Cymulate has also recognized the need for security validation services and has partnered with many organizations, including Dell, to deliver its offerings within their programs.
This is an exclusive interview series conducted by the Editor Team of CIO News with Shailendra Shyam Sahasrabudhe, Country Manager, India, UAE and South East Asia at Cymulate Ltd.
About Shailendra Shyam Sahasrabudhe:
Shailendra brings over two decades of experience to establish Cymulate in the Indian market. is an accomplished, performance-focused technology leader with over two decades of experience specializing in Growth, turnaround, and Corporate Performance Management in the IT Services domain. He has worked for a significant number of years in the cybersecurity domain.
Shailendra has been consistently delivering revenue growth and driving highly strategic business initiatives to support corporate goals. He brings his successful track record of growing businesses and delivering value for stakeholders to his current role as the Country Manager, India, UAE, and South East Asia at Cymulate Ltd. Israel-based Cymulate helps businesses of all sizes continuously assess their cybersecurity posture and prove their resilience across evolving environments and digital transformation. At Cymulate, Shailendra is responsible for business operations, sales, and marketing while ensuring the organization has a strong presence in the region.
Shailendra’s expertise lies in Marketing Management, Strategic Partnerships, Client Relations, and managing cross-functional global teams that deliver business results. He is an innovator in launching strategies, programs, and services to boost sales performance, capture new revenue opportunities, and expand them into new channels.
Prior to his current role, Shailendra was the VP Asia, Sales, at Promisec, where he created new service offerings that helped MSSPs and consulting companies undertake project-related tasks in the most cost-efficient way. He consistently delivered revenue growth of over 25% YoY at the organization where he served for over 7 years.
Shailendra has also held leadership positions at Aladdin, F5 Networks, Teledata Singapore, Godrej & Boyce Manufacturing, and Phil Corporation.
Shailendra has a Bachelor’s Degree in Engineering (BE-Electrical and Electronics Engineering from Karnataka University, Dharwad) and a Master’s in Management Studies from the University of Mumbai.
What sets Cymulate apart from other cybersecurity testing solutions in the market, and what distinctive benefits does it offer to businesses?
The Cymulate platform provides a modular, scalable platform for businesses of all cybersecurity maturity levels to understand and manage their digital risk exposure. Unlike other solutions, Cymulate provides comprehensive coverage for continuous threat exposure (CTEM) programs, which delivers the ability to scope, discover, validate, prioritize, and mobilize security programs with business context. The platform discovers vulnerabilities, assesses viable attack paths from ground to cloud, validates that security controls are effectively detecting, alerting, and acting on activity, and proves that remediation had the desired outcome. Additionally, customers that wish to automate red teaming can validate vulnerabilities across the full kill chain and conduct what-if, targeted, and custom testing. For proactive remediation and alignment of cybersecurity with business context, Cymulate also offers Exposure Analytics, which aggregates and contextualizes data from Cymulate and third-party products.
Cymulate is the only vendor to provide the functions found in internal and external Attack Surface Management (ASM), Breach and Attack Simulation (BAS), Continuous Automated Red Teaming (CART), and Exposure Analytics within one management console. Notably, the company can also ingest other third-party data to provide a holistic view of risk and improved incident response instructions. Cymulate has also recognized the need for security validation services to be provided by Managed Service Providers and has partnered with many organizations, including Dell, to deliver its offerings within their programs.
How does Cymulate’s “continuous security validation” approach help organizations identify vulnerabilities and mitigate risks in real time?
A company’s network is constantly changing as digital business requirements change, demands for access to data grow, and network configurations become more complex. The risk of revenue loss, regulatory, compliance, and insurance pressures are all driving a harder look at cyber resilience and due diligence. Given the impact on business, cybersecurity has become a topic of leadership and board-level discussion. One where questions are like, “How do you define and manage cyber resilience? Or how do you demonstrate security improvements?” Or how do you demonstrate that the company’s complex systems are resilient to emergent threats?” all must be answered in curated and straightforward ways and not be isolated from a snapshot in time. The benefit of Cymulate’s platform is that it is automated and can run consistently and on demand, so that these questions can be quickly and confidently answered. Dashboards and reporting provide easy-to-understand resilience scores of individual security controls and an aggregated risk score that can be trended over time and against best practices and industry-standard frameworks like the MITRE ATT&CK Framework.
Most security tools are designed to detect and alert when they recognize threat activity. Cymulate is different in that the technology safely performs the actions of an attacker and will scan the network to find vulnerabilities and viable attack paths, all in an automated system that is production-safe. Next, Cymulate provides over 120,000 test scenarios to use the techniques and tactics of an attacker to see if it can penetrate the network, endpoints, and other security defenses. In this process, it validates if the security controls are effectively detecting and alerting on activity. Collectively, this information and the remediation guidance provided can be used to mitigate the exposure before a real attacker has a chance to attack. These scenarios can be run as frequently as needed. Annual or semi-annual assessments are simply not adequate for maintaining a low risk profile with the pace of change in today’s digital environments. The automation found within Cymulate also provides a previously unattainable solution for companies without in-house Red or Blue Teams who lack the expertise to conduct in-depth offensive assessments.
What are the best practices an organization can implement to enhance their security posture, strengthen their IT infrastructure and establish multiple defensive layers?
Thinking like an attacker when considering defensive operations is a key component to creating a strong and reliable security posture. This means not only considering each layer of security as an independent process but also how they will work together to compensate for gaps or weaknesses in one layer with strengths in another layer. For example, if a particular type of email attachment is required for a business process, then endpoint controls and/or network defenses must compensate for that fact. Additionally, prioritizing vulnerability management is critical. A severe vulnerability in an application that cannot be reached by anyone should not take priority over a lower-risk vulnerability in a server directly exposed to the Internet. Knowing how layers of defense will interact to defend the application or server in question is necessary to determine what the true priority of any given remediation action should be. Finally, never forget the basics. Strong Active Directory control without overprovisioning or weak password policies can deflect a lot of current attack traffic that is aimed at businesses, as just one example.
What are the top five industry best practices you would recommend to partners who want to educate their customers on improving their cyber resilience?
- Cyber resilience is a product of multiple layers of defense acting together as a unit. No one product will solve all the problems a business has with cybersecurity, but proper tuning and testing can indeed help dramatically. This means more services, more often, but fewer major security incidents, dramatically reducing expenditures over time. Cymulate testing can be a huge boon here, as knowing where things can be tuned versus where things need to be replaced can reduce overall budgets. Notably, Gartner has recognized both exposure management and security validation as top cybersecurity priorities for 2023.
- Always remember that indirect attacks are as damaging as direct attacks. While it would be easier for a threat actor to access a database directly from the outside world, most threat actors would have no qualms about using social engineering and other techniques to find a back door. That seemingly minor problem of a user falling for a phishing scheme could result in a major breach.
- Cybersecurity is a team sport. While not every employee will have technical knowledge and experience, all of them are expected to be able to use basic tools like Outlook and Office applications. That’s all the skill an employee would need to help defend the organization, so they can indeed impact cyber resilience.
- Shadow IT is a huge threat. If a system isn’t known to the team managing cybersecurity, then it cannot be adequately protected, and not only could it be attacked, but it could also open a pathway to other systems as well. Mapping internal and external attack surfaces is the only way to know where applications, servers, systems, and SaaS applications are in use, and gaining access to new instances of all these things is so easy for non-IT team members to accomplish.
- Legacy has got to go. Over time, even the best-written applications will end up having vulnerabilities. This is not a significant problem for supported software and systems, as they can be patched to correct the vulnerability. That’s not the case for legacy hardware and software, though. A quick look at scanning tools like Shodan shows that there are still thousands of Microsoft Exchange Servers that will never have a patch against known and actively used vulnerabilities; they are exposed and cannot be fixed. For any business process, there are similar examples of legacy systems still being used and being attacked. While this means additional budget expenditure to upgrade or migrate, the risk of significant downtime and budget costs due to an attack far outweigh what it will cost to correct the problem, but business processes may have to evolve and change to allow the upgrade or migration to happen.
Could you provide information about any upcoming products from Cymulate?
Continuous threat exposure management (CTEM), originally presented by Gartner, is a cyclical process designed to continuously review, remediate, and control threat exposure throughout the organization. The Cymulate platform is designed to help customers implement and improve a CTEM program with its Discover, Validate, Prioritize, and Optimize approach, which is fully aligned with the CTEM program. As CTEM evolves, Cymulate will continue to add enhancements to provide our customers with the functionality needed to meet the demands of this program. Cymulate will also continue to provide new test scenarios for emergent threats so that our customers can manage their risk and respond to changes to the cybersecurity landscape.
On June 20, Cymulate launched a ground-breaking new solution for organizations to run an informed continuous threat exposure management (CTEM) program. The new Cymulate Exposure Analytics solution bridges this gap by ingesting data from Cymulate products and other third-party data on vulnerabilities, risky assets, attack paths, threat intelligence, and other security controls to create a risk-informed defense aligned with business contexts. The Cymulate Exposure Analytics solution has a quantifiable impact across all five of the CTEM program pillars and on a business’s ability to reduce risk by understanding, tracking, and improving its security posture.
Also read: How to increase Cyber Resilience in the Third-Party environment?
Do Follow: CIO News LinkedIn Account | CIO News Facebook | CIO News Youtube | CIO News Twitter
About us:
CIO News, a proprietary of Mercadeo, produces award-winning content and resources for IT leaders across any industry through print articles and recorded video interviews on topics in the technology sector such as Digital Transformation, Artificial Intelligence (AI), Machine Learning (ML), Cloud, Robotics, Cyber-security, Data, Analytics, SOC, SASE, among other technology topics
