ESG Report: Helping Mitigate Cyber Risk by Attacking Like the Bad Guys

One of the biggest security challenges for today’s CISOs is how to better mitigate cyber risk. To do this, you first have to understand where and how their IT systems may be attacked next. Penetration testing can be employed to support this need for identifying potential vulnerabilities, by breaking into IT systems to test an organization’s defenses. Unfortunately, the value of traditional penetration testing is limited as it is often treated as a ‘check-the-box’ exercise to meet compliance and customer requirements, diminishing its effectiveness for reducing cyber risk. CISOs need to embrace the value and potential here by adopting the latest tactics, techniques, and procedures (TTPs) used by sophisticated cyber-adversaries. Randori can help organizations accomplish this.

Report Overview

IT organizations are increasingly at risk as a result of the sheer quantity of IT systems that are unknowingly susceptible to attack due to numerous factors, including:

1. A growing number of software vulnerabilities.
2. Ever-changing and rapidly expanding attack surfaces that reflect the movement to hybrid cloud architectures.
3. IT systems that often include connections to third-party organizations.
4. An increase in the technical sophistication and pervasiveness of the threat actors.
5. The absence of real-time threat assessments, due to a lack of continuous monitoring

It was therefore no surprise that nearly three-quarters of the 340 security professionals surveyed by ESG recently believe that cyber risk management is more difficult today than it was just two years ago. Read the full report to understand why ESG believes Randori can help enterprises effectively manage and mitigate cyber risk.

About the author: 

Jon Oltsik, Senior Principal Analyst and ESG Fellow

Jon Oltsik is an ESG senior principal analyst, an ESG fellow, and the founder of the firm’s cybersecurity service. With over 30 years of technology industry experience, Jon is widely recognized as an expert in all aspects of cybersecurity and is often called upon to help customers understand a CISO's perspective and strategies. Jon focuses on areas such as cyber-risk management, security operations, and managed security services.

About ESG: 

ESG is an IT analyst, research, validation, and strategy firm that provides market intelligence and actionable insight to the global IT community.