Inspiration
Most of the risk management, vulnerability management software and tools provide qualitative risk scoring (Critical, High, Medium, Low) and few advanced too tools like Microsoft Security Scoring provides Quantitative risk scoring ( on a scale of 0 - 100) , both these techniques have below challenges
"What's the worst that could happen ? " infosec teams always struggle to explain the potential impact of not treating the vulnerabilities in the context of tangible outcomes due to these abstract scoring mechanisms. Loss of dollars ? Loss of reputation ? Loss of Life ? CISO's always struggle to articulate this to Board the tangible Risks from IT infrastructure
"One-size-fits-all" approach ! its far fetched for a CVSS score or any general purpose Security score which is built for standardizing to consider context! For example same Vulnerability on an asset for Bank in Bangladesh and Oil Rig in Europe will scored same ! This results in mis-guidance to the infosec teams due to lack of "personalization" !
"On a Budget " ! infosec teams and CISOs are always hard pressed on time and resources but always loaded with tonnes of vulnerabilities to prioritize and address .
What it does
Seconize Contextual Risk Analytics uses advanced AI/ML Algorithms to address the above. We provide a Financial Quantification of IT Risks in terms Dollars ! and it is personalized to Organizations context ! rather than abstract scoring mechanisms.
How we built it
We built a REST API First, Cloud native tool that leverages Microsoft Graph API's and Security Scores to contextualize for the Organization and provide Financial Risk Impact !
Challenges we ran into
Providing a holistic risk quantification involves numerous challenges , normalizing the vulnerabilities across all IT Asset types ( Web , Cloud, DB, Network ) itself is a huge challenge ! And also normalizing vulnerabilities across CVEs, Best practices, Mis configurations is another huge challenge !
Accomplishments that we're proud of
We provide the first ever , fully automated , intelligent and continuous learning enterprise class product that can identify holistic Financial Risk quantification for the enterprises , using advanced Mathematical techniques !
What we learned
We learnt lot about risk quantification itself and fundamental difference between , risks, vulnerabilities and threats !
What's next for Seconize Contextual Risk Analytics
Next big steps for us to quantify for different customers in different environments , calibrate the algorithms and results which is very complex task in its own , but we are up for all the adventures being a startup !
Built With
- java
- javascript
- rest-api
