In today’s rapidly evolving digital landscape, the importance of asset visibility for robust cybersecurity has never been greater. Enterprises face increasingly complex attack surfaces, and without a clear understanding of their IT assets, they risk leaving vulnerabilities unchecked. Greg Fitzgerald, co-founder and CXO of Sevco Security, understands this challenge firsthand. With a founding team that draws from deep experience in endpoint security, including Cylance and Carbon Black veterans, Sevco was created to address the critical issue of IT asset inventory—an essential foundation for any security strategy.
In this exclusive Q&A with VMblog, Fitzgerald discusses the origin of Sevco Security, the expanding enterprise attack surface, and the role comprehensive asset visibility plays in mitigating vulnerabilities. From missing endpoint protection to shadow IT and misconfigured controls, Sevco’s approach helps organizations uncover gaps in their security posture and provides actionable intelligence for prioritizing and remediating risks.
VMblog: Can you tell us the story behind the problem you were solving when you founded Sevco Security?
Greg Fitzgerald: Our founding team has extensive security background and includes former endpoint folks from Cylance and Carbon Black. As such, we saw first-hand how many organizations were struggling to understand how many assets they had so that they could deploy those tools everywhere they needed to be.
We founded Sevco to solve this core issue for many enterprises: IT asset visibility. Asset inventory is the first step in addressing any security issue – you need to know exactly what you’re protecting, and what your current security posture is.
We released our first product in 2020, which provides that visibility by integrating with an organization’s existing tools to aggregate, correlate, and deduplicate their disparate inventories into a single, comprehensive inventory. This would uncover previously unknown gaps in security tool coverage. Most organizations discovered they had 20-30% more assets than they were previously tracking after they implemented our technology and realized they had more problems in their environments than they had the capacity to handle.
Since we were already providing them comprehensive visibility of their devices, users, and software and all the associated attributes for those assets, it was a natural extension to provide visibility into vulnerabilities on those assets.
In 2024, we then released our Exposure Management product to surface and prioritize all types of vulnerabilities – not just software vulnerabilities like CVEs that most solutions focus on, but also environmental vulnerabilities like missing or misconfigured agents, shadow IT, and end-of-life systems. Because we had visibility into attributes like location, business criticality, and users associated with devices, we already had all the internal information organizations needed to prioritize the riskiest assets for remediation, and we coupled that with exploit intelligence to give them a complete picture of their risks.
Now, hundreds of companies rely on Sevco to seamlessly deliver a comprehensive, accurate, real-time asset inventory for security operations and a comprehensive view of the vulnerabilities in their environments and the risks those vulnerabilities pose.
VMblog: How have enterprise attack surfaces grown, and how does that make the job of security teams more difficult?
Fitzgerald: The exploitation of vulnerabilities increased 180% over the past year, which makes the fast and effective remediation of vulnerabilities a strategic priority for security teams. Malicious actors have become very adept at hijacking vulnerable endpoints and using them to access data and corporate networks. Unfortunately this type of vulnerability is just the tip of the iceberg when it comes to endpoint security. Recent research from Sevco uncovered an even more insidious problem: many companies are blind to IT assets that are missing critical controls, including endpoint protection. The research found that 10% of all IT assets are missing endpoint protection in the first place. The same data set shows that 22% of IT assets aren’t covered by enterprise patch management solutions and that 23% of IT assets are not covered by enterprise vulnerability management systems. These data points combine to tell a frightening story: too many IT assets are invisible to security teams. You can’t protect or patch an IT asset that you don’t know about.
VMblog: What’s the value of a complete IT asset inventory beyond the inventory itself? What does it enable?
Fitzgerald: An accurate IT asset inventory is the foundation of a company’s security program because it enables you to identify all the assets that need to be protected and which security tools are missing from those assets.
A comprehensive inventory that tracks attributes for each asset is also absolutely necessary for a vulnerability prioritization effort because it provides you with not just the assets being affected by those vulnerabilities, but intelligence on them, which enables you to understand the risk in your environment.
Having this inventory is foundational for understanding how effective your team is at remediating or – if remediation is too difficult – mitigating vulnerabilities.
VMblog: What differentiates Sevco Security from other vendors in the space?
Fitzgerald: There are three major differentiators that sets the Sevco platform apart from other vendors in the space.
- Asset inventory is control number one in nearly every security and compliance framework. Sevco’s asset inventory is more accurate in head-to-head comparisons with other inventories, and updates in near-real-time, meaning organizations don’t just have visibility into the presence of assets, but the state and how the state of those assets is changing over time. An asset might be present in one of your tools, but if the agent is broken or misconfigured, the asset could still be unprotected. Upon deployment in any existing environment, Sevco often identifies a surprisingly high number of assets previously unaccounted for – sometimes uncovering as many as 30% more.
- Sevco is the only tool that provides vulnerability consolidation from across all tools that report vulnerabilities AND prioritizes both software vulnerabilities like CVEs and environmental vulnerabilities like missing or misconfigured controls, shadow IT, IT hygiene issues, etc. that, in many cases, are more of a threat to an organization than CVEs. For example, if a patch/configuration management tool isn’t deployed, you can’t patch a device – no matter how many times a ticket is issued.
- Sevco’s unmatched visibility uniquely highlights metrics that enable validating remediation when it’s observed on the asset itself, not just when a ticket is closed. This helps security and IT teams see what’s working and what’s not working in their remediation programs. The Sevco platform also identifies underutilized tools in an organization’s security stack or, conversely, opportunities for cost savings by rationalizing license counts.
VMblog: You mentioned that organizations have a patching problem. Why are modern-day enterprises having so much trouble tackling vulnerabilities?
Fitzgerald: Legacy vulnerability management solutions only provide insights into software vulnerabilities, but risks to the environment encompass more than just CVEs. There are missing or misconfigured agents that aren’t protecting the devices they’re supposed to, shadow IT that security teams don’t have control over and end-of-life systems in need of updates.
Without vulnerability assessment and patch management agents present, it is impossible for any vulnerability management program to ever meet its objectives. When the number of reported vulnerabilities continues to rise while security team capacity remains largely the same, organizations need the help of technology that can provide better intelligence on vulnerabilities and their assets to prioritize the riskiest issues for remediation.
VMblog: Any advice can you give to small businesses in their efforts to safeguard their attack surface?
Fitzgerald: Our research also found that SMBs managing their own environments are among the most vulnerable. SMBs trying to secure their attack surfaces on their own are missing patch management on 27% of their devices, while SMBs working with a managed security service provider (MSSP) are missing patch management on just 3% of devices. Additionally, SMBs trying to secure their attack surfaces on their own are missing endpoint protection on 21% of their devices, while SMBs working with an MSSP are missing endpoint protection on 4% of devices. This is why a comprehensive asset intelligence approach should be considered to protect systems and avoid the fines and penalties of compliance failures. Allocating funds towards protecting your business is way better than paying millions to the SEC, losing brand value and diminishing your reputation.
##
