Tag: AI and Cybersecurity

---

Introduction

Cybersecurity is often an afterthought for startups focused on growth, product development, and securing funding. However, the cost of ignoring cybersecurity can be catastrophic, especially in a world where data breaches and cyberattacks can take down even the largest companies. As a startup founder or executive, you don’t need an army of security professionals to protect your business—you just need the right strategy.

This guide provides a clear, step-by-step approach to building a robust cybersecurity strategy from scratch that grows with your company.

---

Step 1: Understand Your Startup’s Risk Profile

Before diving into specific tools or policies, it’s crucial to first understand the risks specific to your startup. Different industries and business models have varying security concerns. A SaaS platform handling sensitive customer data will have different risks than an e-commerce company, for example.

Key Questions to Ask:

• What kind of data do we collect, process, or store? Is it sensitive (e.g., financial or health information)?
• What would happen if we lost access to critical systems?
• Who would want to attack our business, and why?

By answering these questions, you can assess the potential impact and likelihood of a cyber incident, allowing you to prioritize which areas of cybersecurity to focus on first.

---

Step 2: Build a Security Culture from Day One

Security is not just an IT issue—it should be embedded into your startup’s culture from day one. Building this culture early on will ensure that all employees, regardless of their role, are aligned with the company’s security goals.

Actionable Tips:

• Training and Awareness: Make cybersecurity training part of onboarding for all new employees. Teach them about common threats like phishing, social engineering, and password hygiene.
• Foster Accountability: Encourage a mindset where every team member takes responsibility for security, whether they’re in engineering, marketing, or sales.
• Regular Communication: Have open lines of communication about security incidents and vulnerabilities. Transparency is key to creating a proactive security culture.

---

Step 3: Implement Basic Security Measures First

You don’t need to hire a full-time CISO or invest in expensive security tools right away. Start by implementing basic cybersecurity best practices that can drastically reduce your risk.

Security Basics for Startups:

• Strong Passwords and Multi-Factor Authentication (MFA): Implement MFA wherever possible—especially for critical systems such as email, CRM platforms, and development environments.
• Data Encryption: Ensure that data at rest and in transit is encrypted using industry-standard protocols (e.g., TLS for data in transit, AES-256 for data at rest).
• Backup and Recovery Plan: Regularly back up your data and have a disaster recovery plan in place. Automate backups for critical data and systems, and ensure that backups are stored securely.

Suggested Tools:

• 1Password or LastPass for password management.
• Google Workspace or Microsoft 365 for built-in security and data encryption.
• CrashPlan or Backblaze for automated backups.

---

Step 4: Identify and Secure Critical Assets

Your startup might not have many resources to secure everything equally, so you need to prioritize protecting the assets that matter most. These could include customer data, proprietary code, intellectual property, or key infrastructure.

Steps to Secure Critical Assets:

1. Map Your Data: Identify where your most sensitive data is stored and how it flows between systems.
2. Segment Networks: Separate critical systems and data from less important systems. For example, development environments should be segmented from production environments.
3. Apply Principle of Least Privilege: Limit access to critical systems and data to only those who absolutely need it. Implement role-based access controls (RBAC).

Suggested Tools:

• AWS IAM or Azure AD for access management.
• Datadog or Elastic Security for monitoring infrastructure and assets.

---

Step 5: Protect Against Common Attack Vectors

Startups are often targeted by cybercriminals looking to exploit weak points. Understanding the most common attack vectors will help you defend against them.

Top Threats to Startups:

• Phishing Attacks: Employees may receive fake emails designed to trick them into sharing sensitive information or credentials.
• Ransomware: Hackers encrypt your data and demand a ransom for its release.
• Insider Threats: Both malicious and accidental insider actions can expose your business to security risks.

Key Defenses:

• Email Filtering and Anti-Phishing: Use email filtering solutions that block suspicious emails and train employees to recognize phishing attacks.
• Endpoint Protection: Ensure all company devices are protected with antivirus software and endpoint detection and response (EDR) tools.
• Access Controls: Implement strict access controls for sensitive data and systems.

Suggested Tools:

• Proofpoint or Mimecast for email security.
• CrowdStrike or SentinelOne for endpoint protection.

---

Step 6: Establish an Incident Response Plan

No matter how well-prepared your startup is, incidents can still happen. Having an incident response plan ensures that your team can act swiftly and minimize the damage.

Key Elements of an Incident Response Plan:

• Incident Detection: Set up monitoring to detect potential threats early. This could involve alerts for unusual login attempts, unexpected data transfers, or system changes.
• Response Team: Assign roles and responsibilities to a response team, including who will handle internal communication, who will investigate the issue, and who will communicate with external stakeholders.
• Post-Incident Review: After an incident is resolved, conduct a thorough post-mortem to understand what went wrong and how to prevent future incidents.

Suggested Tools:

• Splunk or Datadog for real-time monitoring.
• Trello or Jira for managing response steps.

---

Step 7: Plan for Growth with Scalable Security Solutions

As your startup grows, so will your attack surface. Security should scale alongside your business, so it’s important to invest in tools and processes that can grow with you.

Scalable Security Practices:

• Cloud Security Posture Management (CSPM): As you adopt cloud services, CSPM tools will help you continuously monitor and improve your cloud security.
• DevSecOps: Integrate security into your development pipeline early (shift-left security) to catch vulnerabilities before they go to production.
• Third-Party Risk Management: As your ecosystem expands, ensure that your vendors and partners also have robust security practices.

Suggested Tools:

• Palo Alto Prisma Cloud or Lacework for CSPM.
• Snyk or Veracode for DevSecOps.

---

Conclusion: Start Small, Scale Big

Building a cybersecurity strategy for your startup doesn’t need to be overwhelming. By focusing on the basics and implementing scalable security practices, you can create a strong foundation that grows with your company. Cybersecurity should be viewed as an ongoing process—not a one-time project. With the right mindset, tools, and a proactive approach, your startup can stay secure and resilient in today’s dynamic threat landscape.

---

TLDR; When Nagomi emerged from stealth in April, we noticed that any time we linked to nagomi.security on LinkedIn, it would be flagged as “Possible Malicious Content.” Here’s why and how the issue was resolved. And some interesting findings…..

Disclaimer: The Author Isn’t a Security Practitioner.

I’ve worked at several cybersecurity companies, but I’m not a researcher, engineer, or any flavor of legitimate security practitioner. I was a developer back in the stone age (early 2000s), but I don’t claim any expertise whatsoever. There’s a high probability that I’ll get some stuff wrong, so I figure I should start with that.

Possible Malicious Content: A Not-So-Great Look for a Cybersecurity Company

If you’ve ever launched a company and its website from stealth, you’d know that it’s a lot like a duck swimming. On the surface it looks calm and natural. Underneath it’s web-footed chaos.

But this one was actually pretty straightforward with very few hiccups. In fact, I remarked that this was one of the easiest site launches I’ve ever done. Which is why the next part happened. The universe loves a gloater.

Right after launching the site, I launched our LinkedIn page. And immediately I noticed something weird: as soon as I put in nagomi.security as our site URL and URL for a CTA button, I saw that the URL was overwritten and went to:

And after playing around a bit, I noticed that ANY .security TLD was getting overwritten. But that didn’t make sense…there are plenty of companies that have .security domains….

I then saw that any time we posted from the Nagomi Security LinkedIn page, if we linked to, say:

https://nagomi.security/what-is-credential-stuffing-and-how-can-cybersecurity-teams-use-existing-tools-to-minimize-the-threat/

Clicking that link would result in:

Why Is LinkedIn Marking Our Domain as Possibly Malicious?

I reached out to LinkedIn support about the issue and got the following reply (and quickly):

Going to VirusTotal, we saw:

Two security tools listed in VirusTotal dinged us for having a “newly registered domain name”. Although the domain was registered in January….

…I guess “newly registered” is subjective.

We then reached out (via form fills) to the 2 vendors to get out of domain jail. Meanwhile….

Hey! Look!! I Found A Workaround!!

Filling out forms isn’t exactly the most urgent path to getting a problem solved, so in the meantime we needed to share our content and build a following for our LinkedIn page. I found a couple of workarounds – each with quirks.

Workaround 1: A .com Domain Forwarding to the .security Domain

A few days before registering nagomi.security, we registered nagomisecurity.com

That domain just forwards to nagomi.security, so if we want to promote the blog post that’s at:

https://nagomi.security/what-is-credential-stuffing-and-how-can-cybersecurity-teams-use-existing-tools-to-minimize-the-threat/

we could just use:

https://nagomisecurity.com/what-is-credential-stuffing-and-how-can-cybersecurity-teams-use-existing-tools-to-minimize-the-threat/

It works, but it’s kind of long. LinkedIn uses its own URL shortener, so the long URL above would end up being: https://lnkd.in/eJUbqRtt Problem solved, but that’s odd. LinkedIn is okay with a URL that forwards to a domain flagged in VirusTotal. So wait…..what about…

Workaround 2: A Bitly URL

If LinkedIn is cool with a redirect, then would they allow a URL shortener like bit.ly?

Yep! When you buy a bit.ly subscription, you get a new domain registration

On April 23rd, while still serving our sentence in new URL jail, I registered nagomi.ws and then started creating shortlinks to nagomi.security. It works every time. Here: https://nagomi.ws/youre-so-vain That goes to my LinkedIn profile. This one goes to our super popular credential stuffing blog post https://nagomi.ws/4bjnnga

The Resolution

On April 29th, I got the following message:

24 hours after being cleared by VirusTotal, LinkedIn should drop the warning. Then, on May 20th, I checked VT and we were clear! But we were still being flagged as malicious. I reached out to LinkedIn and let them know that although we were clear in VirusTotal, our links were still getting marked as possible malicious content.

Then, the next day I got a message:

I looped in our Trust and Safety and they let me know website link was caught by one of our security vendors but has been cleared since.

Fixed!

What Did We Learn?

First, LinkedIn uses VirusTotal to check links and if any vendor on VT says you’re a potential problem, you get flagged. So if you’re emerging from stealth and plan to use LinkedIn, check VirusTotal before launch. It might take a while to get cleared.

Second, register your domain months before you plan on launching. You can get dinged for a “new domain” even when your domain is hundreds of days old…..

….unless

Unless you want to use a brand new forwarding domain like bit.ly. Not only does that skip the “newly registered domain” issue, it allows you to forward to any domain you want! Which begs the question: does LinkedIn have a suppression list for domains so that if they’re known to be owned by a URL shortening service they skip the VirusTotal check?

Thirdly, LinkedIn support was very helpful, super responsive, and without their escalation path I don’t think the issue would have resolved itself. It’s not their fault that VT marked us as potentially malicious, and as soon as they saw we were in the clear, they let us out of jail immediately. Kudos to them!

Fourthly and finalthly – This security research stuff is fun! I’m not going to quit my day job, but I see why people love going down the rabbit hole. And if you’ve made it this far, thanks for reading…and please let me know what I got wrong. I’m sure there are errors. Just not the word “finalthly”. That’s correct.

Today we’ve announced that Nagomi Security has emerged from Stealth with $30 million in funding. The company operated in stealth mode with Seed funding from Team8, and the recent round was led by TCV, with participation from CrowdStrike Falcon Fund and Okta Ventures. Nagomi is also backed by leading angel investors, including Shlomo Kramer, co-founder and CEO of Cato Networks, Nir Polak, co-founder and CEO of Exabeam, and Guy Podjarny, Founder of Snyk.

How I Got Here

After 6+ years of career-defining work at Axonius, I knew I had to get back to early stage. I am incredibly proud of what we were able to accomplish, the team we built, the product, and I have nothing but great things to say….I mean….I have a tattoo on my arm to prove it. Going from zero to $100 million in ARR is a massive accomplishment, and I can’t say enough about the team that made it happen.

But it was time. I was always conscious of the fact that – at some point – there would be someone better to run marketing at a certain level of size and scale. Knowing that I love the early, chaotic stage from stealth to $100 million, balanced with knowing that there is someone out there that loves the $100+ million stage, it became clear to me that it was time to move on.

Start or Join?

When I made the decision to do something new, I had to choose whether to start something myself or join an existing startup. And I had an idea that was bothering me. Despite all of the tools we have in cybersecurity, how do we know whether they’re actually providing value and working effectively? Other than the binary “did I get breached?” how can we tell whether what we buy is both working and providing value? And in both cases, how do we measure progress?

I had incredible guidance from investors that thought the problem space was interesting enough to explore. And when I spoke to one investor specifically, he said something like “not only do I love the problem space, I invested in a company a year ago that’s working on exactly that problem. You should talk to them.” So I did. And they were. So I am, too.

I Buy All This Stuff…….But Is It Working?

Cybersecurity is hard. You buy a bunch of tools, configure them on day one, and then move on to something else. But threats change, cyber criminals pivot, and tools add functionality over time. But with cybersecurity teams constantly stretched thin, and practitioners underwater with too many threats to possibly investigate it becomes incredibly difficult to ensure that the tools we have at our organizations are configured properly against the real-world threats targeting us.

What if there were a way to connect all of your security tools to a brain that:

1. Creates a unique threat profile for your organization – taking industry, geography, size, etc. into account.
2. Constantly monitors threats, campaigns, and TTPs that are being used in the wild.
3. Understands that a law firm in the UK is being targeted by different threat groups than a manufacturing plant in Australia, and using different attack vectors.
4. Looks at your security tools and defenses, and then maps to MITRE ATT&CK to understand where there are gaps, where there are opportunities for improvement, and then gives prescriptive remediation plans to move the needle.

That’s what Nagomi does. By connecting to the security tools an organization already uses, it then compares that to threats like ransomware and phishing, then gets more granular looking at the specific threat actors and campaigns, analyzing the configuration of the stack, and providing evidence-based suggestions on how to decrease threat exposure.

How Big Is The Problem?

Big.

Much like it was in the early days at Axonius, every person I talk with has the problem. At Axonius I’d ask “how many devices do you have?” and would get either “I don’t know” or “between 10 and 30,000.” Here, when I ask “how do you know whether your security tools are effective against Black Cat ransomware, and do you have any exceptions? What about compensating controls?” I hear “It’s incredibly manual, and we’re trying to figure out how to solve it.”

One of our customers put it best: “You buy a bunch of tools and have them configured perfectly on day one. But then you move on to other things, a year goes by, and you know that there are either new features or changes that could make your defenses more effective against changing threats. I want to know where my controls are degraded, where I am exposed, and what I can do to close that gap and move the needle.”

Give It To Me Straight, Doc

I like an analogy, so here goes:

So How Do I See It?

Great question. We just emerged from stealth today, and our awesome new site is nagomi.security – huge thanks to the team at CNP who put up with my aggressive timeline and dumb questions. They really do great work (I’ve worked with them at 3 different companies).

And if you’ll be at RSA, come see us! You can schedule a time here, or send a message and we’ll find a time to talk!

Today we released the final installment of the Axonius film series with Simone Biles, Controlling Complexity: Growth. This post looks at why we did it, how we evaluated whether it was successful, and what we learned from a 2 year adventure.

Starting at the End: Today’s Launch

Today we’re launching the final chapter in our 3 part series with Simone Biles. You can see Controlling Complexity: Growth here.

What Were We Trying to Accomplish with the Controlling Complexity Campaign?

In a word: awareness. When we first started Axonius, we knew that the larger the organization, the more acute the pain they felt around knowing what assets they had, uncovering risk, and automating action. But a few years after launching the first cybersecurity asset management solution, we noticed that smaller organizations were feeling the exact same pain.

But as a young company, we didn’t have the brand awareness for the masses. In fact, when we did our first aided recall survey only 9% knew who we were. In other words, 91% of our target audience didn’t know Axonius existed.

Which led us to do two things:

1 Creating a simple theme to describe our value.

We could talk about cybersecurity asset management, becoming the system of record for digital infrastructure, and all of the amazing product features we have. But we needed a big theme to hang those from. We needed that big, lofty idea to concisely tease the aspirational value.

Q: What is the thing that Axonius customers get when they buy our product(s)?

A: They are able to control complexity.

Complexity is inevitable. It’s the 2nd law of thermodynamics, and it’s true in our everyday lives. Over time, things get more complex. And that’s what we see at organizations we work with. They add more people, more devices, SaaS applications, cloud instances, and tools to manage and secure them all.

This fragmentation is what leads to many of the IT and security challenges organizations face today. But if they were able to collect, aggregate, and correlate data from all of the sources that know about assets, they would be able to know what they have, uncover risk, and decide what to do when any asset deviates from their expectations.

In short: we help organizations control the inevitable complexity they will face as they grow.

2. Figuring out how to tell the story

Great. We have a theme that fits. Now what? Well now we needed to figure out how to tell that story.

Cybersecurity vendors (and tech in general) tend to rely on talking about military-grade features, real-time detection, and lead with FUD. They rarely focus on the people behind the software and hardware. The hacker behind the hoodie.

We wanted to focus on the human beings that know working in cybersecurity isn’t a fair fight, but they show up every day anyway.

We wanted to find a public figure that represented the idea behind the campaign. Someone that faced adversity and came out stronger on the other side. Someone that could adapt. Someone that is constantly striving for growth.

I kept coming back to one name: Simone Biles. Arguably the greatest American athlete of all time, she grew up as a foster kid, and the entire world watched her at the Tokyo Olympics. Imagine competing at the highest level under a worldwide microscope. But Simone is one of the most marketable athletes on earth. Why would she choose to work with a cybersecurity company?

You don’t get what you don’t ask for. So we asked.

https://www.linkedin.com/embeds/publishingEmbed.html?articleId=7158501276213989373&li_theme=light

Meantime, we saw that a video of Amy Bream, a Crossfit athlete born with one leg was going viral. In the video, she’s seen trying to lift a very heavy weight, and fails. She tries again, fails. Tears stream down her face. But she does it again and this time, she nails it. In that video, without any words whatsoever, it encapsulated the spirit of the campaign.

https://www.linkedin.com/embeds/publishingEmbed.html?articleId=9129140883019890487&li_theme=light

So we reached out to Amy, too.

What happened next is truly unbelievable. They both said yes. And in what I will refer to as the “dog that caught the car” scenario, we had to figure out what to do next. What happens to the Marketing team that got what they wished for?

What Do These Two Athletes Have to Do with Cybersecurity?

As Chris Cochran and Ron Eddings so perfectly say:

Cybersecurity professionals are mental athletes with no off-season.

From an Inc. article covering the initial campaign launch:

Still, it invites the question, what does a cybersecurity asset management firm aiming to humanize the field have in common with a gymnastics star, even if that star has been hacked?

Despite the unusual pairing, the answer’s pretty simple: resilience.

“Throughout our lives, we’ll all share adversity and complexity over the course,” Biles tells Inc. “And the ability to persevere through that is what really makes a strong system.”

“We both share complexity,” Biles adds. “Even if it’s in our own different worlds, we both go through it.”

and:

Biles isn’t the only athlete to connect to Axonius’s campaign. The CrossFit champion Amy Bream, who was born without a right leg, is also involved. Along with Biles, the two will discuss how they each take on complexity in their lives in a video series that’s housed on an Axonius video platform. They will also make appearances on podcasts and in-person events.

Chapter One: How Amy and Simone Control Complexity

Our first video with Amy Bream looked at how she focuses on what she can control to overcome adversity.

https://www.linkedin.com/embeds/publishingEmbed.html?articleId=8628858540957729997&li_theme=light

Followed by the first commercial with Simone Biles

https://www.linkedin.com/embeds/publishingEmbed.html?articleId=7071930296964594043&li_theme=light

Chapter Two: Adaptation

In the second installment, we wanted to highlight how in the face of enormous complexity, the best not only find ways to adapt to the challenge, they also find ways to give back.

Giving back is core to what we do at Axonius. In this chapter, we were fortunate enough to be able to give to Friends of the Children – an organization that provides professional mentors to kids in foster care – and the Morgan family. I don’t want to spoil it. You’ll have to watch:

https://www.linkedin.com/embeds/publishingEmbed.html?articleId=6938837850868601515&li_theme=light

Chapter Three: Growth

And now, back to today. We started with the fundamentals of dealing with complexity. We then looked at adapting to challenges. In the final chapter, we finish with the idea that complexity is inevitable, but growth is optional.

To do this, we wanted to bring in people that work in and adjacent to cybersecurity to tell their stories through the vehicle of a letter written to their younger selves. We then had an informal conversation to explore the common threads between a champion athlete and cybersecurity professionals:

Oritse Justin Uku, CISSP is an author, veteran, and Business Information Security Officer. I met him years ago at an event in NYC and stayed in touch. His journey from business school to Afghanistan, finance to cybersecurity is fascinating, and I’ve always thought him to be one of the most inspiring people I know.

Tiffanie Joseph, PSM1 took the leap to put herself through a yearlong cybersecurity program to improve her and her daughter’s life. Her story is evidence that cybersecurity can transform people’s lives.

John Seaman helped us convince Simone to work with us in the first place. John and his family have been involved in orphan care (adopting & fostering), he’s a long-distance runner, and his motto is to leave people, places, and things better than you found them. A truly great human being.

Promoting the Growth Chapter: Letter Writing Campaign

As part of today’s launch, Dean Sysman wrote his own letter to his younger self:

https://www.linkedin.com/embeds/publishingEmbed.html?articleId=8810343331209025451&li_theme=light

We’re encouraging people to write their own letters to themselves about a time when you overcame complexities of your own.

Use hashtag hashtag#DearYoungerMe and please tag Nathan Burke, Dean Sysman and Axonius in your post so we can read your stories!

Was It Successful? How Do We Know?

People often say that measuring brand is impossible. You just know the absence of it. I disagree.

Though not perfect, I evaluate brand investment in two ways:

1. Aided Recall – If you made it this far, you may remember that at the outset of the campaign we were at 9% aided. 18 months later (before today’s launch) we are now at 27% aided recall. That is a historic leap in such a short time.
2. Customer and Employee Stories – We are constantly hearing from customers and Axonius employees that they only found out about us because they saw the Simone and Amy content.

I won’t give any numbers here, but I can confidently say that the investment has been well worth it by any measure.

Time to Thank People

Working with Simone, Amy, and everyone involved with this campaign was truly a career highlight for me. I need to thank many people, and I apologize for anyone I’ve missed.

Kaite Rosa, Karen Dorfzaun, Elizabeth Hartel, Madeleine King, Jeffrey Schleicher, Allen K. and Sky Pak – You transformed a high-level idea into something amazing that you should all be proud of. You accomplished something that is beyond all expectation.

Dean Sysman – You let us run with a crazy idea that no one has ever done before. Thank you.

Stephanie Fox, Micheal B., Jennifer Lynch, Austin Holcomb for all the work behind the scenes on the website and social channels to get this out the door.

Tracey Workman for convincing journalists that this wasn’t a run-of-the-mill vendor stunt, but a story worth telling.

To our great agency partners Stept Studios for producing and editing the final chapter in the series, and to Ruckus for the first two chapters.

To Janey Miller, Drew Johnson and the Octagon team for taking a chance on a cybersecurity company who wanted to do something ambitious.

To Genevieve Jewell Thompson and the Amy Bream team – thank you so much for being a joy to work with.

To Oritse Justin Uku, CISSP, Tiffanie Joseph, PSM1, John Seaman – thank you for letting us tell your stories.

To the entire Axonius team, thank you for supporting this project. I am so proud of the work we’ve done and can’t wait to hear what people think.

People tell us that they see Axonius everywhere – and we love hearing that. But a lot has to happen behind the scenes. Here’s a backstage look at what went into our recent news along with some massive thank yous to those that make everything look easy. 

Plans and Punches to the Face

There’s a quote I love from Mike Tyson:

 “Everybody has a plan until they get punched in the mouth.”

Originally, we planned to announce our funding round on March 3rd, but with so many huge funding announcements in the news, we wanted to give ourselves until March 9th. The great and powerful Megan Berry decided we should do a Times Square takeover, so we planned to have the press coverage coincide with billboards on the NASDAQ and Thomson Reuters buildings. We wanted to go big. 

PR strategy is simple: with news like our funding announcement, there are two options:

1. Exclusive – You pitch one major outlet and let them break the story.
2. Embargo – You pitch everyone and tell them what time they’re okay to publish the news.

Going exclusive lets you shoot for a higher-tier publication, but you sacrifice breadth. The embargo route gets you more coverage, but when you’re a young company, that usually means the top-tier publications won’t cover the news. 

Sin Embargo

None of that matters in this case. Instead, someone leaked our news to a publication that refused to hold the story. On a Sunday. So we had to improvise.

Great PR is like chess: you have to be strategic and think 3 moves ahead, BUT you also have to react to what’s thrown at you. That Sunday morning, LookLeft (our PR firm) pulled off what should be taught as a case study in rapid response PR. They were able to get a top-tier publication to interview our CEO and Co-founder and the story got massive coverage everywhere. Outstanding work. 

Let the Professionals Do It

To share the news with our customers, we wanted to shoot a short video of Dean Sysman. I’m a big fan of DIY video, but there are times when you should call in the pros. TestimonialHero shoots all of our customer videos, and this is what they were able to create for Dean’s announcement

I simply cannot recommend TestimonialHero enough. Everything they produce is amazing looking, and getting people to feel comfortable while doing something inherently uncomfortable is their superpower. 

Times Square Takeover

Although the news of our unicorn status was already out, we decided to move forward with the Times Square billboards anyway. I had some truly terrible ideas for a design. Like, embarrassingly bad. So I consulted with the mighty Kaite Rosa, and like always, the result was something we loved. And then, superstar designer Maddie King created something that was jaw-dropping:

If we were living in a normal world, we would have invited everyone in the company to be there to see it. My only regret is that we couldn’t have all Axonians together in Times Square to be part of that moment, but that would have been irresponsible. It takes a massive effort from everyone in the company to go from nothing to a $1.2 billion valuation in such a short time, and although only a handful of people could be there to witness it, I hope they feel the same sense of awe. I need to thank Eileen Ann, Linor Shust, and Jacklyn Goldstein for making this all happen safely.

Back to Work – Now What?  

Instead of our billboards coinciding with our unicorn status, that day we announced that YL Ventures sold its stake in Axonius for $270 million to make room for IPO-focused investors.

The fact that our earliest investor sold its stake in Axonius makes sense all around. YL Ventures is able to focus on what they do best while making room for later-stage investors that have expertise in scaling companies to IPO and beyond. 

So that’s the plan. We want to push ourselves to solve a huge, nagging problem that’s been around for decades and do it with a simple product that our customers love. We want to do that with exceptional employees that aren’t afraid to do really hard things while maintaining standards that are just shy of impossible. 

So far, so good. 

In the 4 months since Hexadite’s acquisition by Microsoft, I’ve had a lot of fun. Working to integrate the security automation functionality of Hexadite AIRS into Windows Defender ATP (in record time) was a great experience and I had a chance to work with some truly amazing people. But now it’s time to go back to the startup world, and as of 12:01 this morning, I’m the Chief Marketing Officer at Axonius. I’m excited.

The Problem

There are plenty of problems worth solving in cyber security. Let’s just say it’s a target rich environment. At Hexadite, we were solving the cyber security capacity problem: too many attacks cause too many alerts, and there aren’t enough people to follow up.

With Axonius, we’re trying to help IT and Security Teams answer four basic questions:

1. How many devices are on my network?
2. Why are these devices important?
3. Where are the blind spots?
4. What can I do if I know the state of all devices?

The Easy Question With A Difficult Answer

The first question: “How many devices are on my network?” should be easy, right? Not exactly. As Adrian Sanabria wrote in a piece on Axonius:

Our market is full of machine learning, big data and even virtual reality interfaces. So why, as an industry, haven’t we properly addressed so many of the basics? The answer is simple: the basics are hard. It might not be the sexiest problem to solve, but asset management is critical to an effective security program. We can’t secure what we don’t know about. The security industry has some serious unfinished business to content with.

and

Currently preoccupied with applying machine learning algorithms to everything, the security industry has, for the most part, stayed away from large-scale device identification, authentication and management efforts for nearly a decade. It seems strange, that in 2017, our tools should have such difficulty telling the difference between an Amazon Echo and a Laptop running Ubuntu, but now is definitely the right time to revisit this problem.

Why Is Every Device Important?

Surely a home laptop is different than a production server, which is different from a smart aquarium, right? There are two very important points to keep in mind when determining whether a device is relevant:

1. Devices have access to information – whether you’re talking about access to a company drive or even stored credentials to a salesforce.com instance, devices are given access to corporate data that you don’t want in the wrong hands.
2. Each connected device is a node in a cyber attack – I think it’s interesting to think of devices from the hacker’s perspective to understand that each device – regardless of form – is a potential entryway to get what they’re after. I used the “smart aquarium” example above, but this is a real example of an attack from security firm Darktrace (via CNN):

Hackers attempted to steal data from a North American casino through a fish tank connected to the internet, according to a report from security firm Darktrace.

Despite extra security precautions set up on the fish tank, hackers still managed to compromise the tank to send data to a device in Finland before the threat was discovered and stopped.

“Someone used the fish tank to get into the network, and once they were in the fish tank, they scanned and found other vulnerabilities and moved laterally to other places in the network,” Justin Fier, director for cyber intelligence and analysis at Darktrace, explained to CNN Tech.

As internet-connected gadgets and appliances become more common, there are more ways for bad guys to gain access to networks and take advantage of insecure devices. The fish tank, for instance, was connected to the internet to automatically feed the fish and keep their environment comfortable — but it became a weak link in a the casino’s security.

Where Are The Blind Spots?

Another interesting question: “How do I find those devices that aren’t managed?” For example, most larger companies use a mobile device management solution to secure corporate data on personal phones, and most have some kind of EDR product on the endpoints. But what about those things that are connected, but not managed? How do you find out what they are and where they are (both geographically and on what part of the network)?

Like Sanabria mentioned in the above referenced profile:

“We can’t secure what we don’t know about.”

What Can I Do if I Know?

So let’s take a leap forward and assume the problem is solved. Everyone now has the ability to see every laptop, desktop, server, phone, fish tank, whatever, and they can see the software running on each. What net new capabilities would that bring?

1. Show me how many and which of my machines are vulnerable to WannaCry – Think of what you’d have to do currently to answer that question. You can’t just ask Alexa.
2. Increase security solution coverage – If you can see which machines are covered by which security tools, you can both use that information to broaden coverage and you can intelligently address the blind spots.
3. Verify security policies – You may have airtight security policies on paper, but what if you could verify that they are working in reality? What if you could automatically test whether your DLP solution is working across all devices?
4. Focus your patch management efforts – knowing which devices are running which versions of un-patched software certainly helps in patch prioritization.

Of course, that’s just the beginning. I could go on (and will….soon), but this is day one. I’m incredibly excited to get started with a clean slate, an awesome team of super smart and genuinely good people.

Here we go. See all to secure all.