Automated Security Compliance with Eric Martin

Welcome to the Test Guild Security Podcast where we all get together to learn more about security testing with your host, Joe Calantonio.

Hey, it's Joe. And welcome to another episode of the Test Guild Security Podcast. Today we'll be talking with Eric Marin, all about automated security compliance. Eric is the head of sales at Vanta and Vanta is a security and compliance startup based out of San Francisco that has built software to Streamline all things SoC2 and HIPAA compliant related. Really hot topic going on, so you don't want to miss this episode. Check it out.

It's no secret that the number and complexity of applications are growing. But what is alarming is that 90% of security incidents result from exploits against defects in software. The need for better application security has never been higher and Micro Focus Fortify is here to help. Fortify is the recognized market leader in application security and it is the most comprehensive and scalable application security solution that works with your current development tools and processes. With Fortify, you could start security applications in a single day, including custom code, open source or commercial components and scale as your needs grow with an on premise as a service or hybrid implementation. Check them out. Head on over to micro focus.com app security.

Hey Eric, welcome to the Guild.

Hey Joe, thanks so much for having me. Excited to be here.

Awesome. Great to have you on the show. Before we get into it, is there anything I missed in your bio that you want the Guild to know more about?

You crushed it. I think you nailed it. Yeah. So thank you so much.

Awesome. So as I explained in the pre show, I am a newbie to security and so we're going to take it step by step and really dive into this before we actually hit the meat of the topic. But so before we actually dive in deeper, how would you explain what is security compliance?

Yeah, interesting. At a very high level security and compliance, they more often than not work hand in hand. We like to encourage companies to be security first and what I mean there is to kind of take the necessary precautions from how they operate their business to de risk that business. Okay. So there are simple things that companies can do, whether it's kind of enabling two factor authentication to getting connected to your cloud infrastructure or requiring employees to take security awareness training. Right. There's a full spectrum of kind of measures, simple and kind of complex or robust that companies can do to beef up their security and then kind of put themselves in a better position to adhere to and then go get these different compliance certifications or reports.

Nice. So what are some myths around security Compliance, One I can think of is that it's only applicable to enterprise wide companies. Is that true or what are your thoughts on that?

Yeah, I think so. When you think about security and compliance, there are two certifications that immediately come to mind. There's the SoC2 and there's ISO 27001. SoC2 is like a North American cybersecurity compliance report that when a company gets it and then presents it to a prospect, a partner, a customer, it effectively communicates that to a certain extent they are safe to do business with. As in like that company is going to take X, Y and Z precautions to make sure that they're handling and processing your information and they're using their own sub processors in a way that kind of the industry kind of expects they should be dealing with them. And so to answer your question, is this only applicable to enterprise businesses? No. More often than not. What we're seeing now are early stage companies going out and pursuing these compliance reports just because their table stakes based on the sub industry that they're in and or kind of the types of customers who they're trying to sell to. I could elaborate more or I can pause there.

Yeah, if you could just go in a little bit more detail, some examples maybe would be helpful.

Yeah. So for example with Vanta, right? Like most of the companies that come to us who want help getting a SOC2 report or becoming HIPAA self certified are between 2 and 100 people, right? More often than not they're between 5 and 15, 5 and 20 employees. These are like pre seed, seed stage, sometimes series A. And the reason they're coming to get a SOC2 report and eventually HIPAA and then ISO 27001 is because a couple things, one, they may have a customer or a prospect who is hard requiring it. They may be in an industry like Fintech where it's just table stakes. So in order to get your business off the ground, one of the things you're going to do is partner with a major financial institution. And to partner with those folks you need a SOC too. But more often than not these companies today are coming to pursue these compliance reports as presumptive blockers. So they may have been asked for them once, they may have never been asked for them, but they don't want them to be blockers, they don't want them to slow deals down. Some of them see having these compliance reports as a competitive advantage. And if historically getting a SoC2, for example, took a 20 person company, you know, 60 grand and 6 to 12 months for them to be able to come to, you know, leverage software like Avanta that can help them get it done for $20,000 in two to four weeks. All of a sudden like the tables have changed. And like what was originally or initially something that felt out of reach or kind of something that didn't seem realistic to ask a small company to get now all of a sudden feels very realistic. And so maybe right place, right time for businesses like ours. But yeah, more often than not, it's not enterprise companies that are, that we're seeing, although these enterprise companies inevitably also do have these reports.

Awesome. Yeah. The person I spoke to that told me more about this was it's a startup and I guess they use a Google API and Google require them to get a SOC audit and it was some outrageous amount of money. And then they found you all. So what do you offer then that makes it a more cost effective because the rate they originally were quoted was like some outrageous amount.

Yeah. So historically when companies wanted to go pursue these compliance reports, and we're kind of picking on the SoC too, because that's the compliance report that Vanta helps to streamline. But historically, if someone were to go get this, they would hire an auditing firm. That auditor would come to their office in the old days. Now they'd probably do a zoom call and they would do what's called a gap assessment or a readiness assessment. That's where they're going to run these companies through a laundry list of things that they need to see in place before they can file these reports. They would charge you for that assessment and then they would send you off to your own devices to go get those ducks in a row. Prove that those ducks are in a row in the form of screenshots, often in the order of magnitude of hundreds of screenshots, and then upload those into some portal or some drive that these auditors have built. The auditors then have some processing time where they need to sift through these things, confirm them, go through their checklist, and then draft the reports. And so there was frankly like traditionally this just took a lot of man hours hence like added up to large sums of money in the Vanta world. Simply put, we've built software that connects with read only APIs to certain systems that companies use. So like your cloud infrastructure, your version control system, your identity provider, and we continuously run tests against these API connections. The way that we've designed Vanta is so that in Vanta, if you're passing these tests, you're communicating to one of our audit partners that you're satisfying different technical controls. And then as it pertains to the non technical requirements that often go into getting these compliance reports, such as having policies, a vendor management platform, doing vulnerability scans, et cetera, we built ancillary tools to help companies satisfy those requirements within the platform as well. And once again, right. Like you talked about, like kind of the juggle between like security and compliance or compliance and security, we like to think of ourselves as a security monitoring and alerting tool. It just so happens that the framework that we've built these security tests around map back very neatly to Soc 2.

Nice. So it sounds like it's an ongoing thing as well. So it's not just like you get audited once you have that document and then you're good to go. Or is it something that companies need to be aware of ongoing new features being released? You need to have some sort of traceability, I guess with that.

Yeah, it's a good question. So, and it's good for our business model because companies do need to get a SOC to report and they need to, well, they need to renew it every 12 months. And so when you're thinking about the different types of SOC2 reports, there's a SOC2 type 1 and there's a SOC2 type 2. A SOC2 type 1 is a point in time report. This report kind of communicates to your partners, prospects, et cetera, that hey, on this date we had all of our kind of processes and procedures in place. A SOC2 type 2 is more of a continuous report which like, the main difference is that a SOC 2 type 2 requires what's called an observation period. And that's this like 3 to 6 to 12 month window where tool like Venta is continuously monitoring that you are adhering to these controls, as they're called in Soc2world or these kind of processes and procedures over the duration of that time period. And so because we run these tests on the hour, we can flag to companies when these tests fail that might take them out of compliance and we tell them very specifically how to go fix them. And so yeah, a more detailed picture there of the different flow flavors of SoC2 reports as well.

So what happens if someone doesn't meet these requirements? Seems like it's two pronged almost. If it's like a government regulation, you're going to get fined. And two, I guess if you want to make more sales, I guess more and more companies are asking you are you compliant before they do business with is that a two prong? Type of thing you see as a scenario for why you need to be audited and compliant.

Well, so the reason why companies need to go get these reports generally stems from hard customer requirements and. Or it's just table stakes for the space that they're playing in. In terms of like kind of what happens if companies don't have these things? In simple language, if a company doesn't have a SOC 2 report and it's a hard requirement from one of their prospects in order to do business with them, like very immediately it's going to stall or immediately put the deal to a halt. Right. So more often than not we're in this like really interesting position where the stakeholders or the people that own pursuing these compliance reports are more often than not technical leaders or security leaders or compliance leaders. But the drivers are the revenue team. It's the people that like, it's the sales reps and the sales managers that are saying, hey, we need this report to get this deal done, let's get it done.

So without a tool like yours, who does a SOC 2 audit and how do they know if they're compliant? I guess is that like a feature a company, someone hires, a SOC2 audit person or is it just out of. It's like a contractor or someone that comes in and takes a look at things.

Yeah. So quite literally, who will kind of write these reports for companies are AICPA accredited auditors. So you could do a simple Google search for like SOC2 auditor and you'll find hundreds if not thousands of auditing firms out there, large and small. Vanta is a software company, but we partner with these auditing firms. So today we have a team dedicated to kind of like onboarding and training these auditors to file reports using Vanta software. We have over two dozen of these firms ranging from small local regional firms all the way up through the big four. And for them it makes a lot of sense. Right? Like for better or worse, software companies are more approachable than auditing firms. I think in this day and age, folks would rather kind of get a leg up on working towards anything that has the word audit in it, using software as opposed to kind of going to the human first, for better or worse. And so our partners lean into us and we lean into them and it ends up being this like really kind of strong relationship.

Nice. So you mentioned a few times that Vanta, what it does is it automates things. So automates your security, compliance. Could you just talk a little bit more like give an example how that works? Is it built into the actual software pipeline where they develop software, and before it's released, it runs these checks. What do you mean it runs every hour? Does it add a lot of overhead? What's the whole process?

Yeah. So at large, when we make these API connections, whether it's like your AWS, your GitHub or your Okta, we're running tests to see are you leveraging these tools in the most appropriate manner. So we're looking at configuration and metadata. And so it's like, are you retaining log groups for 365 days? Are these S3 buckets where you store sensitive data encrypted? And so it's really lightweight. You know, a lot of these third parties that we've built these API connections to have built custom kind of like permission sets for third party audits. So the tests that we're running are not intrusive. We don't have access to customer data. We quite literally cannot get access to these things. And they're kind of like draws a line, like some controversy in terms of like how kind of meaningful or powerful SoC2 is given, like the limited scope of what SoC2 actually looks at. But once again, as you think about kind of solutions like Vanta, SoC2 is kind of the starting point, right? It's like as we kind of work towards building our own kind of de facto online security kind of label, let's call it, and we automate different certifications like ISO 27001, and we support different security frameworks. Naturally, the breadth of these tests that we run and the depth that we go will increase. And so, yeah, it's all very exciting.

Sounds very cool. I know. Just my experience with automating other things. You need something in place though, like a manual process that's working before you can automate it. How much does a company need to have in place before they can use an automated solution like Vanta? Like, do you go in and say, well, you don't have this and this, so therefore you need to do this legwork before we even get to automating it with our software?

Yeah, it's a good question at large. I'm laughing because we've had companies come to us before they were even incorporated and they're like, we don't actually have a company name yet. Actually one of those companies that came to us and signed up before they were incorporated is now like a 200 person company, which is kind of fun. So one, hopefully you're incorporated, but B, at a minimum, we encourage companies to pursue a SoC2 once they've kind of decided on their kind of core tech stack. So which cloud infrastructure are you going to use? Which version control system are you going to use? Which identity provider are you going to lean on? And the reason being there are a number of controls or parts of the SoC2 that are tied to kind of how you leverage those different systems. So that would be the baseline requirements. Most of the companies that we work with are, as I said, they are so early in their existence that many of them are like, they have an MVP product. So as you're thinking about, like, are there sales thresholds or product thresholds before you can go pursue these things? The short answer is no.

That's pretty incredible. It's before they even it's mvp. How do they know about you? Like, how do they know what to look for? That this is actually a need? Because this is the first time I really heard of it. So it's something that everyone's aware of. So it's just as easy as did you a Google search and then find someone like you?

Well, so for us right now, people hear about us through a number of ways. We have partnerships with dozens of venture capitalists, we're tied in to many of the kind of startup accelerator communities. Every customer that we signs up refers at least one new customer. Right? So we also have a very strong outbound engine that's kind of like making people aware of us who formerly had no idea we existed at large. Though, once again, I'll just go all the way back to that kind of original kind of statement, which is that companies find out very early on in their life cycle whether or not compliance reports like SOC2 are going to be meaningful, frankly. Think about, like, think you're an early stage company and you're going out and you're trying to find your first customers. Right. Inevitably what's going to happen is you're going to find a couple of interesting companies, you're going to discount them aggressively, they're going to agree to put their logo on your website, but at the end of the day, in order to work with them, you're still going to have to go through some form of a security or risk assessment. And more often than not, these really early stage companies come to us after going through that risk assessment and learning that, oh shoot, Twitter wants a SoC2, Slack wants a SoC2. So we're going to work with this company as a beta customer, but apparently we need to get this thing done. And so that's when they put the word out. And somehow or another they always find us nice.

So so far we've only talked about SOC 2. I know you also support HIPAA, so just explain a little bit what HIPAA is and maybe when someone needs to use that as well for compliance.

Yeah, my wealth of knowledge on HIPAA is way more shallow than my wealth of knowledge on SOC 2 at large. Right. Like so for starters, HIPAA is a compliance certificate report that where like companies can self certify. And so when we think about which compliance reports we want to support, the reason that we went from SOC to HIPAA was because there's a huge overlap in the number of controls or requirements from one to the other. So notably there are a couple additional policies that companies need to have in place if they are to be HIPAA self certified. There are also certain flags where they need to tell us where EPHI is contained. It's interesting as we learn more and more about hipaa, kind of the types of businesses that need it right now safely, it's the healthcare tech companies who we support, who are the ones that need to also be HIPAA self certified, or the SaaS, businesses that sell into or partner with these major medical institutions. And then as you think beyond HIPAA, like we mentioned, ISO 27001, ISO 27001 is effectively like the international version of SoC2. And so once again, it's still early days for us because we don't support that yet. I would be winging it too aggressively to talk too intelligently about it, but once again, I think it's one of those things where we do look forward to supporting that so that we can further support international based businesses.

Nice. So I would think also with compliance regulations change all the time, but it seems like if you have an automated solution, this is being updated as well. So people, I guess when they use a solution like this, they have confidence in knowing that it's all up to date and that it's meeting all the current regulatory type of requirements, I guess.

Yeah. So this is where once again, the partnerships with our auditors comes into play. Right. So these folks are leaning heavily into Vanta to write these reports. And so they are just as invested as we are in the legitimacy of kind of the tests that we run and the controls that we encompass and making sure that we are up to speed on things. So we have our own internal team that kind of keeps on top of these specifically SOC 2 requirements. But anytime there's a change or an update, we get an email from literally like 30 different auditors saying, hey, just FYI there's this new thing that we need to consider. Vanta doesn't have it today. How quickly can we see it in there? So once again to your point, yes, like we have any number of kind of hands, I guess, involved in making sure that we stay on top of what's required.

So it sounds like once again, Vanta, I noticed someone to use it. It's just a matter of making API calls. Right. It seems like it's an API based solution, you're just making calls to it or hooks to APIs. So it's really lightweight.

Yep, very lightweight. I've now onboarded a couple hundred businesses and that's just a fraction of the companies that we support today. And I remember like even when I was doing this back in the early days, it would take someone five to seven minutes to go through and make those various connections. I think the way that we think about it now is that.

As we go out and support bigger and bigger orgs, these orgs will more often than not have more complex tools or systems that they rely on and they will have controls or SOC2 requirements tied to how they use those additional frameworks or not additional, excuse me, additional systems. So it's on us as we kind of build to support bigger and bigger businesses, to build more and more of these integrations. And that's something that like we have teams of engineers just dedicated to continuously working on.

So are there any vendor management best practices for monitoring security?

Yeah, and this is something that companies can do regardless of if they're pursuing a compliance report or not Effectively a healthy exercise to do is to go through and first off figure out who internally is going to be responsible for the different vendors that your company relies on to operate your business. Right. It's healthy to like bring one or two or more stakeholders to the room, get those vendors listed out and then from there. And this is something that like comes into play when you get a SoC2, but you don't need a SoC2 to do this. It's a healthy exercise to kind of collect the security documents from those vendors on an annual basis, review those security documents and make sure that like you're comfortable with their security posture. And so once again, this vendor management portal is built in tool like Vanta and there are controls that companies will include in their SOC reports tied to how they manage third party vendors. But regardless of if you're pursuing one of these reports or not, it's a healthy exercise to kind of stay on top of the vendors that you're truly relying on. Making sure that someone is responsible for those and that they're collecting those security docs and reviewing them on some kind of regular cadence.

So Eric, I know this could be very expensive. So how much should companies budget for a SOC2 type audit?

Yeah, so at large we'll give like a high level answer here that companies can kind of work around. But companies 1 to 20 budget all in costs around 20k. And that would include the software fee and the audit filing fee. Companies in that 50 to 100 range budget anywhere from 30 to 40k. And then companies north of 100 be ready to budget 40k plus. And that's largely because these auditors today will price based on headcount and then type of SoC2 report that you need. And these software vendors more often than not price based on headcount as well. So it's one of those situations where when folks come to us having spoken with an auditor first, it makes pricing a really easy discussion because auditors will more often than not quote folks 3x the numbers that I just gave you. And so it's often a welcome surprise when they find us. But if you're hearing this for the first time and you haven't spoken with an auditor, then yeah, reasonably come in with those expectations and then you can challenge our reps to honor those ranges.

Yeah, it's pretty transparent. So why headcount? Is it just more documents that they have to review based on headcount?

There's no good answer for why headcount and it's tbd if that's going to be the model that sticks. Historically, the way we've priced by headcount is because tools like Vanta have immediately replaced what is called that gap assessment. And so if you think about auditors charging companies based on headcount size, it was the easiest kind of anchor for us. And so tbd, if that sticks. There's a bunch of experimentation happening, including with us around pricing models. But at large, the way we think about it is number of employees that are in scope for a SoC2. So we have detailed scoping features within Vanta where companies can dictate which employees are in or out of scope for this particular report. And as part of that, any employee that's in scope, we're going to continuously monitor kind of their account status, which tools they have access to, whether or not they are adhering to kind of access, SLAs and the works. And so the reality is that we do keep tabs on lots of data tied to individual employees as well.

Awesome. Okay. Eric, before we go, is there one piece of actual advice you can give to someone to help them with their security compliance efforts? And what's the best way to find contact you or learn more about Vanta?

Yeah, my advice is this is ask tough questions early especially, and this is notably for early stage businesses listening. But it's like as you're kind of getting through these sales cycles and you're getting towards the end, be sure to be cognizant of the fact that you're going to have to go through a risk assessment, especially if you're handling sensitive customer data. And so with once again, this is me just speaking from a salesperson, it's like qualify early, right? So as early as you can, figure out what those hurdles to close are going to be, and if one of those hurdles involves pursuing one of these compliance reports, then give us a shout. Come to us@vanta.com, that's V A N T A dot com or you can email me directly ericvanta.com, that's ericvanta.com thank.

You Eric for your security testing awesomeness. The links to everything in value we covered in this episode and head on over to testguild.com S31. And while you're there, make sure to click on the Try It Today link under the Exclusive Sponsor section to learn all about Micro Focus Fortify, which is the recognized market leader in application security. And if you haven't already, make sure to check out Secure Guild, an online conference dedicated 100% to helping you succeed with creating security testing awesomeness. Head on over to GuildConferences.com and click on the Read more under the Secure Guild Conference Conference section. So that's it for this episode of the Test Guild Security Podcast. I'm Joe and my mission is to help you succeed with creating end to end full stack security testing awesomeness. As always, test everything and keep the good Cheers.

Thanks for listening to the Test Guild Security Podcast. Head on over to testguild.com for full show notes, amazing blog articles and online testing conferences. Don't forget to subscribe to the Guild to continue your testing journey.