Synack’s Managed VDP with Triage and Patch Verification

00:05 Hey, everyone. My name is Brandon Torio, senior product manager here at Synack. And today, I'm going to talk about our managed VDP program. Starting off, I wanna talk about what the point of a managed VDP program even is. What advantages does it bring to your offensive security strategy? So first of all, there are mandates for federal agencies to have a VDP program. But beyond that mandate, if you don't fall under it, it allows you to engage external researchers and just increase the diversity of perspectives you're getting on

00:35 your tech service. The more perspectives you have, the more areas of testing are being covered and the more considerations are being considered by those security researchers out there, to find any potential vulnerabilities that might exist on your tag surface. And the advantages we offer here at Synack are on the bottom halves of the slide. So, really, one of our biggest, one of our biggest advantages is that we reduce the noise. So as external researchers from the public submit vulnerabilities or findings through the portal,

01:05 we here at Synack triage every single one of those submissions so that when you log in to the Synack platform, you are only seeing things that really truly matter that are really out there. Beyond that, we also offer on demand patch verification. We can improve your remediation timelines because you can see all of this information in one spot alongside your other activities that you may be doing such as pen testing your internal host or your public facing web app. We also offer powerful reporting and analytics that executives especially love in a tab we call the executive reporting tab,

01:38 to demonstrate trends over time and things like that. So instead of just talking about it, I'm gonna cut to the chase and jump into the demo here to show you what I mean. So here I'm on the home page of the Synack platform. And if I go from the home page where you can see high level stats about your activity in the platform, like exploitable vulnerabilities or Synack researchers doing testing, and I go to assessments, here you can see an illustration of the kind of activity you do on the SYNACK platform in context with your

02:08 managed vulnerability disclosure program. So here at the bottom, we have your vulnerability disclosure program. And above it, you can see that you also have an assessment for your public facing web apps that might be undergoing pen testing, internal host infrastructure, APIs, etcetera. So having this all in one platform really creates a powerful vulnerability management experience and also makes the reporting and analytics that much more powerful and effective. So you can imagine that your vulnerability disclosure program here is started for whatever scope you've deemed appropriate.

02:39 And if you were to go to the exploitable vulnerabilities tab, this speaks to the triage, advantage that I was speaking to earlier. So every vulnerability here under exploitable vulnerabilities has been triaged by a team of humans here at Synack. So if it's here, you can bet that it's real and it matters and demands your attention. If you're going to any individual vulnerability, you can change the status to your liking as you work on the vulnerability, and you can see rich information about it,

03:09 like the impact, the payload sent to it, steps to reproduce it, and you can even comment back and forth with the team to understand the vulnerability further, and you can press patch verification. So after you go remediate that vulnerability, at the click of a button, you can verify the patch, tell us about how it was fixed, and then someone will go out and test to see if the patch was effectively done. This helps inform things about your remediation timeline, not only across your VDP program, but across all pen testing.

03:39 And you can analyze that here in the platform as well by jumping to our analytics and reporting experience where we can see rich information about the severity of vulnerabilities, the timelines they're submitted on, the timelines it takes for you to remediate them, and things like that. So you can see a few powerful views here that are self explanatory. The top categories, the, breakdown by severity, how many locations these vulnerabilities have found out, on average, how fast it takes to do remediation,

04:09 Other visualizations here, we often find that customers love looking at these over a period of time or over a single assessment. So, again, those assessments are things like your public facing web apps versus your internal host versus your managed vulnerability disclosure program. So as you come in here running a managed vulnerability disclosure program, you actually filter by that single assessment and see all of these statistics relative to just that program, and understand exactly how many vulnerabilities real vulnerabilities you're finding through the managed vulnerability,

04:42 program and how long it takes you to remediate them, the severity of the vulnerabilities, and all such powerful statistics. And this is an illustration of how Synack views offensive security testing in general. We really wanna help you get meaningfully better at your offensive security posture over time. We wanna be able to show you that, hey. Last year with your managed vulnerability disclosure program, you found this many vulnerabilities. This year, you found less, and you're remediating faster than you did last year. And you're remediating faster than you're doing on your other target.

05:14 Let's close the gap between your public facing web app pen testing remediation timeline and your VDP remediation timeline. Right? Why is there a delta there? That's just one example of how you can use the SYNNAC platform and its VDP program, to the best of its capabilities. So, hopefully, that was informative and you understand not only the need for a VDP program, but also the advantages offered by Synack's managed vulnerability disclosure program that come through the Synack PTAS platform. Thanks for watching, and if you have any questions,

05:44 be sure to reach out on our website on a contact us form, and we'll be in touch.