Integrate Security Testing With Your Vulnerability Management Workflow

00:04 Hi, everyone, and welcome to a demo of ActiveOffense on the Synack platform. I'm gonna begin this demo by jumping right in and creating a seed group within the Synack platform to find some of my assets. ActiveAffense includes this attack surface discovery ability, which you can see here operates pretty intuitively. We enter a seed group name, set our role based access control settings, and give the system something like a CIDR, as you see here, to create and run discovery. After we get some assets into the system, we can either view discovered assets here or check them out

00:36 directly on the asset list, and you can see the assets are now in the Synack platform. A second key component of ActiveAuthance is importing vulnerabilities relevant to these assets. So I'm going to go into my profile into settings to the integrations tab as seen here. Scroll down and select connect to Tenable, which is our first VULN integration we've made available. Enter your Tenable information and filter if you wish by severity of vulnerability, perhaps you only want to import critical Vault to Triage at first, for example, and perform the import.

01:06 You can see here that the import has now completed, and we've entered three hundred sixty five vulnerabilities in this example. I'm gonna now go to the vulnerabilities tab. Here, this is the verified exploitable tab, which is where vulnerabilities go after they've been verified by vulnerability operations, a human team at SYNNAC that makes sure every vulnerability we deliver here really does matter. But the vulnerabilities I just imported are sitting here under the scanner findings tab. This is where Sara AI comes into play. So a key component of Synack's ActiveOffense offering is Sara, which stands for Synack Autonomous Red Agent,

01:37 and having Sara triage imported vulnerabilities. So, for example, I can click on one of these suspected vulnerabilities here, and you see the information that came in from Tenable, and I can submit it for Sarah triage by pressing this button. What this means is that the Autonomous Red Agent will then triage a vulnerability, which you can see is reflected here in the status that just changed, and you can expect to get back a final status for that vulnerability, either exploitable or not exploitable, to help you sift through the noise and identify real exploitable vulnerabilities that demand your attention. As part of this workflow, we've also made different views available,

02:08 such as a CVE cluster view, where you can see the vulnerabilities you've imported grouped by a common CVE number. And in addition to selecting a single vulnerability, you can bulk select vulnerabilities. And in this example, because I'm selecting one of the CVE clusters, I'm actually triaging multiple vulnerabilities. And after you've selected with the checkbox experience, you can submit for triage in bulk. We also have a software cluster view here available to help you understand more of your tech service in detail. And if I go back to the unique vulnerabilities tab here, you can see that in our example, some of the statuses have changed.

02:38 The statuses are reflected in this column here as well as this flow diagram at the top. Vulnerabilities start by being in the system on this All Count. They are not triaged at first, and then after you submit them, either individually or in bulk, they go into agent review. If Sarah suggested they are exploitable, before they get marked as exploitable, vulnerability operations, our team at SYNACT will review it to make sure that it is. And if they approve it as exploitable, then it will get marked as exploitable. Otherwise, the vulnerabilities may be marked as not exploitable, as seen here. Additionally, we have a couple of other statuses here.

03:10 Ineligible for triage indicates the vulnerability doesn't meet our rules of engagement, so some types of vulnerabilities such as denial of service just aren't fit for Synact's typical rules of engagement, and the unreachable status means that we were unable to interact with the assets at the time of triage. So perhaps there's a firewall setting that needs to change, or perhaps the asset just doesn't exist anymore since the time when you've discovered it and imported the relevant vulnerabilities. If I click on a vulnerability here after it receives a status, you can see we provide a lot of information about how the agent reasoned through the final status.

03:40 So in this example, we have an exploitable vulnerability, and you can see the agent's reasoning for marking it as so. This reasoning exists both for exploitable and non exploitable vulnerabilities to give you transparency into how the agent went about its status assignment. From that page, we could view the exploitable vulnerability report, or we can navigate back to our vulnerabilities tab into the verified exploitable section and see that the vulnerability has now populated here. You can see that the source in this case is from Tenable. That source will make clear what vulnerabilities have gone through your Sara AI triage flow as compared to others that you may find in SYNNAC three sixty five or other open

04:12 vulnerability discovery. And like all vulnerabilities, you can click on this vulnerability, see rich information about it, such as the location, steps to reproduce, any relevant screenshots, and you can mark it as closed fixed, and then go through our patch verification workflow to make sure that your patch verification method was effective. So with the discovery of assets through our asset discovery feature, the alignment of vulnerabilities from Tenable, and the experience I demonstrated on this page where you select vulnerabilities and submit them for triage, you can really see the active offense experience come

04:42 together to help you get an external attacker's perspective on your attack surface.