Why PTaaS is the New Standard for Pentesting

00:05 Welcome to another CINAK cut to the chase. I'm Justine Salisbury. I work in product marketing here at CINAK on our pentesting products. So today, we're gonna be talking about PTAS or pentesting as a service and why a lot of our clients, and probably some of your clients too, are moving to a PTAS model. So what is PTAS? PTAS is, it really says it in the name, but it's a platform that provides pen testing. And so it's really a new, a very new phenomenon in the past ten years or so.

00:37 So traditionally, pen testing delivery was, you would receive a report, you had to schedule often months in advance, and there was a limited number of testers, who would test your attack surface, and then provide you with a report for your auditor. So today, it's it's changed drastically. So a lot of the testing is on demand through an online portal, and you can start or stop a test at any time. There's a scalability aspect as well. So a lot of attack surfaces now have drastically increased,

01:08 after cloud migrations and cloud sprawl, these testers, these PTAS vendors, can really scale with you. So they provide coverage of larger numbers of assets. There's also a lot more automation and tooling. So this can take many different forms. It could be auditing of attack traffic. It could be scanning that's combined with pen testing. It could be attack surface management that's integrated into your pen testing. There's a lot of different continuous monitoring and

01:39 testing out in the PTAS market today. And finally, there's remediation guidance. So traditionally, with pen testing, you received a report, and that was the end of the relationship with the pen tester. But with PTAS, there's often remediation guidance for specific vulnerabilities, as well as patch verification after the test has been conducted to make sure that those vulnerabilities are properly remediated. So how is Synack PTAS different with all of that context?

02:11 As I've mentioned before, a lot of traditional pen testing was project driven. There were long testing lead times. You had to schedule tests months in advance. There was usually just a few testers working for a mom and pop shop locally. Or if you're working for a larger corporation, they had a smaller team, usually under thirty or one hundred folks. So not a large community of testers. And the reports were static. So you just received your results.

02:41 There were not usually any real time results and no remediation guidance after the test. They're also very compliance focused. So they are meant to hand to your auditor and not necessarily your developers. How does that differ from standard PTAS? So as I mentioned on the last slide, now PTAS is on demand, it's scalable, we have different tooling, there's a lot more, you know, kind of tester diversity, although for most PTAS solutions, it is a bit limited.

03:13 And then there's remediation guidance as well. So the SYNNAC model has evolved beyond the standard PTAS model. So on demand testing, we take it to the next level. So it's not just that you can start a test quickly, it's that you can use self-service to create a test through the SYNNAC portal, which I'll show later in my demo. It's also scalable, so you can scale to even more assets than you might with a traditional PTAS vendor because SYNNAC has a huge community of

03:43 researchers that can scale to meet that demand. There's also a lot more automation and tools. So SYNNAC has really invested in its technology and in its reporting to set it apart from other PTAS vendors, which I will also get into when I show the portal in just a few moments. We also have an incentive based model. So similar to a bug bounty program, all of our researchers are compensated for vulnerabilities that they find. They're not compensated based on hours and materials.

04:14 Although we don't have the unvetted type of bug bounty. We have private program, and we have all of our testers are heavily vetted, both for trust and for skill. We also have testing coverage visibility. So all the testing traffic through Synack is captured via full packet capture and is provided to the customer via the Synack platform. We also provide a lot more testing controls. So we have C2 command infrastructure.

04:46 We also have a VPN through which all of our researchers test. We provide a lot more controls than alternatives. Finally, we provide root cause analysis. So SYNNAC has really invested in its reporting so that we can show the top types of vulnerabilities that are reoccurring across your whole attack surface and provide that information to developers so that they can take action and improve. And SecOps integration. So we integrate with Jira, we integrate with ServiceNow,

05:18 we integrate with Splunk, and we really make those results actionable for your team through those integrations. Now I'm just going to show the Synact portal and speak more to the differentiators through the portal. This is the Synact portal. So this is what our customers see and how we deliver our pen testing vulnerabilities and other analytics. So as you can see here, these are all the exploitable vulnerabilities that our researchers have found.

05:48 You can also see that it's broken down by critical high, medium, and low. And these are the suspected vulnerabilities. So I talked before about automation and tooling. We do include a scanner with our pen testing. And all those scanner results are triaged by our SYNACT Red team so that you only receive the exploitable vulnerabilities. So as you can see here, there's ten exploitable vulnerabilities that have been found. And there's a bunch of other vulnerabilities that are being triaged and some that were found to be not exploitable.

06:20 We also track remediation status so we know which vulnerabilities have been closed and which are still open, and you do as well. Another aspect I mentioned was coverage. So CINAK does keep track of coverage. So here we have scans and the status of those scans. We also have SRT insights on the right. So those are the number of researchers that have tested your attack surface and the number of hours that they've tested it for.

06:56 For root cause analysis, we do provide vulnerability categories. So you can see here different vulnerability categories that are reoccurring and the percentage of your total vulnerabilities that those vulnerability categories account for. So this is a great way to see what's reoccurring for your team. So maybe your development team is weaker on certain vulnerabilities, and so they're reoccurring within your attack surface, and you can address that through training.

07:30 This is the Coverage tab. So this provides more detailed coverage data and really shows how often different assets are being tested. So this is an example assessment and it shows the different domains, how often they've been tested, the types of classified traffic, so the types of attacks that researchers are trying as well. So you have that and it's all auditable. And then also the number of vaults that have been found for that particular domain.

08:07 That about wraps it up for now. I hope you better understand the difference between what Cenac does and other PTAS vendors. And we look forward to hearing from you and starting more conversations around PTAS and what CINAC provides. Thank you very much.