What is Attack Surface Protection?

How does the CyCognito platform analyze the attack surface?

The CyCognito platform discovers and tests all assets discoverable via the internet. This process finds assets that were previously unknown, unmonitored, and exposed to attack. The platform continuously monitors and tests all assets associated with an organization. It alerts to new, existing, or recurring issues, and provides remediation guidance to fix those issues and eliminate the risk presented by that asset.

What are attack vectors?

Attack vectors are paths into an organization’s network via issues detected in the attack surface. Sometimes these attack vectors are single steps (like an exposed remote access protocol which provides direct access to a system), or multi-step (like a vulnerability which must be exploited to allow for privilege escalation that gives an attacker control)

What are the benefits of attack surface protection?

Organizations cannot remove all of their assets from the internet, otherwise they would be unable to do business in today’s digital world. Attack surface protection delivers more than just a digital asset inventory, it ensures that an organization’s exposed and connected IT assets are known, secure, monitored for issues and defended against attacks.

How do you compare with Qualys or Tenable?

Legacy vulnerability assessment (VA) tools are focused on scanning targets within the perimeter with authenticated scans against known IP ranges. The CyCognito platform differs by approaching the attack surface as an attacker would, from the outside. We automatically discover all of the organization’s internet-exposed attack surface to establish a complete picture of the attack surface. We then evaluate the security posture of those internet-exposed assets (both known and unknown to the business), without authentication, and provide prioritized remediation guidance based on business impact.

What IT Tools do you integrate with?

CyCognito seamlessly shares information, such as alerts and issue evidence, through frictionless workflow integrations with over 400 popular IT tools, including ticketing systems, SIEMs, SOARs, XDR platforms such as ServiceNow, Jira, QRadar, ZenDesk, Tenable, and Splunk.

How can CyCognito help with attack surface protection and reduction?

The platform provides the continuous visibility necessary to understand and truly know your attack surface, even when that attack surface grows and changes daily due to the proliferation of cloud and SaaS applications. The platform also provides the guidance needed by security operations teams to identify high risk areas, monitor threats, and secure those exposed assets.

What are some attack surface reduction and protection best practices?

Attack surface protection best practice includes continuous asset discovery across the entire internet looking for new and existing internet-exposed assets that belong to your company, developing business context about how assets relate to the business, active security testing of those assets, and providing IT teams guidance to expedite remediation.

How do you compare with RiskIQ or Expanse?

Generally speaking, legacy attack surface management vendors focus on the discovery and inventory of internet-exposed assets. They don’t answer the question, “What do I do with this information?”

CyCognito does. As a foundation, we provide that comprehensive, complete inventory, and go a step beyond legacy solutions to automatically associate discovered assets with their business context, such as what processes they’re a part of.

Then, the platform actively tests the security of that inventory to show where exposed vulnerabilities, security gaps, or misconfigurations could be used by an attacker.

We use all of this together, along with exploitability and attractiveness of those issues to attackers, to guide security operations teams to remediate the 10 issues that present 90% of risk first.