Question 1

What is BreachRisk?

Accepted Answer

BreachRisk™ is a series of services that measure cyber risk according to the perspective of cyber attackers. The services are highly automated and can be run without any technical experience.

Question 2

What is "red teaming?"

Accepted Answer

Red teaming is a term describing the most advanced type of assessment and testing. A red team plays the part of the "bad guy" and tests defenses just like the bad guy. Similar to a futbol scrimmage, where the team prepares for a match by having 11 players wear red penny jerseys. The job of the red team is to think and act like cyber attackers.

A red team is similar to a penetration test, but there are important differences. A penetration test is a list of specific items on a list for a security analyst to check. Modern penetration tests do involve testing of security defenses, but in a very limited and specific way. Penetration testing is a good practice and is essential for compliance needs, but red teaming is much more advanced.

In red teaming, the red team takes on a more holistic and creative approach to the attack testing and is much more rigorous than a penetration test. For example, a penetration tester might merely check for an open port on a host and attempt to interact with it, whereas a red team might also see if interactions can enable follow on attacks that give the attacker progress towards a malicious goal. Or, the red team might be more creative and look for ways to trick an employee into giving them access to the open port.

While penetration testing, attack surface discovery, vulnerability scanning, dark web analysis, spearphishing, and cloud attacks can be done by a large number of security vendors, it is important to know that attackers don't do those things in a vacuum. Real attackers use these methods all together - and when combined with the creative attacker mindset the whole of red teaming activity is far greater than the sum of these parts.

BreachRisk is a continuous red teaming service which includes penetration testing as one of the activities.

Question 3

Is BreachRisk pen testing or red teaming?

Accepted Answer

BreachRisk is both red teaming and penetration testing. BreachRisk red teaming involves a number of security activities, including penetration testing, attack surface discovery, attack surface monitoring, vulnerability scanning, spearphishing, dark web analysis, and cloud testing.

Question 4

How often does BreachRisk measure my risk?

Accepted Answer

BreachRisk™ services conduct risk scoring on a frequency based on the subscription level, ranging from monthly, to weekly, and on demand for premium level service.

Question 5

What is BreachRisk Score and what is it based on?

Accepted Answer

BreachRisk™ Score is a 10-point risk rating that measures "can cyber attackers cause a breach?" The higher the score, the higher the risk.  It includes the likelihood of a breach occurring and the nominal impact of such a breach. It is CVSS compatible and comparable across companies with a score. Sources of risk are primarily related to viable attack paths discovered by BreachRisk™. The easier the attacks are to succeed, and the more damage that can be done upon success, the higher the risk.

Question 6

Is BreachRisk only for people that are cyber experts?

Accepted Answer

No, in fact BreachRisk™ was specifically designed from the ground up to neither require nor allow advanced configurations by users. Our AI and supervisors handle all configurations, including deciding exactly when to conduct analysis and testing activities.

Non-technical users will appreciate how BreachRisk™ provides results in a way that focuses on risk management, i.e. concepts of likelihood and impact. These concepts don't require that you fully understand why risk is created because it helps you know what the risk is, where it is, and the potential impact to the organization if not addressed.

Cyber experts will still appreciate the vast amount of technical detail that is provided in the BreachRisk™ dashboard. Well beyond BreachRisk™ Score and BreachRisk™ Report, we provide attack surface monitoring data and testing analysis and results. This allows cyber experts to spend less time actually conducting analysis and testing, and more time addressing the risks and aligning with company needs.

Question 7

What information do I need to set up my BreachRisk dashboard?

Accepted Answer

To establish a free BreachRisk dashboard, you'll need the following information to register your account:
 • Name
 • Company Email
 • Company Website
 • SMS, Email, or Authenticator App access to set up multi-factor authentication

Question 8

Can I use BreachRisk along with other risk rating and security services or products?

Accepted Answer

Absolutely.

BreachRisk will always quantify risk of breach based on what experienced attackers would believe to be true. Although we believe that the attackers are the true authority on cyber risk, there are definitely insights and data that BreachRisk does not aim to provide.

Consider pairing BreachRisk with services that can provide these capabilities to round-out your risk monitoring program:

• Detect and test vulnerabilities behind your public firewall.
 • Exhaustively map policy and security practices to important certification or regulator practice standards.
 • Allow you to make extensive internal notes for asset management, especially for assets behind your firewall.
 • Detect and test physical and hardware vulnerabilities that can only be accessed via physical access.
 • Other risk rating platforms to allow for multiple assessments of third parties.
 • Other phishing services that focus on wide testing and follow-up, performance-based training.
 • A managed service provider that can deeply understand your IT and security needs to help you maintain business alignment and state-of-the-art security practices.

Question 9

What information will I need to monitor the BreachRisk of a 3rd party?

Accepted Answer

All you'll need is the name of the company and the official website. We'll do the rest. You'll get up to 10x better accuracy than other 3rd-party cyber risk monitoring services currently on the market.

If you plan to seek the organization's participation in a monitoring or testing scheme in an effort to gain up to 100x better predictive accuracy, you'll just need a competent authority point of contact.

Frequently Asked Questions

Detect. Verify. Test.

The Hacker's Perspective®