Reduce Risk Faster

Learn how to prioritize high-impact findings with PlexTrac’s new Priorities module

David Rushton, PlexTrac sales engineer, has talked to many, many security professionals and leaders in both the MSSP and enterprise spaces about how they use threat intelligence and dark web monitoring to inform their security strategy. In a recent webinar, he distilled his insights on how to maximize intelligence to provide better, more actionable offensive security data and move the needle on security posture. 

Watch the full webinar or read on for the highlights. 

PlexTrac’s new Priorities module contains the industry’s first configurable contextual scoring engine that empowers security service providers and enterprises to:

• Accelerate time to value — Ditch generic scoring and tailor it to your unique risk tolerance or industry-specific needs.
• Achieve continuous validation — Identify patterns in your data to create and execute targeted remediation, retesting, and validation strategies. 
• Demonstrate progress to stakeholders — Prove the effectiveness of your security program by clearly communicating root issues and progress on addressing them.

Accelerate time to value

The easiest way to accelerate time to value from your vulnerability scans, pentesting results, and other data is to be able to consolidate, aggregate, and group that data into themes based on risk. Scoring systems help assign a level of risk so that you can prioritize which issues to work on first. Unfortunately, existing scoring systems don’t account for the context of your organization or environment. 

David explained, “I’ve got a lot of experience with working with different scorings, and the biggest thing they always fall down on is that they never take in the customer’s context or scenario. There are a lot of great scoring systems out there, but some customers need the ability to apply their own context within their own scenario so they can better prioritize based on their situation and what they’re trying to do — either in the moment or strategically as an organization.” 

PlexTrac Priorities features a fully configurable, context-based scoring equation that enables you to create a scoring system that takes into account industry standards like CVSS and also the context of your or your clients’ specific needs. 

Dahvid shared the value he sees in PlexTrac’s scoring equation: “This gives you the ability to facilitate that conversation in a way that will make sense to those leaders and customize it further from what is already an industry standard. You can make your standard at this point.”

The ability to easily apply a score that has been created and agreed upon to prioritize the most critical issues for a specific organization is what truly helps teams make fast and meaningful progress in their security posture. 

Dahvid continued, “As IT admins, you want to focus on the things that sound the most impactful or the most likely, but there could be something that isn’t exactly a very high likelihood, but a high impact and affects a larger asset count — that should be your priority. That should be the remediation [priority], especially considering that if the impact is high enough to facilitate a higher score, you want to make sure that you’re fixing the things that are going to cause the most issues within your organization. So by being able to provide other elements of focus so that you can pull the IT admins or the security personnel out of the tunnel that they may be in and show them a greater picture, it really does help build that remediation plan in a way that is going to be not only effective but much more efficient in ensuring a risk reduction strategy across the board from a pentest.”

Achieve continuous validation

To reduce risk more quickly also requires continuous risk assessment. Ongoing and consistent testing and validation reveals the high-impact findings in your environment right now rather than in a few months at that next pentest. Many organizations are moving toward a continuous testing model but the increased and constant data flow makes prioritization even more important — and more difficult. 

Dahvid said, “So a lot of the ways that we have looked at using Priorities have been more focused on the continued aspect. A lot of teams, especially with larger, more mature organizations, are starting to move to a much more consistent testing schedule — which is phenomenal. But the hard part with consistent testing is then you have to wade through the consistent amount of reporting. And execs are trying to get to the point. They’re trying to figure out what is the risk, and what is actually something that we need to prioritize. Hence the Priorities module.”

PlexTrac Priorities streamlines and speeds the scoring and organization of findings under themes that can be easily tracked as fixes are made. This not only helps all stakeholders determine what the greatest risks are but also helps ensure those priorities are getting treatment so they can be validated and other issues raised in priority — in an continuous spiral of progress. 

“We do a lot of red teaming, so we tend to encompass a very large swath of physical, logical, and social, and sometimes those intermix with one another. A lack of good standard operating procedures could be a trend that we want to point out that isn’t readily available through just a finding itself. You can extrapolate that from the report and from the narratives, but providing it in a smaller, more condensed, ingestible format like Priorities does just makes it so much quicker. It streamlines that process and gets right to the heart of the problem instead of trying to explain it or sit down over multiple conversations, which is fine, but the quicker you can resolve something, the better.

“So Priorities really helps simplify, but also amplify the speed in which you’re able to remediate, because now you’re focusing on what is actually the root of the problem,” Dahvid said.

Demonstrate progress to stakeholders

Finally, Priorities is an excellent tool for presenting technical data to non-technical stakeholders in a way that immediately provides value. The high-level analytics views PlexTrac can produce help show progress on SLAs and priorities in a way that is easy to understand.  

Dahvid expressed, “This is probably my favorite aspect of the addition. And it mainly focuses on communicating to executives on a continuous basis. It gives a viewpoint in, I hate to say it, pretty colors, right? Graphs and pretty colors actually do paint the picture though, right? Words are great. And we all do a good job at reading our reports and ensuring what is being found is presented in a methodological way. But graphs and pictures tell the story at the end of the day.” 

David explained, “But at the end of the day, you need to show your worth. You need to show how you’re delivering value either, as in your situation, to a customer or internally to your line managers, to your organization in general. To be able to say, ‘Hey, I’ve done all these tests, this is what I’ve measured, this is what’s been fixed, this is what I’m helping you guys focus on with the analytics, with priorities as well,’ and that really shows your value and how much improvement you can make.”

The ability to compare report over report, test over test, in PlexTrac demonstrates the value of security investments in either internal testing or outsourced services in a concrete way. Dahvid responded, “Here’s what we had in our first test and here’s what we had in our second. Here’s what we had in our third. And here’s the trend, right? And this really opens up the horizon of knowledge for them in a way that I don’t think any other reporting tool has done in the past.”.  

See PlexTrac in action

With PlexTrac Priorities, service providers can increase the value of services and create opportunities for new and more frequent service delivery. Internal teams can proactively leverage offensive security data, prioritize risks, and drive continuous risk reduction

Dahvid closed saying, “PlexTrac has been a phenomenal tool in amplifying the speed at which you can accomplish your reporting. It’s where they started, and PlexTrac has done a phenomenal job at doing that. This is the next step in the communication model for reporting. At the end of the day, we’re always trying to communicate to our best knowledge how to resolve issues within either our organizations or our clients’ organizations. Priorities is that next step.”

Check out our Context Is Key eBook to find out more or see PlexTrac Priorities in action for your team with a personalized demo.