A year ago, I joined AttackIQ and spent my first few weeks on a listening tour with colleagues, customers, partners, and analysts. I met with Augusto Barros, the lead Gartner breach and attack analyst at the time, curious to hear his perspective on the maturity of the breach and attack simulation category and to learn which questions customers were asking him on solutions to validate their cyberdefenses.
His view was that security leaders were no longer asking, “What is BAS?” They were asking “Which use cases are best for BAS and how should I apply them?” In short, BAS was on its journey from an emerging offering to a more mature cybersecurity category.
Fast forward to March 30th. Gartner released its Top Security and Risk Management Trends 2021 report covering eight trends to watch including BAS. When Gartner publishes something like this, it is a moment of arrival for a new technology category. Unlike shoulder pads, mullets, and parachute pants (which perhaps never should have been, if we’re honest) this is one trend that is here to stay. If you are a Gartner subscriber, you can find the full report here.
The analysis is consistent with what we are also hearing from customers. Rather than relying on annual penetration testing or red team assessments, Chief Information Security Officers (CISOs) are discovering that there’s a better way to adapt to change and ensure resilience in cyberspace. A better way to validate that controls are working as expected. And with attacks increasing in sophistication and impact, cost, and visibility, they are learning there is a more modern, automated way to prepare for breaches and increase confidence in their security posture. That way is with AttackIQ.
AttackIQ provides an easy, automated way to validate security control effectiveness against known threat behaviors, giving customers confidence that their tools are correctly configured and working to protect them. Our platform emulates thousands of real-world attack behaviors and techniques, fully aligned with the MITRE ATT&CK® framework. In fact, it is the first adversary emulation platform built for multi-stage, comprehensive adversary campaigns and to test artificial intelligence (AI) and machine-learning (ML)-enabled cyberdefense technologies in a production environment, at scale, and at every stage of the attacker kill-chain.
Our alignment with MITRE ATT&CK is why we became a founding member of MITRE Engenuity’s Center for Threat-Informed Defense (CTID). The Center is an organization within MITRE that conducts applied research and advanced development to improve cyberdefense at scale for the global community. It brings together the best cybersecurity researchers from across the globe, which helps us stay informed of emerging best practices in threat-informed defense and educate the market.
Our close partnerships with control vendors in the Preactive Security Exchange, including Microsoft, Cisco, LogRhythm, Illumio, and more, enable us to continuously work on ways that joint customers can realize greater ongoing value from both our products to ensure cybersecurity effectiveness.
Finally, to further the practice of a threat-informed defense, we surround our customers and our community with free in-depth, hands-on cybersecurity training on the latest concepts and techniques in AttackIQ Academy. Already more than 14,000 student practitioners have registered for classes to earn certifications in Purple Teaming, BAS, how to operationalize the MITRE ATT&CK framework, and more.
Unlike some of the regrettable fashion choices of the past, believe me, BAS is here to stay. Join us for a weekly demo with your peers or reach out for a private consultation and we’ll be happy to show you how to proactively identify gaps in near real-time and prioritize security investments more efficiently and effectively.
