, DevSecOps (54%) and cloud, infrastructure, and APIs (62%) were leading areas of control organizations plan to prioritize.

*   **Vendors and organizations both aim to address key NIST functions.** According to the cybersecurity leaders we surveyed, the three most popular NIST cybersecurity framework priorities for 2022 are protect, detect, and identify. Interestingly, this overlaps with the focus of security vendors placing an emphasis on visibility in their products. While this overlap may be explained by mutual interest between enterprises and vendors, it could also suggest a lack of products that focus on response and recovery.

Additionally, some of the most interesting insights were the more nuanced tactical challenges facing CISOs. For example, while identity is still a top priority for many organizations, finding talent with the requisite skills across major cloud providers is proving to be a challenge for some. An AWS security engineer may not be familiar with GCP or Azure. Often, those real-world pain points are where innovation in the space can have a significant impact.

That’s just the tip of the iceberg when it comes to what we’ve learned in our survey of cybersecurity leaders. 

Here is Forgepoint Capital's full report.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Source

DARKReading