Meeting the Exposure Management Challenge: Key Use Cases for Success | @OfficialRapid7 #SolutionSpotlight

Broadcasting from our studio in Boston, Solutions Review is proud to showcase Rapid7 in the Solution Spotlight, an inside look at enterprise technologies.

I'm Doug Atkinson here at Solutions Review, and welcome to this Solution Spotlight featuring Rapid7 and focused on meeting the exposure management challenge: key use cases for success. With the growing cyberattack surface sprawl, being able to zero in on the most critical exposures is a huge challenge. So today we'll examine a collection of use cases driving the adoption of attack surface and exposure management technologies. The idea is to unlock broad visibility across your tech ecosystem, both internal and external, enabling you to pinpoint security gaps, discover shadow IT, and gather the relevant risk context that accelerates prioritization and remediation activities. And joining us to walk you through the Rapid7 presentation today is Jon Schipp, Senior Director of Product Management. Jon, thanks for being with us.

Happy to be here, Doug. Thank you.

Well, I've been looking forward to this conversation, um, not only because you've been at Rapid7 for over 7 years, but on your LinkedIn you're also, uh, referring to yourself as the Ric Flair of cybersecurity. And I'm going to need to dig into that at some point. But before we get going, because we— I know we've got a lot to cover, tell us a little bit about your journey through the cybersecurity category.

Yeah, absolutely. So first and foremost, I've been a practitioner. I started my career as an incident responder and secure as a security engineer. I did this at scale at the National Center for Supercomputing Applications. So not only to talk in the talk, I've walked the walk, so to speak. You know, over the time I worked at startups and I eventually I worked at Rapid7 where now I lead our product management teams around our exposure management attack service capabilities. As you mentioned, I've been here about 7 years. I also have been a broad industry experience across detection, response, managed services, and other areas. So I'm just kind of all well-rounded in terms of cybersecurity. I love this stuff. I live it and I breathe it. Happy to be here.

Yeah, well, I'm glad you're here. Not only we have not had Rapid7 on one of our Spotlights, which we're pretty happy about, but also you guys are neighbors down the street in the Boston area. So always happy to have a highly successful local company join us in the Spotlight. Before I give you the floor though, I want to just set expectations that we're going to have a few slides and some case studies, and then a demonstration of Rapid7. And then I'm going to come jumping back in over the top rope with some questions for Jon. And so, Jon, I will hand the floor to you. And when you're getting ready to wrap it up, just give me the high sign and I'll come in.

All right, let's do it. Okay, so today I think the first thing kind of set the backdrop of this is our vision, how we kind of came across this attack service management challenge that we're hearing from our customers in the broader market over and over and how we kind of fit it into our company vision. So we'll start there. So the first thing that we've kind of done is we've interviewed customers. Like I personally interviewed 70+ customers over the course of 6 months and asked them what are their most important problems that they're facing today? What are those challenges that keeping them up at night? And we've learned through a lot of this research that it's just that organizations lack the appropriate or accurate visibility in their environment. They're spending a lot of money on a lot of different tools. They're paying for vulnerability management solutions, cloud security posture management, endpoint detection, endpoint protection. They're paying for identity solutions and so on and so forth. We could all name, you know, another set of categories of tools that customers are paying for. But the problem that they're having is that the more tools that they pay for, the different number of key pieces of data in their environment are no longer aligned. So as a specific example, if you look at the funnel here, we have a situation where customers do not know, or organizations do not know the number of assets that they are responsible for protecting, which is a huge deal for a security team. Take a look at this column, you see InsightVM, which is Rapid7's vulnerability management scanner. It could be any scanner though, it could be Qualys or Tenable. They also have a cloud security posture management. In this case, we're using Wiz, but it could be Rapid7, Insight CloudSec, and so on. But you can see each one of these tools sees a different number. Insight VM sees 60,000 assets. Wiz sees 35,000 assets. And you may ask yourself, why? Well, one, Wiz specializes in the cloud. It's going to see more cloud resources that compute than a traditional on-premise, even hybrid vulnerability scanner like Insight VM. In addition, at the very bottom, You'll see if you're a Microsoft shop and you have Active Directory to control your machines and user identities, et cetera, it's only going to see 40,000 assets because it only sees the machines that are joined to the domain controller, that they're added to the Active Directory infrastructure, if you will. And so you can start to see how tools are specialized in their viewpoint. And as a result, they say different things about the number of assets in their environment. We use this specific example because it highlights the continued effects of that. The cascading effects are that if you can't agree on the number of assets that you're responsible for protecting, then it's very difficult to agree on the number of threats that are going on in your environment, the number of vulnerabilities exposures are in your environment, and the number of compensating or security controls that are in your environment. And so this tool sprawl or data sprawl, depending on how you look at it, actually impedes organizations' abilities to actually see their true attack surface. And so what we want to do to help solve this challenge is we want to bring all this data together, unify it, correlate it, collate it so that we can give customers the best view of their attack surface and get them closer to that true number of exists in their environment. Instead of seeing 10 different numbers for their assets, we say there are 68,234 assets in your environment because we're pulling all this telemetry across your organization's tools into one place. And so with that said, there's a few quips that, you know, many of you have probably heard online or in presentations that the industry uses. One that I like is you can't secure what you can't see. It kind of seems self-evident at the surface, Another one at the bottom here is that you can't trust your data if data sources are in conflict. And this is, you know, really important on the data sources because we're in an industry where high-fidelity data matters. It affects your ability to make the right decisions in prioritization and response and remediation, which if the decisions are wrong because the data is wrong, that leaves your business at risk. And so we need to prioritize the things attackers can take advantage of the most, their likelihood and probability to succeed. Those are the things that we have to go after in the ATT&CK SERP. And so with that said, we've come to our new company vision. This is something our CEO Corey talks about when he's presenting publicly or with internal town halls, is that every customer has the ability to monitor 100% of the attack surface. We wanna be able to do this in real time and with confidence. And we believe personally that we're further away than a lot of, or further ahead, excuse me, than a lot of the industry today because of the investments that we've made over the last 8 months. As an example, on July 8th, we purchased a company, we acquired a company called Noetic, which is one of the leaders in attack surface management, specifically around cyber asset attack surface management, which is a, that's a mouthful, but CASM is the acronym that the industry is using to help find and solve all these different pieces of telemetry that differ and bring them together in one place. So with that said, we've made an investment in CASM. I was on the M&A committee myself, by the way. I looked at a lot of vendors across the industry. I flew out across the US, met their founders, evaluated their leadership teams and technologies, and we figured out that Noetic was the right solution for what, for us. It had the best algorithms for correlation that they built over the course of 3 years. We put it to the test with customers, early adopting customers, as well as internally in our production environment, and we had great results. And so we feel confident that we are actually able to kind of solve this big problem that I just talked about, having this tool sprawl and this data sprawl across the ATT&CK service today that's impeding, by the way, this is, it's not just about the data, but you have to think about what are the outcomes. So it impedes your ability to have an effective detection response program if you don't know the number of assets and threats in your environment. It impedes your ability to actually understand the vulnerabilities and exposures across your organization if you're missing machines and identities that are not being scanned or assessed for vulnerabilities. So this is such a foundational thing where security teams need to go back to basics and make sure that they have the coverage where they need it across their environment. In addition to this, this acquisition, we have also redeveloped the Rapid7 platform. And so on the left-hand side, you'll see in the smaller screenshot, the older Insight platform. This is, if you saw it once on our website or you're a customer of ours, or you've seen it in the news, the Insight platform is what we talked about prior, prior to July this year. And it was a set or a suite of products that solved many different issues across cybersecurity, detection and response, vulnerability management, application security, cloud security posture management, more. But each one of these products became a tile, and the users have to click on a tile and open it up into a different tab. We've actually modified and kind of re-evolved the way that we're bringing our platform to market with a, with a platform with a capital P. And this is really about how we bring a platform of capabilities, not just products. And so now when you come in, you have all that data that we're pulling together that we're solving for in the funnel that we saw earlier, the different assets, identities, and so on and so forth. We're bringing that into one view. So customers start to get an overall view of their security program in one place. And then they can pivot into the capabilities they're looking for, whether it's detection response, if they're investigating a threat, or they're worth— they want to dive deep and do some remediation from the vulnerability and exposure management pieces of the platform and so on. And so we'll actually demo this live. You'll see how this platform evolved. And I think it's just really— I've been in this industry for a long time. Not a lot of other platforms are kind of making the right investments, in my opinion, in this way. You'll see how ours is starting to really come together. And it's a really powerful thing that leads to more efficient workflow or efficient workflows for our security practitioners, uh, as a whole. It also makes it a lot easier for us to innovate now that we have this data layer underneath that provides all that to customers. So with that said, we're going to quickly highlight the Rapid7 platform as a whole just to kind of give you a broad understanding of what we're doing and how this new data piece fits in. Again, the data piece is that Cyber Asset Attack Service Manager capability that we've purchased from Noetic, and bringing that in the platform, how it actually continues to give analysts in our vulnerability management more context so they can make better decisions with prioritization. And so when you look at this screen, you're going to see a little highlight here on the bottom left here. So before we had Rapid7's native data collection, this is what our scanners saw. This is what our agency and our tooling that we've built over the course of 10+ years. Now what we can do to feed into our platform is we can bring in all kinds of other security and IT and business telemetry that we missed previously. So we can connect to all the 100+ tools that customers are paying for across their environment, bring that into the platform, put it through our AI engine, and actually let customers see more about their attack surface as well as power the capabilities of exposure management, detection, and response, giving them more visibility. I would say unparalleled visibility in the market today because it would be very difficult to do this if you're building this all natively. And so the Chasm is the secret sauce that kind of brings this data together to give your analysts the best view across their entire environment. Now with that said, we brought all this to market on top of that new Command platform. We have 3 products. We launched these on August 8th— I'm sorry, August 5th at Black Hat. And these 3 products are a part of our exposure management family of products. We're calling it Exposure Command. The first one is Surface Command, which is all focused on attack surface discovery. It will find all the assets, identities, and more across, across your ecosystem of tools and your organization, whether it's multi-cloud or on-premises. On-prem or both hybrid approach, it'll bring all those together. It will also scan the internet for any public-facing low-hanging fruit like IPs, servers, etc., that are out there waiting for attackers to take advantage of. So it combines what is called external attack surface management and CASM into one solution for a cost-effective price point. It is the only solution in the market today that we're aware of that brings both views, the internal and external pieces of attack surface management, in one solution. In addition, moving forward, we went to Exposure Command. And so in Exposure Command, if you have, if you need to go beyond just the ATT&CK service capabilities and you wanna add native vulnerabilities and exposure telemetry, including our Insight CloudSec, Cloud Security Posture Manager capabilities, our SOAR, the ability to kind of view your security program across hybrid environments and measure, manage your overall cyber risk, you go to Exposure Command. And then on the right-hand side, we have Exposure Command Advanced. And this is really about— it's really for customers that are multi-cloud. They're large and have a growing enterprise in the cloud footprint to scale their business. They're operating in AWS, Azure, GCP, and they need more specific cloud capabilities like real-time data harvesting in cloud. They need infrastructure as code scanning and other more advanced features of the cloud. They're purposed into Exposure Command Advanced to make sure they have the needs for them to continue to scale their business.. And with that said, there's a market perspective here, right? And so obviously Gartner is the market leader when it comes to exposure management. They coined CTAM and the exposure management field. And within Gartner, you now, you have 3 pillars, 3 main pillars. One is called the attack surface, which I have highlighted here in orange, and how our Surface Command Attack Surface capabilities fulfill that bucket. We also have our native vulnerability management solution that we've been in the VM space for a long time, 20 years for Rapid7, and one of the early and leading, still leading one of the leading VM players in the industry. And so we can rely on our VM technology to kind of solve that third, that second bucket. And lastly, we have the validation piece. You can actually use our Vector Command solution, which is an add-on top that actually will go ahead and pen test all of the external-facing assets in your environment to validate those exposures are real and help you take them down or wherever the necessary actions are, depending on the rest of that, the environment. And so this is kind of how we fulfill all three buckets in the Gartner's exposure management classification. And then from there, we're going to get into what we call the solutions. We're going to dive a little deeper into some of these products, and then I'll pivot to the demo. And so that first product again is Surface Command. It's a completely vendor-agnostic approach to attack surface discovery. And it, again, I want to highlight the fact that it does internal and external attack surface management in the same solution. This is not something that the market typically has today. They are separate. You are going to have to go through separate companies. And we'll talk about that a little bit in a second. And then we also do this over hybrid environments, so both the endpoint and the cloud. So it doesn't matter whether you have S3 buckets or compute in the cloud, or whether you have Active Directory in your workstations and servers on-premise, we will take a look at both. We will map out your attack surface for you across hybrid environments so you can see how the dots are connected from your 3 different environments. Because we know today that attackers— you know, listening to the CEO of Bloodhound talk not too long ago, and they were talking about how attackers were actually compromising Entra ID in the cloud with Azure and then somehow making it down into the internal network. And so everything is highly connected today depending on the network's configuration and all the technologies that we're using. So we have to be able to have that broad view across your on-premise and your cloud infrastructure, internal and external. It's just a necessity. And the way that we collect all this telemetry is by having 100+ connectors across the tools that customers are paying for today, your IT applications, your security applications, business applications and more, and we'll demonstrate some of that shortly. Before we do that though, I do want to talk about the industry a little bit because there's been an evolution the way that we approach attack surface management. You think about the, what I'll call the legacy approach to attack surface management is the asset inventory on the left-hand side. And so these are Lansweeper, your ServiceNow CMDB, and other approaches to actually trying to figure out the number of assets in your environment. But the problem with this approach is that it lacks security context. Now remember the word attack in attack surface, it's security focused. We have to have adversarial attacker behavior in the mix to understand how to prioritize. And so the old approach of asset inventory and CMDB will not cut it today. You're limited to what the vendor can see, usually through some type of scanner that scans the network. But you're actually not also pulling in all the other security telemetry. A lot of stuff is missing. In addition, it's very difficult for these legacy approaches to keep up to date. We notoriously see almost every customer I've talked to— actually, never have I had a customer I talked to that said their CMDB is up to date. It is a problem because it's such a manual effort the way the CMDBs were designed. And so that is the legacy approach that won't help customers fully identify and map out their attack surface. It is one input into the attack surface. It doesn't see the whole thing. Now, take a look at the bottom of this particular slide. You'll see the illustrations that I'm using to actually highlight how much they see. It's kind of like a heat map. The more orange or red, the more visibility we see in a specific area. And you obviously want a full complete circle to see the most. So then in the last 7 years, EASM, or External Attack Service Management, kind of kicked off. We have a lot of threat intel players kind of joining that space now. And it's super important because you need to know what are your public-facing IPs and domain certificates, et cetera, that attackers can access as low-hanging fruit. They can go install Nmap or Metasploit on their laptops, and they can go attack this low-hanging fruit. And so it's an easy way for attackers to get into the environment. Now, the problem with EASM, while completely valuable and absolutely necessary, is that it only sees the external. It only sees the perimeter of the network. As you can see by that ring, there's nothing inside it. The other challenge is the— is EASM is sold as a separate module. Most custom— most companies out there are vendors that supply attack surface management capabilities, really just provide EASM modules. And so you're missing that internal that internal view that we talked about how it's so necessary to have them together because they're connected, right? It's a networked world. And then if you were to go into the, the middle category, which is CASM, this is the last 4 or 5 years, I would say, and that's the Cyber Asset Attack Service Management. It's meant to address the problems of the lack of visibility in the internal attack service along with all the security telemetry. So it finds internal assets, identities, compensating security controls, and has, depending on the vendor, has a number of telemetry typically just vulnerabilities and exposures, but is often missing threat telemetry. And then as a result of its focus on the internal, it lacks a native EASM. And so vendors like Axonius and Armis and JupiterOne, et cetera, they don't have a native EASM capability out there. And so you have to go, like I said before, you have to go buy a separate module from another solution and then integrate it in that way. And so the integration and the workflows around there are subpar as a result. And then just in the last 3 to 4 years, you're starting to hear more about risk-based vulnerability management. Just to kind of key off some of the industry players, you have Nucleus, you have Vulcan, you have Brinca, and some others. And this is really a, a chasm approach to exposure management specifically. It really just focuses on aggregating vulnerabilities and exposures across your environment, along with some business context to help them help your customer, help your organization, your teams prioritize better. And so this is specifically for organizations that, specifically large organizations that have multiple vulnerability scanners as a primary use case. You may be paying for Rapid7, Tenable, and Qualys, and each one of them may have a little bit different perspective on the environment. One may miss a vulnerability that the other has. And so you want to take all those vulnerability scoring, put it in one place, and add a risk score on top of that. So you get an aggregate view of your vulnerability exposures. And that's kind of the problem and challenge that RBVM is going after. And now I want to finalize this with Rapid7 Surface Command, which we believe actually is a combination of all 4 of these things. It is a complete CASM powered by our acquisition of Noetic. It is an EASM because we actually built an internal, or internal scanner, um, in Rapid7. Sorry, my, uh, headphone fell out. In EASM scanners, we have a native scanner in that, and then it also combines risk-based vulnerability management capabilities so you can generate customer scores across your environment. And we did this from a completely vendor agnostic approach and we have built-in data transparency. If you remember the vision that we talked about earlier, where confidence in your data was so important, to give confidence into data, you have to have a layer of trust built from organizations and your customers. And so the way that we actually do that is we provide a number of capabilities to let customers see how well the data is working for them. And do I have duplicate data in my environment? Is the APIs that I'm connecting to fulfilling the property that they said they were going to do, et cetera, et cetera. What are the correlation rules that are underneath this that my system is relying on telling about my environment? What are those? We make those transparent to the customer. And then we also aggregate vulnerability exposures, threat data, and more all in one solution. And so that's kind of our approach. And while we're kind of going all in on the ATT&CK Service Manager, again, it's, it's a part of our company vision that you saw earlier and something that we're using to empower exposure management use cases and other use cases in the Rapid7 platform. So with that said, I'm gonna do one more and then I'll pivot over to the demo. So we're talking a little bit about Exposure Command, just to highlight. So remember, Exposure Command is our exposure management product, and this is how we're going to market it, bringing not just ATT&CK service capabilities but also bringing vulnerabilities and exposures from our native scanner and agent in one place. So it's powering that core telemetry. You don't need another solution out there. You can have— you can consolidate, uh, your platform or your security program with Rapid7 at a pretty low-cost solution versus buying and put— putting together several different vendor solutions at once, and then allowing you to actually measure and manage your overall security program within the Rapid7 platform powered by all this data. So we become the control panel for your risk program, threat program, and more. All right, so now we're going to pivot into the platform because I know you guys have been very eager to see the stuff come to life and see how you can leverage in your organization. And so what we're going to do is show off our dashboard homepage of the new Command Platform. Platform. You'll see in the left here it shows it's— we're in the Command Platform. It tells what product we're actually in. So I'm in the Exposure Command Advanced Suite. I have all the bells and whistles to manage and monitor my entire security program from a risk perspective. So when we get in here, we can see immediately how many assets I have, how many identities, external assets, those that are running in the cloud. And this is all— it tells you in the little tab here, or in the highlight— it's all calculated by the relevant Surface Command connectors. And so we're pulling in that telemetry, the 100+ connectors we have, you've connected as a customer, into the environment, correlating it all down to get you that, and deduplicating it to that accurate number of assets, identities, and more. In addition, we'll actually show off, or we'll actually have your coverage of your gaps in your environment. And so you can see that we have 56% of our assets are covered with endpoint security. Now, 100% is the ideal approach because if you do not have 100% coverage, then you have some percentage of assets that are missing or missing monitoring for threats. And when I say endpoint security, this is vendor agnostic. This is not Rapid7's Insight agent. It is any agent. It could be CrowdStrike, it could be SentinelOne, so on and so forth, Defender. We are vendor agnostic. We get you the best visibility across it so that you're not dependent on one type of tool. In addition, we'll give you some coverage gaps on the assets with vulnerabilities assessed. In this case, we're saying 78% of our environment is being assessed by exposures and vulnerabilities. Again, vendor agnostic. Doesn't matter if it's Rapid7, Qualys, or Tenable. We just want to make sure that you're covered and you have the visibility. And then we also have identities as a first-class citizen. So we'll capture security controls like MFA missing, et cetera, in the last one. So from here, we can then dive in into some other graphs and charts depending on what we're looking at. But what we're going to do is we're going to go to the ATT&CK surface menu. And you remember I highlighted how we revamped the platform. Now we have these menus of capabilities that you can drag down. They load very fast. Now if you want to jump in and see your ATT&CK surface overview, you got the page here. We go a little bit deeper, on-prem versus cloud assets, regular identities versus admin identities. Priority actions, our coverage across all the tools that we have in our environment, and then we get a view of our external attack surface. You can see I have 4,191 services running exposed on the internet. That's a problem. I probably want to investigate that. I can either click here or I can go to our external attack surface menu and I can see all the seeds out there that we're scanning for. And so I can add a new one if I wanted to. I'll just say, just for example, uh, mycompany.com. I'll spell it right. If I click add, which I'm not going to at the moment, it's going to go scan the internet for all the subdomains and IPs related to that, and they're going to pop up here as they're found. In this case, I have 13,000 external discovered, uh, machines or IPs or domains, etc., in the environment. And I can click on any one of those, see what ports are on there, what CVEs, etc., and whether the security team actually accept this into the attack service and, hey, no, this is actually— isn't mine. And so lastly on this, we also have our Vector Command solution integrated in here as well. So if you want to hire our pen testing team to actually validate the exposures on your public-facing internet, we can do that directly for which is a very powerful capability. So you get breach simulation service all built in. From here, what we're going to do is we're going to go into the assets page and it's going to pivot into a wider view because there's a lot of stuff going on here. So our assets page is that aggregate view of all the systems, identities in your environment. Okay, so now what we're going to do is we're going to look across our ATT&CK service, which currently has 67,000 assets. So it represents a pretty large enterprise environment. And so what we're going to do is we're going to try to find those assets that are lacking basic security controls such as endpoint protection or EDR. And this is because we have to go back to basic, the foundations have to be covered in our environment because if we don't have endpoint protection or detection, we suffer the risk of having threat actors get on a machine without that. And then those attacks fly under the radar, right? They go missed. And so this is something that we actually see in our MDR business, by the way, which is one of the largest in the world. We're not just known for vulnerability exposure management, our threat detection response, which is one of the fastest growing. And so with that, we've seen from our SOC, who serves thousands of customers, that whenever, you know, in their research they've done over the last 18 months, they found that 30-something percent of initial exploitation events from attackers were on machines that did not have EDR or EPP. Attackers look for those, they targeted those machines because they knew they would fly under the radar. And then it requires other telemetry to come in to find the attacks going on, such as the network traffic and et cetera going on in the environment, and then things from their posture management tools. And so what we're going to do now on that specific use case is we're going to search our ATT&CK surface for machines that are lacking those controls. And so the first thing that we're going to do is we're going to surf— search for machines that lack an endpoint solution. We're going to use SentinelOne as an example. Now it doesn't matter if it's SentinelOne, it could also be CrowdStrike, it could be Rapid7 or Microsoft Defender, or all four if you want. And then what we're going to do is we're going to filter down on assets that don't have SentinelOne and are running Windows. And so this case, we'll filter on Windows as our operating system. And we do this because Windows tends to be the more vulnerable targeted operating system because of the market share that they have that attackers go after, as well as some of their policies. In addition, what we're going to do is we're going to go then filter that down a little bit further. And for the most important systems, in this case, we're going to go for server-class systems in the environment. Because as you guys know, server systems typically have business function that are vital and they have access to business data. And so we went from 67,000 machines down to 1,558 that, again, lack endpoint detection or protection, are running Windows, and they're a server-class system. What we want to do is we want to go a little bit further. 1,500 is a much better number, and it's more manageable for the team to go remediate. But we actually want to go a little bit further and pinpoint those that are further up the chain in prioritization. And so we're going to filter on vulnerabilities in the environment that are exploitable. This is where we can leverage our vulnerability exposure telemetry in this view to kind of filter that down further. And so we're going to say vulnerabilities exploited in the wild is true. And then from here, we're going to have a much better view of the systems that the security team should go pinpoint. And so we went from 67,000 machines down to 1,558 to 373, a much more manageable number for the security team to go remediate, work with IT to make sure attacks aren't flying under the radar under those systems. Systems and actually bolstering their threat detection and response program. We can do the same thing for vulnerability management. We want to make sure that we have all the machines assessed for their exposures and vulnerabilities and so on and so forth. Again, solving the basics across the attack surface. Now what I'm going to do is I'm going to clear that filter and we're going to pivot to identities. We're going to show you some additional capabilities. So with identities, they're a first-class citizen in our platform. We can actually go in here and we can filter for all identities that are lacking multifactor. So we'll say multifactor is false, multifactor authentication, meaning that these users are more susceptible to password attacks because they're not getting that push button on their phone, that notification that this is— is this me? In addition, we're going to filter those down on those users or identities that have administrative access to some system. Now you'll see here in this list that we have some that say true or false. You're like, wait, what? Maybe why is that? Well, it turns out you can have multiple applications that have multifactor on or off, and we'll actually dive in that a little bit. So we're going to do is— so the Search is accurate, is showing you all the users that have multi-factor set for any particular system, this false, as well as all users that have, have an administrative access to some business application or system. So we're going to click on Abdullah as a user, we're going to pop him out and you can see where, where our Kasm really shines. We can actually see all the data sources, the source of truth about this user. This is what Azure Active Directory says about this user. You got the principal name, their location, the department that they're in, additional properties SMTP proxy, whatever you need from Active Directory. In addition, we have what Slack says about this user. We have the information about ServiceNow says, you know, before, so we got phishing information. They're 22% likely to click on a phishing email, Google Workspace, and more. In addition, we aggregate all this information up and we correlate it into the general tab. So it takes the best information from all these data sources to get to the analyst. And then from here, we can actually see the correlation information I talked about earlier, the data, the transparency features. You can see why and which keys and values were actually prioritized. And others, and you can actually change those to match your IT environment. And so in this case, we have multifactor set to true for ServiceNow but set to false for Google Workspace. So that's where you have to kind of dig into the user because there's many different accounts, many different systems, and you want to see the controls across all of those. And then what we're going to do is we're going to actually figure out the blast radius for this user if an attack was carried out. We go to View Graph. And now we mapped out this particular user. Again, it's a high-risk user. They do not have MFA enabled, and they have administrative access to a system. Their primary machine that they use in their environment is this HubSpot Enterprise machine. So we're going to click on that a little bit and find out more information about this machine. So we click on it right here, click, uh, play, and then now we actually get all the information about this particular machine. So hubspotenterprise@nc.com, ServiceNow's got information. Rapid7's inside VMs, got a vuln scanner on there. Intune, Defender, so on and so forth. So we can see the vulnerabilities that are on this host right here. Here's all the CVEs. We can enrich those with other properties. So we got NIST NVD, FIRST EPSS, we got SysIQ, but not for this one. And then what we can do here is we can actually see what are all the attributes to this host, what are the mitigations and security controls. So in this case, antivirus and malware is on this host. Completed by Defender. Same with behavior prevention. We also have vulnerability scanner from InsightVM, and there's an encrypted disk on this host. So now I'm going to go back and see they got some security controls on this. But what I want to do is I want to dive in and see what all this host has access to. So let's click on the network button, and we can pull in network telemetry to map out your network as well. And so I'm going to clean this up a little bit because we don't need all this core information. I really just want to show you the key things. And so let's do this All right, now you can see this Abdullah user has access to HubSpot, which has access to this bus network, 10.10.10/24. So let's dive into that. And we're going to see here that we actually have a ton of machines that this attacker, if they were to compromise Abdullah's account— again, no multi-factor administrative access— laterally move into this network that has access to app servers, load balancers, email server. Looks like it might be a production network that we should be aware of. So we should then have the ability to communicate with the IT team about this user's access because we can show and demonstrate, hey, there's significant blast radius if this machine or this user would be compromised together. And so that kind of shows you how you can map your attack surface using all the telemetry from your environment. Next, what we can do is we can actually go into our workspace and show you some more advanced capabilities. And so if you want to find— because we're pulling all this telemetry, we can do lots of searches on. If you want to find your users that are most prone to phishing using KnowBe4, you could then search across all the different telemetry that we have and then get them ranked. And so, okay, Valentin is 99.8% likely to click on phishing. He might want to be in a watch user list, as an example. He might need to go through some additional phishing awareness training. And so you have the ability to kind of use this telemetry to make business decisions and prioritization. We can also build out a custom risk score across compensating controls. This is a more advanced example example, but I have this as a pre-filled, a pre-filter query. What it's going to do is going to look at all the different types of mitigations and complexity controls across all the assets in your environment and then compute them into a new risk score, uh, similar to an RBVM use case. And so in this case, we can see which machines have vulnerability scanners or which don't, uh, what is their score from that, which one has CVEs, which one has CrowdStrike or is not, has a public IP address, has a ServiceNow information, just stored ServiceNow information in the database, because that gives you a business owner, right? Typically, if they have ServiceNow is up to date, but if it doesn't have that, we actually want to reduce your risk score. And then you finally get your custom risk score on the right-hand side. It kind of shows you just how powerful this system is through its query language, which is all available in the workspace and saved queries functionality. And lastly, we do have some automations built in. Any query can be turned into an automated workflow that does things like response remediation. You can do ticketing. You can call out to another vulnerability Scanner to remediate your vulnerabilities. You can call up a tentacle to rescan hosts after new information, send emails, all types of ticketing, notification, remediation, response workflows. And this integrates directly with Rapid7's Insight Connect, which is our SOAR solution. So you get access to thousands, literally thousands of different actions. I think we're probably over 10,000 actions across our SOAR product, which has been in development for over, over, uh, 6 years. And so that kind of highlights how Rapid7 give you a comprehensive view of your attack surface. Anything that's queryable can become a dashboard. So you can start to get an overview of your controls there. You got your EASM data all in one place. You can see your top services that are exposed, uh, your, your application breakdown, those services. And then we also give you a view into the data. And so this going back to the confidence piece, the transparency, we want to tell our organizations so they can have trust in the ATT&CK service, tell them how we're making the decisions that we're making. And so we have 219,000 raw assets. We can then reduce that to the number that we correlated using our 3-year built correlation engine. So we get down to 67,000 assets. Here's the ones that are active. We're going to break down by cloud provider, on-premise provider, some normal IT stuff. But the thing that really stands out is our correlation effectiveness. We can actually go here and see how many assets each data source is seeing that we've connected, how many are duplicates, and that helps our, our customers actually troubleshoot and get better fidelity out of their data. Data. So let's take a look at this as an example. And so we're going to pop up this one, which is our, this is our correlation index. And so at the top here, you can't— I got to change the color. I have dark mode enabled on this, so I apologize. But 13,000 assets are being seen by 4 different tools. You can see that green bar between here. And those tools are Insight, IDR, VM, Defender, and so on. But we have 10,000 assets here that are not being seen by any of those tools. So our correlation is not good. That could be a result of misconfiguration. It could be the result of bad permissions and things like that. So it helps your team actually prioritize and get the correlation down, because what you want to see is a perfect line through all these sources. And there's other ways that we can actually do this. I won't go into those today. We have multiple features that give this data transparency to help our customers make the most and get the best accurate view of their environment. So with that said, We're gonna go back to the homepage and we're gonna jump into the risk view. So we talked about the ATT&CK surface, right? That was our Surface Command product. And as, as if you purchase that or have that as an add-on on the Rapid7 platform, you get this visibility across any other Rapid7 solution that you own. What we're gonna dive in now is our exposure, excuse me, our exposure management capabilities. And now we jump into the risk view. So you can start to see how to measure and manage your overall risk program, for example, your risk view. And this was something that our CISOs typically like to report for customers as well as upper level, uh, BM managers. Metric gives you a view, a hybrid view, actually. It's actually pulling in data from our cloud security view as well as our on-prem view to give you the number of remediated vulnerabilities, number of assets, accepted vulnerabilities, and so on and so forth. The common metrics that we expect from our, from our VM team. What is our vulnerabilities versus risk score trending over time? How much assessment remediation are we doing? How many of them are exploited in the wild? And then this one is a really interesting graph too, is our new and remediated vulnerabilities versus risk score. So you want to make sure that the pace of new vulnerabilities come in, specified by the dark bar, is lower or at least at par with those vulnerabilities that are remediated. You can see we're actually out of whack here. We have 135 new vulnerabilities coming in, but only remediating 17. And so this is a signal to upper-level management that we either need to add more process, improve our process, add more headcount, or find ways to scale this so we can reduce and increase— reduce our risk and increase the remediation. Of our vulnerabilities to keep our risk score low. So once you start to see all this, there's tons of graphs here around common metrics with customers. We're not going to get into all of them. But once you get here and you start to see how to, you know, where I am at in my current state of my risk program, then you want to figure out how do I improve it? And that's where you go to our Remediation Hub. This is again a hybrid approach. We don't separate on-prem versus cloud to see the total risk across my environment to see, hey, how do I reduce that risk score the most? In this case, we have the top solutions. There's 7,000 solutions available. Available. This first one is telling us to upgrade Google Chrome and that we have a certain number of impacted assets in our environment. And so we have thousands— or actually, we have 400-something impact— 4,171 impacted assets, excuse me. And this solution is related to 3,410 vulnerabilities across all those assets. And so we can see where those assets are. Here's the sites. We've got some of Melbourne, Arlington. Here's the operating system. Here's some custom tags. We've got some sysinfo around these. Again, this is going to reduce our, our risk the most. So we got information from the cab environment that says, hey, attackers are actually exploiting this in the wild. And we got our remediation instructions here, and then also the— we can kind of dive into details here, and then also the number of vulnerabilities across all those assets. And so these are the things that the security team can go prioritize with IT to make sure they're reducing the risk the most. And the last thing I really want to show you, kind of how we bring all this together, is from here you saw how you get a broad view of your attack surface, right, at the top. You can see everything that you couldn't see before because we're aggregating it all together. Then you saw how we can, you know, quickly measure and manage your overall risk program with the executive risk view, the remediation hub. Now the last thing that I want to show you is how we can actually help you go deeper into your remediation and triage of vulnerabilities and exposures. So we're going to do this with a cloud example. We're going to jump into our cloud posture, and what this is going to do is call out to our CNAPP capability. And the first thing that we're gonna get is a summary including resources with toxic combinations. And so these are the most important things we should probably go after when it comes to the cloud. So we have 2 resources in the cloud that have a business-critical application access with critical CVEs and are publicly facing. So we're gonna click on that. We're gonna dive in a little bit deeper, and we're gonna see our in-depth cloud security module. According to this risk toxic combination of the layered context here, which adds up of the different things around this list, we can see that 2 resources process. By different things, I mean telemetry. Pulls in different cloud telemetry to kind of find the resources that match it. And so in this case, we have two different resources that are vulnerable to this, and so we're going to click on the first one. You can see the names, Sales Demo and R7 Sales. Looks like we got this, uh, the pesky sales team putting their demo demonstration boxes on the public-facing internet. That's not a good thing. We gotta demo to customers and show them our value, but at the same time, we don't let attackers get through. And so in this case, we have to take some action here so we can actually see We can see why we're classified the certain risk score, 1,000, which is the highest, 'cause it's publicly facing, business critical, and we have a ton of vulnerabilities and insights on this. We can then take some actions. We can say, hey, let's modify a security group. Maybe we need to put some ACLs in place, not have to shut the thing down completely, but maybe we also just need to shut it down. In this case, we can terminate the instance, stop it, pause it, disassociate the IP, et cetera. And the last thing I really wanna show is how we can help security teams help master the cloud, 'cause the cloud environment is very complicated. Complicated. It's, it's much more complicated and ephemeral and fast-paced than traditional infrastructure. You can deploy, you know, cloud resources in seconds, even milliseconds. And so we use our attack path capability to kind of map the cloud out to show you how an adversary would reach this host and what the blast radius for that is. And then we're using our features overall, but showing you in a specific view how you can go deeper into the cloud security context. So here we have the public There's an internet gateway that's been deployed, a routing table, and I can click on any one of these to get more information. There's the VPC, there's a NACL group that actually allows the traffic to go through, and then ultimately we have that EC2 instance in question, that pesky sales compute instance. From here, we can see we have an SSH key, it's being run from a specific private image in Kubernetes, so there may be vulnerabilities in that image that we need to go resolve. We can double-click on that. But the other thing we wanna see is that we're connected to a VPC. I'm gonna double-click on that, and now we can see we actually have we actually have more EC2 instances. So if this machine was compromised, there's lateral move to 3 more different instances on that same network. We can each get additional telemetry from that depending on how you wanna click in. So this kind of shows you how we can help customers solve the complexity in the cloud landscape through some visuals, show them the attack paths that they're facing from adversaries to help them work across their cloud ops teams or remediate those particular attack vectors. And so with that said, I think Doug, I'll turn it back over to you. It's kind of given the lay of the land of Rapid7 exposure management capabilities. So hopefully that was important.

There was a lot there and, and I appreciate the amount of detail. It's remarkable. So you've been there for 7 years, you've seen the evolution of Rapid7. Before we get into kind of some of the nitty-gritty questions, What's driving the bus here? I mean, obviously cybersecurity becomes more and more vulnerable. You, your own team released a vulnerability intelligence report, a 2024 attack report that said you tracked more than 5,600 ransomware attacks between January 2023 and February 2024. I mean, is that really what it is, or are clients just absolutely asking for more and more protection?

Yeah, I know it's a great question. It's both. So the attacker landscape is changing. We're finding more and more nowadays that there's— attackers are actually using more zero-day exploits. So things that there's vulnerabilities not out there for today that a team could actually go patch. So attackers are ahead of the curve. Occur. So that is one trend. In addition, for the attackers that do get in are not using those zero days, they're actually executing on unmonitored assets like we talked about, using common CVEs, common vulnerabilities that have been around for years. And so what you're seeing here is customers are not really— their organizations are not going to solve their problems by buying a new shiny tool. They're going to solve the majority of their problems by just getting back to those basics I talked about, making sure they have the right coverage up front, making sure they know how many identities are in their environment, what the posture is, making sure they have machines in there that are monitored by threats. And so it's this trend, I think, and this, you know, the sentiment that we're hearing that, hey, I'm buying all this stuff, I'm spending a lot of money, we're out of budget, yet it's not really improving a whole lot. And so we've found that going back to the basics is just something that we've kind of missed, like the industry has missed, because we're all moving so fast. There's new attacks all the time. We're just trying to keep up, but it's like, no, that's important. And we do have to have the right protection to the defense and depth in play, but we gotta get the basics right. Right. And so I think those are the trends that we're seeing that kind of, that kind of point to what, why Rapid7's investing so much in this.

Yeah. So I, I think this is fascinating, um, because, because ultimately the demonstration you presented there, it's so obvious the, the, the simple changes that have to be made. And that there are so many potential vulnerabilities. I'm curious, everybody at a certain level has something in place. You know, people aren't typically acting derelict in their duties. They're doing the best they can. So how do you help them integrate this into what they're already doing? I mean, how do you approach that when somebody says, you know what, I saw the demo and solutions review and I'm curious to learn more about it, but we have all these other things in place. How do you talk to them about how this fits with their current portfolio of solutions?

Yeah, you're absolutely right. They're not derelict, they're working hard. So I think that that's something to hit on. And we hear from these hardworking team members every day that are struggling to keep an evolution of the attack surface. And so we need to make sure that they have the right tools and technology to be effective. Effective. And so immediately, because I go back to the first example, just that, you know, the data silos and tooling sprawl that you saw, that's actually making the problem worse. We need these tools, but we're not— the way that we're designing them, the way that the industry is bringing the market, is making the problem more difficult. And so we have to actually make that make sense for customers. We have to bring those tools together so they can start, oh, aha, this is the assets, these are the ones that I didn't know that were out there that my IT team deployed, or someone else in the company deployed, I just couldn't see. These are the low-hanging fruit that we have give our security team visibility into. And so when you see that, when they see like, oh hey, I have all these things that I can't make sense of and all this different data that slows me down, I literally have to log into 10 different tools or 15 different tools every day. So when I talk to them, they're using a lot of spreadsheets, they're manually trying to fill this out, but they're out of date the next day. So they go through their VM tool, I'm gonna grab all the thousands of assets, see which ones are missing, which are not. Then I'm gonna go to my EDR and grab all the thousands of assets and identities. I'm gonna put this in a spreadsheet with everything else. And it's literally killing their productivity. And so it really resonates because everything we do relies on data. So we gotta make the data work for the customer, work for these organizations. And I think that's just something, once we have that, it'll make them so much more effective.

Well, so I know Rapid7 has over 11,000 customers. Well done, by the way. Um, the, The question that we had was regarding smaller security teams. So you guys obviously work with the biggest of the big, and the demonstration there was certainly with a fairly large attack environment. What about the surface management for smaller security teams? Where does this help out?

Yeah, it's a good question. And I say, I think that number one, they have smaller companies, SMB, mid-market, continue to have the same problem. It might be on a smaller scale where they, instead of paying for 50 tools like an enterprise would have, they may have 5 to 10 tools. But they still have these visibility gaps that are impacting their ability to be more productive, ultimately resulting in prohibiting them from reducing the risk quickly as well as increasing their ability to target and monitor threats. And so what we've done as we thought about this, especially in the research that we did early on for the acquisition, you know, I myself, like I mentioned, interviewed 70+ customers and those were across the industry. They were enterprise as well as mid-market and small. A lot of the SMB and mid-market customers said, we actually cannot afford, we would love this, but we just can't afford a tool like this. And if I want to have an EASM tool to get my perimeter, guess what? I definitely can't afford both. I can't afford an intranet. Internal attack surface tool and an external attack surface tool. And so our approach is we know these customers need this through lots of interviews. We actually decided let's bring it together in one solution, go to market, and let's do it at a more affordable price point, trying to undercut it very competitively because— and by the way, this is with good reason— because they can't see today and they can't afford it to actually have a solution that allows them to see. So we want to be that person, that company that can solve that problem for them and then help them grow into the other Rapid7 solutions and offerings. And so that's kind of the idea. We're going to help them grow their security program with us over the course of multiple years by allowing them to start with attack service visibility upfront at a very affordable cost.

So as I look at that solution, I think to myself, okay, you know, if I'm running it for the first time, I'm going to see a lot of things and I'm going to slowly start to close those vulnerabilities. What's the protocol? I mean, where do you kind of see this playing out as an ongoing implementation? I mean, the first aha moment is something, but does the world change so rapidly on a continuous basis that you need to run this on some sort of regular protocol?

Yeah, so for one, it does. And it really depends on the nature of the business. Think about companies in hypergrowth mode, and it could be any size, right? Just growing quickly. You're hiring, you could be hiring new people every day or every week. You could be deploying new applications in the cloud to service new customers every single day and multiple times a day or every week. And so that just kind of points to the fact that the tax service does change. So I put it in 3 different buckets, Doug. I put it in step 1 is assessing your tax service. Attack surface. Let's find all the things that we have, right? And let's assess the posture of those. Then the second bucket is, hey, now I wanna— now that I have these things, I wanna monitor the attack surface. So this is where you incorporate other types of tools, threat detection and response, vulnerability management. And the third bucket is now I need to reduce my attack surface because I found everything, I'm monitoring what I have, and now let's get our vulnerability management IT teams working together to reduce that attack surface. And that becomes a cycle. Cycle so that each week you're actually, hey, what does my new attack surface look like? Because it does change depending on the organization. It could be day to day, it could be week to week, it could be month to month. So it's enough though, you have to keep up on top of it because an attacker can if you don't.

Well, I noticed on the documents section of the rapid7.com website for Exposure Command, there is a very neat onboarding experience section at the bottom of the report, and it says very specifically, Implementation Success Package Cloud Security, 2 half-day sessions, Advanced Command Exposure Command Advanced, 2 days. Talk a little bit about the onboarding experience with regard to bringing something like this on.

Yeah, and so for all our go-to-market solutions around Exposure Command, we provide all our customers with deployment and onboarding services. We do this because we want to make sure that they're set up for success. We don't want to just give them a tool, throw it over the fence, they paid for it, they have to figure it out for themselves. And so they will get to interact with our onboarding and deployment team, who are technical resources that know these tools inside and out. So in the case of Exposure Command, they will deploy our Service Command Attack Service capabilities, will start auto-ingesting anything they have from Rapid7. So get your vulnerabilities automatically, you'll get your, your threats, you'll get your cloud security, sorry, compute resources all in there. And then what we'll do, we'll say, hey, what are the top 5 tools that you trust in your environment? And those will be commonly we hear from customers, hey, Okta, right? I need for my identity source, Active Directory or Azure Directory, Entra for my identity source. What is the EDR EPP tool that you're using? Whether it's CrowdStrike or SentinelOne or Rapid7. What is, you have a service, you have a CMD, is it ServiceNow, out. Like, identify these key pieces of telemetry, get those set up through API connections. Once they have the APIs, it starts ingesting the data right away, and you have correlation within a couple hours. Then they can search their attack surface. So that's like the foundational piece there is like, hey, within a couple hours of plugging this in, you'll start to see your attack surface. 5 data sources we believe personally will actually start to give you visibility that you didn't have before. Now, Now, the more data sources that you add on top of that, the more visibility that you get. And so we see as a production deployment, customers that reach 10 or 15 data sources tend to be the sweet spot.

So as we wrap things up, I'm curious if you have any words of advice for folks that, again, we consider these types of events as a kind of a gateway drug to checking out more about what Rapid7 is doing, and by the way, I would encourage everybody to go to the rapid7.com website and see all of this in all of its glory and check out everything that Rapid7 has available for you on the website. But what words of advice would you offer up to somebody who is seeing it, you know, they obviously have a lot of things on their plate, they're trying to prioritize in the coming year. What would you tell folks to think about with regard to a decision like this?

Yeah, that's a great question. I'd say, you know, going back to the basics that we talked about, any vendor irrespective or agnostic aside, think about what are the tools that you rely on to run and secure your business today? Write those down. Right. And then figure out how you can, because sometimes we don't even know, depending on the size of the organization, Right? So what are you leveraging across your business and how can you use the information with that to make yourself more effective in prioritization of vulnerabilities and reducing your risk? Assess those gaps and then find the right tool or product that actually meets those, that fills those gaps, I should say. That's the thing that I would do, whether it's Rapid7 or whether it's another product, doesn't matter. We wanna make sure that you're doing the right thing. And so just make sure you assess what you have from what your knowledge is and the way that you run your environment, the way that you secure your team, where your IT does Does it? Make sure you inventory that and you know your own gaps. Then you can actually set out to success to find the right tool that actually closes those gaps for you.

Yeah, the stakes continue to get higher and higher. Ironically, it's usually a simple vulnerability that causes the breach, the downfall, the critical error. Excellent job today. Appreciate the time. Again, head to rapid7.com and check out everything with regard to all that they're offering. And best of luck in the coming year and for this rollout. Very much appreciated today.

All right. Thank you, Doug. I appreciate it as well. It was great to be here.

Well, there you have it. Another solution in our spotlight. We want to thank Jon and Rapid7 for that presentation. And we appreciate your attention as well. Until next time, I'm Doug Atkinson here at Solutions Review. Thanks for watching.

If your business would like to be featured in a future event, contact us today.