Reporting Data and Analytics for Executives on the PTaaS Platform

00:05 Hello. Welcome to the latest installment of Cut to the Chase. I'm Jeff Barker with the product management team here at SYNNAC, and I'm joined by Tim Norvett. Tim, you wanna introduce yourself? Thanks, Jeff. Yeah. As mentioned, my name is Tim Norvett. I am one of the solutions architects here at SYNNAC, and I'm looking forward to today's topic. Great. Thanks, Tim. It's great to be here with you. Today, we're here to explore our new executive reporting capability, the latest edition of our leading penetration testing as a service or PTAS platform.

00:36 With the addition of this new reporting, we offer the industry's most comprehensive security testing experience that includes attack surface discovery, which really helps you maintain a list of your attack surface assets. Attack surface analytics really helps you make sense of that data, make it actionable. Sometimes we're really hit with a bunch of data and it's tough to know what to act on. So those analytics help you act on that data. We make that data actionable with vulnerability discovery and testing. Really, it features automated and human led discovery of

01:09 those vulnerabilities leading to the whole vulnerability management process, which the net of it is remediating those vulnerabilities, acting on them and actually fixing them. It's not enough just to know I've got new vulnerabilities. It's really all about fixing the ones that are important. And then reporting helps us share findings and performs root cause analysis to improve processes. We continue to recreate the same vulnerabilities and if we have insight into what we're doing and why we're doing it,

01:41 we can improve processes. And the mission here is to really eliminate vulnerabilities before we create them. So if you want to learn more about our PTAS offering, listen to the latest cut to the chase that describes our PTAS value, and it describes it in more detail and also contrasts it with traditional penetration testing. So now let's dig into the details of our new executive reporting. Tim, what's your perspective on the new reporting capability? How does it advance penetration testing beyond where we are today?

02:15 No. Absolutely, Jeff. I like how you termed it a comprehensive approach to security testing. And your one phrase in there, how we're helping to eliminate vulnerabilities before they're created. You know? Because as a solutions architect, one of my roles when I work with customers to help them move beyond a reactive to a proactive stance when it comes to addressing their security posture. As you mentioned, we don't want to help them just address existing threats, but transition to anticipating and mitigating against future risk.

02:46 And what we're gonna talk about today with executive report and analytics, we wanna work with security leaders that help them, know, translate security data into strategic actions. Because as you mentioned, it's not just about identifying weaknesses. It's the ability to transform data into insights and then into tangible improvements that help improve the value of security investments. One of the reasons we did this here at SYNNAC is, you know, as you know, Jeff, we we believe that a data driven approach enables

03:16 security leaders to create specific and actionable guidance. This ensures that every security measure implemented is both effective and efficient. And, yeah, I'm sure you're thinking, yeah, it all sounds great and those are great goals, but how are we doing that actually? So let me share my screen here, and we'll introduce you to what we're doing in our platform. Great. Looking forward to it. So what we have here is we're introducing some business intelligence functionality within our platform,

03:46 the ability to drive real time insights from the security test and data. You know, one of the first goals when we did this, you know, Jeff, when we were talking about what what we need to do here is we need to help security leaders drive more granular insights. You know, traditionally, when you look at security destined testing data, you get really high level overviews and you get broad strokes, but that doesn't always tell the real story. You know, in this example here, you know, if we just start at the top here, look at top vulnerability categories,

04:16 it's really easy to look like look at this and think, well, cross site scripting is the issue we need to address. And if we drill in here, we could see thirty eight percent of vulnerabilities are cross site scripting. But as a security leader, our job is to address where what poses the biggest risk to our organization. So just because it's a high count doesn't necessarily mean that's the biggest risk. So if we drill a level deeper, we look at subcategories, which kinda goes one step lower than the categories. Again, we could stop here and see, you know, JSON injection,

04:47 reflected cross site scripting, indirect object reference. That's fifty percent of our vulnerabilities. So maybe that's where we need to focus our efforts. But I I always like to take it one step deeper. And like I said, let's focus on what's the biggest risk for our organization. So if we start to overlay severity data over those same data points, and let's just remove the lower risk stuff, some of the lows and mediums, and focus on what is the biggest risks to us. And you see, if we just look at highs and criticals, cross site scripting is now number three in the risk.

05:18 Authentication session information disclosure is what's the biggest risk. And, again, with the goal of getting more granular, let's do the same thing with subcategories. Let's remove the lows and the mediums. Just focus on what's the biggest risk to our organization. We can see, you know, default credentials is actually the biggest risk to our organization right now. And account enumeration is number second. JSON injection number three. So you can see when we looked at broad strokes, cross site scripting popped out as number one. And when we get more detailed and granular and look at from a

05:49 risk perspective, it's not even the top three. So, Jeff, I don't know if you have any thoughts, but one thing I I like about this is not just can we drive the insight, but the speed at which we can drive it. I mean, if you take over take out my talk track, I mean, in less than thirty seconds, these are insights that our our users can come in and get from their security testing. Yeah. This this is great. Right? And, you know, it's interesting. One of one of the things I hear when when I talk to security leaders is they you know, it's like, Jeff, I I don't need more vulnerabilities.

06:21 I got plenty of them. I need to make better decisions on what to act, where my risk is. So I think this, you know, this is is super pertinent and and really interesting. Right? Because it it really highlights the risky areas and making sure we're applying our resources, you know, to solve solve those problems. So it's super interesting, you know, drilling down through just the big numbers. We all like to show the big numbers, but, you know, where do I act? That that's a great point, Jeff.

06:52 And and just highlight some other features in here. What we're talking about now is looking at security testing data from more of a point in time perspective. While it's very crucial to do that because that's gonna help you address your immediate threats, It's equally important to evaluate security posture over a period of time and take a more longitudinal analysis that will help you identify trends, measure the effectiveness of your interventions, and understand where your security efforts are actually making an impact and maybe where more focus is needed.

07:22 So jumping over, we have this trend section in our platform. This is gonna give you two things. It's gonna give you give you a vulnerability count over time broken down by category and then the same thing by severity. So what I like about this area is kind of this trend line here on the far right. It gives you a month by month count by category of what vulnerabilities are looking like. So you can see you're trending up or down in different areas. And in this example here, let's say, you know, the month of December, we can see pretty much across all categories,

07:52 we have a spike in vulnerabilities being discovered. And maybe this maps back to our application teams, you know, pushed out a new major release to to our platform. And, you know, sometimes with new releases comes new risks, so maybe that's somewhat expected. And over the next four to six weeks, you know, teams were working to mitigate those risks. And between January and February, you know, maybe we deployed some new WAF to protect our perimeter. Maybe we made some updates to address the risk, and we can physically see in the month of February

08:22 everything is starting to trend down. So real quickly, as a leader, I can come in here and I can look, you know, how are the implementations of the plans I'm putting out there, directions of giving the team, how are they affecting our overall security posture over time? And from a trend perspective, maybe we look over here at the severity. Again, maybe we see a spike here in March and everything's trending down. But right here with criticals, see everything's trending down, criticals jumps back up in March. So between in the last month or so.

08:52 So maybe this is an area I need to drill in with my teams that you know why is everything trending down? But we've introduced a few critical vulnerabilities, you know, to our to our environment. You know, one of our value propositions here at SYNACK is noise reduction and kind of like you're mentioning Jeff. It's not that we need more vulnerabilities. We just need to know where to focus. And with items like this, we can get that laser focus and put that magnifying glass in here specifically where you need to focus to create that actionable intelligence.

09:23 And, Jeff, do have any thoughts to add here? No. I I I, you know, I think it's fantastic. I think, you know, what we're really seeing, I think, is a is a shift in the industry. Right? We're we're really moving from penetration testing as something that's a separate process, a separate report, a separate team. And historically, we really haven't been able to leverage that data and that investment in the testing practice to improve our processes.

09:53 Right? But if we start to run that testing through a PTAS platform like ours, you start to get this data and we're actually getting more for our penetration testing investment, right? We're actually able to say, am I improving over time? So I think, you know, information like this really changes the game and really shows organizations how they can truly leverage penetration testing for more than just, you know, satisfying the auditor.

10:24 No. Yeah. And kind of building on that, how to use penetration testing for more than just kind of the front end metrics to satisfied audit auditors. Yeah. I I think we need to recognize the value of security testing goes beyond, as you mentioned, merely just identifying vulnerabilities in security. We would be remiss in our responsibility as a security practitioner if we did not discuss the role of security testing as it relates to validating and demonstrating where systems are secure and resilient. So as important as to identify vulnerabilities up front,

10:55 we also, as you mentioned earlier, we wanted to work with them through the entire process and show them through the closing and remediation of those vulnerabilities. So the last thing I'll touch on is this vulnerability response area. You know, to start off here, as mentioned, we want to know where to focus our efforts when it comes to remediating those vulnerabilities. So we can quickly drill in here and see what teams still have open vulnerabilities. Are there specific areas we need to focus those remediation efforts so we can drive to zero. It's not about finding more vulnerabilities.

11:25 How can we fix what we have and mitigate those future risk? You know, we jump over here to average remediation by assessment. Now I always like to talk to this, like, maybe there's lessons learned. Maybe some teams are better at remediating than others. And in this example here, we can see averages ranging from eight days all the way up to sixty five days. So maybe we talk to the team that has the eight day average remediation, and maybe there's some lessons learned we can take that and apply to the teams with the higher averages, you know, the thirty six and sixty five to help them drive down and

11:56 create a more collaborative environment. And we we also provide insight into remediation times by phone categories. So maybe there's specific phone categories that teams are having trouble remediating, and we can focus efforts there. You know, average remediation by phone severity. Most organizations we talk to, they have SLAs around. Certain severity levels have to be fixed in certain times, so this is a quick way to come in, ensure, and validate that teams are adhering to those SLAs. You know, wrapping up here, I'll toss it back to you here,

12:28 Jeff, in a second to close it up. But I just wanna kinda reiterate that, you know, our goal with this is to help security leaders, you know, focus on the discovery and validation of on the vulnerability discovery side and the remediation side to help provide that more clear picture of the security posture. And we believe it's this holistic view that will allow you to reinforce your commitment to maintain a secure environment and demonstrate the tangible benefits of your security initiatives. So with that, Jeff, I'll toss it to you for any closing thoughts.

12:59 Yeah. I I really appreciate the tour, Tim. You know, it's it's been great. You know, I think what we're really seeing here with this data, right, and the whole package from discovery to testing all the way through reporting and root cause analysis and process is a real continuous testing methodology, right? That helps us take our security testing mainstream, integrate it into the infrastructure, make it part of the processes, right? In the old world where it took me sixty,

13:32 ninety days to get a tester on-site or a tester on target, right? Notionally it just wasn't possible to integrate testing into my operational processes, right? But with a PTAS platform and this complete solution, we actually can do that now. We can get more out of our testing investment, right? And leverage it more. And you know a recent survey that we did with Enterprise Strategy Group where we went out and asked organizations their perspective on security testing and penetration testing

14:03 and where they applied it and where it benefited the organization, there was a number that came back that was pretty eye opening, which is only thirty two percent of organizations leverage penetration testing to inform their security strategy. And if we think about it, there's one thing that we can probably do that most closely emulates what an attacker does and that's penetration testing. And yet we're not leveraging that. And if you think about how we've delivered this

14:33 traditionally, right, where we get a tester delivers a PDF, we don't stand a chance to integrate that information and inform our security strategy. So I think there's a real opportunity to turn that number upside down moving forward by providing this complete package and really getting more out of the data and getting getting more out of your security testing investment. And so, you know, I think, you know, it's really an exciting time for all of us that have been in the security industry for a long time to actually make real progress here.

15:05 So I I appreciate your time, Tim, and and the and the tour through, you know, through the reporting. And I appreciate everybody's time. You know, if you'd like to learn more about our PTAS, check out our website. It's all there. You can you can see exactly what we do, and, you know, we'd love to love to talk to you if you're interested in exploring more about what SYNNET has to offer. So thank you very much. Thank you.