Are you getting ready for the upcoming Black Hat USA 2024 event, an internationally recognized cybersecurity event providing the most technical and relevant information security research, now in its 27th year. The event is quickly approaching, taking place August 3-8, 2024, returning to the Mandalay Bay Convention Center in Las Vegas, NV with a 6-day program.
Ahead of the show, VMblog received an exclusive interview with Kiran Chinnagangannagari, Chief Product & Technology Officer, Securin, a leading security company. Make sure to add them to your MUST SEE list.
VMblog: Before we get into it, can you give us a quick overview of the company? What should folks know?
Kiran Chinnagangannagari: Securin was founded in 2021 to address three key challenges plaguing the market: lack of compliance, fragmentation of tools and the escalating cost of cyber insurance. All of these challenges can be solved by adopting a more proactive, comprehensive approach to security – and that is what Securin’s platform is designed to achieve for organizations of all sizes. Our focus is on early warning vulnerability intelligence, prioritization and delivering a unified view of risk across the business.
Securin’s platform delivers continuous cyber threat exposure management and validation. We offer predictive and definitive vulnerability intelligence based on how attackers exploit vulnerabilities and provide prescriptive remediation. Our platform and managed solutions are powered by machine and human intelligence to continuously discover and prioritize weaknesses and vulnerabilities in your dynamically changing attack surface. Our technology is proven and battle-tested in over 300+ customers globally, across SLED, government and enterprise – backed by 5 patents (and 20 pending).
VMblog: What is your message to Black Hat attendees coming out to the show this year? If they take back one message about your company, what should it be?
Chinnagangannagari: As tech leaders, we know there’s never been a better – or more crucial – time to incentivize good security practices and transparency across industries. It’s time to reframe how we talk about and address the fundamental challenge of vulnerability and weakness in widely used software. As our own research at Securin indicates, many of the vulnerabilities exploited today are ones that could have been prevented.
Think about it: our industry is calling out for risk-based prioritization, but we rely on a Top 25 based on CVSS scores. Nine out of the Top 25 weaknesses across ransomware-exploited CVEs are absent from the MITRE Top 25 list. We see the same concerning trends across CISA KEVs, where eight of the Top 25 weaknesses are outside the MITRE Top 25. These variations on weaknesses that foster exploitation versus the MITRE Top 25 can impede progress in the encouraging Shift Left movement. On the bright side, MITRE itself acknowledges the gap; since 2023 it has released its Top 10 CISA KEV Weaknesses.
But if we want secure coding practices, and a focus on eliminating repeatedly exploited software bugs and weaknesses, we have to equip developers with the knowledge and insights they need. Securin is on a mission to provide organizations with the intelligence, insights and tools they need to achieve this.
VMblog: Black Hat attendees are known for being security professionals at the forefront of the industry. What specific challenges do you anticipate they’ll be facing, and how will your solutions help them overcome those challenges?
Chinnagangannagari: While our capacity to detect threats has improved significantly, it’s been a double-edged sword: 85% of CISOs believe that vulnerability noise and alert fatigue are significant challenges to finding, responding to and remediating vulnerabilities. Among the challenges defenders are facing:
- Fragmented security solutions
- Security gaps
- False positive rates
- Alert fatigue
- Manual security processes
- Lack of real-time intelligence
And there’s more: despite widespread awareness of them, threats like XSS are being introduced during the development process all the time. This isn’t due to malice or oversight, it’s due to the fact that managing security in the accelerated development environment we’ve just described is tricky. Modern web applications are often complex, with many interconnected components and dependencies – the likelihood of vulnerabilities slipping through the cracks or being introduced through recycles or third party code is high. If your team is wading through 100,000+ alerts, things get overwhelming pretty quickly.
Attacks exploiting the double-whammy of user error and software vulnerabilities tripled last year – and ransomware threat actors are the main exploiters. As this year’s DBIR found, it takes just 60 seconds for the average user to fall for a phishing mail, but around 55 days to remediate 50% of critical vulnerabilities once a patch is available. What can companies do to mitigate this risk? As the DBIR put it, “If it goes into the KEV, go fix it ASAP.”
Securin’s solutions are designed to help defenders identify the vulnerabilities missed by typical scanners, quantify their risks and prioritize the vulnerabilities most likely to be exploited. We provide: Risk-based Vulnerability Management, Penetration Testing and External Attack Surface Management to bridge the gaps present in mainstream databases and leverage the best of AI/ML models and human analytics to deliver unique insights that inform greater decision making.
VMblog: What are some of the key takeaways of your solution that Black Hat attendees should be aware of?
Chinnagangannagari: Securin’s solutions portfolio is designed to work with any customer, no matter where they are in their security journey – whether that’s starting with risk-based vulnerability management or scaling into a truly proactive mindset of continuous discovery and risk monitoring.
Everything we do is driven by our proprietary vulnerability intelligence data model, powered by our patented vulnerability intelligence dataset, providing true interconnectedness and drawing insights from the widest range of sources. Securin takes the extra step of correlating data, not just aggregating it, but identifying the underlying patterns and bringing those to the fore.
Highlights include:
- Chart rapid remediation plan
- 30-50% reduction in analyst time
- Continuous discovery for proactive remediation
- 30+ AI/ML models combined with human analytics for truly unique insights.
When we look at AI regulations and the new NIST 2.0 framework, what we’re seeing is an emphasis on proactive security. At Securin, that’s baked into everything we do with our customers. From attack surface validation to attack surface prioritization and beyond, we’re enabling a security by design approach, where weaknesses are identified and mitigated before they can become vulnerabilities. And if they’re already vulnerabilities, we mitigate them before they’re exploited.
VMblog: The market is a crowded space. What is it about your company and technology that sets you apart from the competition? What are your differentiators?
Chinnagangannagari: Our leadership team has deep expertise across offensive security, government and pen testing / automation.
Securin’s unique combination of data, domain expertise and data modeling set us apart from other solutions:
Data: Our experts have been data crawling the dark web for over 12 years, gaining unique insights and anticipation around the vulnerabilities and exploits that cybercriminals are most likely to target. We mine thousands of sources, updating them daily to provide fresh, comprehensive data and insights.
Domain expertise: Securin’s technology has its roots in Naval Intelligence, DARPA and ASU. Our customers have access to more than 100 expert pen testers continuously validating our data. Our innovative approach is underlined by our 5 patents, with 20 more pending.
Data modeling: Securin’s customers have access to insights built on more than 30 AI and ML models, along with over 700 intelligence feeds. Our expertise is validated by our status as a Certified Numbering Authority (CNA), and more than 55 zero days discovered.
All of this combines to deliver actionable insights at maximum velocity (identify risk from day one, not three weeks later), tailored remediation with automated insights specific to your use case, and the ability to advance and augment existing tech stacks, with an aggregated view.
VMblog: What are some of the top priorities security leaders should be considering for 2024?
Chinnagangannagari:
- Finding the signal in the noise – adopting a proactive approach to security. Building the capacity not just to identify but to prioritize risk.
- Understanding the nature of weakness in code as it applies to your organization. If you focus your priorities exclusively on the MITRE Top 25, there’s a good chance you’ll miss the highly weaponized, less known weakness that is highly relevant to your specific systems. Until it finds you.
- Software supply chain risk: supply chain and third-party risks accounted for 15% of breaches last year. It’s a harsh reality that organizations need to confront this trend and evaluate their partners’ cybersecurity practices. It’s time we asked more of them, starting with areas such as completing a standardized security questionnaire based on frameworks, like the NIST Cybersecurity Framework (CSF) or ISO 27001. These could cover topics like network segmentation and access controls, patch management and vulnerabilities management, among others. We’re still seeing vulnerabilities like XSS (CWE-79) being coded into modern applications – there is really no need for this to be happening in 2024.
Remember: if we want secure coding practices, and a focus on eliminating repeatedly exploited software bugs and weaknesses, we have to equip developers with the knowledge and insights they need.
- Understanding the nature of AI risk: It’s always been clear that AI impacts cybersecurity, but it’s a two-way street: where AI is increasingly being used to predict and mitigate attacks, the applications are themselves vulnerable: the same automation, scale and speed everyone’s excited about are also available to cybercriminals and threat actors. Although far from mainstream – yet – malicious use of AI has been growing. From generative adversarial networks to massive botnets and automated DDoS attacks, the potential is there for a new breed of cyberattack that can adapt and learn to evade detection and mitigation.
In this environment, how can we defend AI systems from attack? What forms will offensive AI take? What will the threat actors’ AI models look like? Can we PenTest AI – when should we start and why? As businesses and governments expand their AI pipelines, how will we protect the massive volumes of data they depend on?
VMblog: Looking ahead, what excites you most about the future of cybersecurity, and how do you see your company playing a role in shaping it?
Chinnagangannagari: Intelligent use of AI and ML to augment human expertise and help automate more routine tasks so that analysts can free time to apply their insights to more challenging problems. Code as everything world – an opportunity for security to sit at the heart of everything from day 1 instead of a retrospective process. Where security by design, by default, can drive a new approach to how we innovate software solutions.
A new generation of software developers and DevSecOps are tasked with operating in a world where IT and security are converging. Cybersecurity is becoming part of the day-to-day software development. There is an exciting opportunity here for cybersecurity experts to step up and drive secure practices, share insights and collaborate on building more secure software.
##
