Challenges: A small cyber team tasked with defending critical infrastructure but with a never-ending list of events, vulnerabilities and misconfigurations was unable to prioritize effectively. This led to stress, inefficiency and too much resource spent fighting fires. Executive reporting was misaligned as not focused on critical business assets. Solution: Continuous, comprehensive attack simulation showing all exploitable attack vectors towards critical assets. This was used as part of an initial assessment and then an ongoing operational process. Without XM Cyber the critical weaknesses would have taken pen testers years to uncover. Impact / Value: A reduction in critical asset compromise rate from 93% to 0% within 3 months. On an ongoing basis this has allowed a less resource intensive operational security model and provided a commonsense framework for CISO reporting to the board.

Challenge: Third party connectivity risk was not properly understood on an ongoing basis leading to a slowdown in digital business initiatives. A historic lack of investment in controls meant that ransomware was a real risk to the business. The board was demanding a more business focused view of cyber risk. Solution: Phased deployment of attack simulation capability covering third party ingress points, and then moving into desktop environments and data centers building up into an ongoing operational process. Impact / Value: Ongoing measurable risk from third party connections and an immediate reduction in ransomware risk. A more business centric cyber reporting approach allowing better board buy-in for the cyber program.