Hello everyone,
two-thirds fewer vacancies than in Corona times, reports the Handelsblatt (anger bait for Gen Z: “Humility is returning – but not for everyone“). IT jobs are obviously particularly hard hit.
With the new developments coming thick and fast, I sometimes feel like an orchestra musician 100 years ago, when music recordings for films were invented. Before that, an orchestra pit in the cinema was standard – see newspaper advertisement of a trade union in which 1930 protested against this inhuman technology (gramophones / records). Let’s see how long I’ll be allowed to play before the superintelligence replaces me (and hopefully a few other trumpets before it).
While we’re on the subject of obsolescence, the following thesis (feel free to refer to or contradict it):Vulnerability scanning with kilometer-long lists as an output has also had its day.
- We will see a further development in such a way that only the vulnerabilities and incorrect settings that can actually be exploited in the individual customer environment will be dealt with
- Powered by Gen AI, continuously tested by chaining exploits in digital twins of the production environment, accounting for intentional/unintentional data leaks by insiders and agents
- Potential: Reduction of CVE list length by > 95% (Visa speaks of 0.03% actual exploitability with fine-grained segmentation + consistent use of phishing-resistant MFA)
- Many of the trouble spots are temporarily cured directly and automatically via virtual patches, while the VM teams can concentrate on the small rest
- Ideal for MSSP offerings (SLA based on “Time to validated Remediation”).
- Also offers opportunities for warranties:
- Compensation if the attack was made via a vulnerability not reported by the tool, or
- Credit of license costs when false positives are reported (autonomous validation now works well).
90-day retention standard and (almost) the complete Sentinel functionality in Defender (“ISOC”) will be available for E5+E7 users in the future. With this,Microsoft is raising the bar a bit higher again (or following suit, depending on your perspective).
This fits theopinion of a security professional with more than 500 incident response missions behind him, whom I recently had the pleasure of interviewing as part of my small book project – here are some of the most exciting statements for me:
- 90 days of log retention is the gold standard. Although 1 year is required by regulation for some customers, it is de facto superfluous from a forensic point of view if you are not worried about state espionage. The money could be better invested elsewhere. “The days when attackers stay on the net for so long are over.” For many smaller companies or authorities, the default is now a measly 7 days. Increasing this to at least 1 month would be a huge step forward
- Firewall logs are often missing. Too noisy for real-time intrusion detection, but essential for reconnaissance in the event of damage => Cold Storage
- Backups can only be restored in 50% of ransomware cases. In the other half of the cases, the recovery has not been tested and does not work, the copies are outdated, non-existent, also encrypted or contaminated. This was also confirmed in another conversation: In some cases, it is only discovered in an emergency that a connection to the backup system has never been made for various specialist applications
- MSOC with the provision of licenses by the customer (i.e., without a reselling margin by the MSSP) is currently often a loss-making business. Depending on the project, the large XDR/SIEM providers provide their MSSP partners with targeted marketing grants, which in turn can thus offer dumping prices in SOC tenders.
Rarely does anyone address thediscrepancy between their own (always positive) PR publications and the real difficulties behind the scenes as openly as Kyle Hanslovan, CEO and co-founder of Huntress.
Background on the provider:
- MXDR for 270,000 SMEs from USA, typical customer has less than 250 employees, turnover approx. 500 million USD, i.e. average revenue per customer ~2k USD/year (for new contracts allegedly ~20k)
- Started 10 years ago, currently ~1000 employees, EU location in Ireland, hardly known in the DACH region so far
- ~150 million funding raised, valuation estimated at around 3 billion USD.
Takeaways from the podcast:
- „Microsoft and Crowdstrike dominate the market for the Fortune 500”
- There are probably 1-2 others😉
- Underestimated in many discussions: Customers have a higher dependence on experts with smaller EDR/XDR providers than with the widely used platforms. And for security professionals, the question arises as to whether you really want to specialize in a niche provider – what will be the market value of this knowledge in 5 years? This dynamic is also an effect of scale
- Competitiveness in the SME sector is significantly lower, but is increasing
- The first 3 years bootstrapped, low growth. Breakthrough came via VC Investment and Channel Partner:
- Distribution to small businesses is only economically scalable via resellers and MSPs (some of the readers can probably confirm)
- Outside Investment has served as an endorsement to other investors and employees (one of the most important co-founders only came on board afterwards)
- Highly automated standardized processes from the very beginning, also with Gen AI for 4 years
- Natural selection of customers: Significant price increase for contracts that can be cancelled on a monthly basis with price reductions for at least 12-month terms has led to the fact that the weakest customers (= poor creditworthiness and payment practices, low prioritization of security, low loyalty) have been deterred and the business as a whole has become more profitable
Mandiant / Google has dealt with substations , more precisely with protection relays. If you have had little to do with the technical details of power grid operation so far (like me), you will find an easy to understand introduction here. While the recommendations sound generic and familiar at first glance (e.g. avoidance of group accounts, shutdown of unused ports + accesses), there are some specific features in the implementation. Would you like some examples? “Test pilot schemes (POTT, DCB, 87L)” or “Configure BADPASS, ALARM, SETCHG, and similar relay logic bits”. Never heard of it before, not even in the GICSP. Another piece of the puzzle in the worldview.
In the end, this time no happy ending, but an absolute downer that plunged me into a deep valley of depression while reading: “Cyber […] currently doesn’t appear as one of the top causes of business interruption insurance losses by either severity or frequency of claims”.
- According to an analysis by Allianz , there have been losses due to business interruption (which were insured) of around USD 7 billion in the last 5 years
- Almost entirely caused by analogous hazards such as fires, explosions, natural disasters, machine failures, building collapses, theft or vandalism
- If I read the figures correctly,IT problems account for only about 1% of the reported damage amount (“collisions” are still listed individually as a cause with 1%, cyber does not)
- The explanation is also included: IT can be quickly restored in a cross-comparison with physical equipment
- Now, of course, as a security chief salesperson, I would reflexively argue that there is also fraud (BEC/BCC), data theft, industrial espionage and other costs caused by cyberattacks. The only problem is that business interruptions are the biggest factor in cyber damage, according to the same report. Among other things , interruptions account for more than half of all damage caused by ransomware attacks .
Oh dear. I finally wanted to be important, and then the fire extinguisher in the corner steals the show.
- The cyber insurance division managers were apparently similarly affected by the results of their colleagues as I was and therefore explained in detail on the last pages of the report that cyber risks are very relevant and how to protect yourself against them (e.g. BCM plans, emergency drills, rapid response)
- Data minimization and DLP are becoming more important: The majority of ransomware cases are now associated with data exfiltration
- Ransomware remains the main cause of IT-induced outages, but non-attack disruptions account for 40-50%, depending on the year
On sober inspection, the figures show that the perceived risk (Allianz Risik Barometer: Cyber in the top 1) and the actual risk for companies are apparently completely different. This does not mean that investments in security are not worthwhile. But: Business interruption due to cyber attack is virtually the plane crash among the causes of death. Media coverage, but fortunately rare. Of course, only because we all do such a good job! And for difficult board discussions, we still have our loyal friend, the unreported figure.
M&A Corner:
- IonQ (QKC) buysElisity (micro-segmentation, see also market commentary April 2025) for ~USD 1 billion
- Armadin (Autonomous Red Teaming at scale, founder Kevin Mandia, George Kurtz on board) gets another 250 million in Series B. $, valuation is ten times that
- Iceland (Enterprise Browser, Cyberstarts is invested) gets another USD 400 million @ Valuation > USD 6 billion
- Hadrian (automated pen testing from the outside on all Internet-exposed assets) receives another $40 million
- Sequrio is using PE funding to buyAlthammer & Kill, Datatree and msecure. The goal is probably to build up a network of consulting companies for data protection, infosec, compliance and generally secure digitization, which now includes 6 companies. The exit multiple increases due to size alone, plus efficiency advantages in admin merger, marketing and, in the future, delivery through AI
Conversations with providers:
Upwind:
- CNAPP from Israel (funding > 700 million USD in 4 years, including cyberstarts, valuation currently > 3 billion), i.e. direct competition with Wiz, Orca, CS, PAN
- More than 300 customers, including Siemens, Sixt, Checkpoint
- App Sec: SCA, SBOM, SAST / IaC / Secret Scanning, ASM
- Posture Management: CSPM, KSPM, DSPM, CIEM, Attack Path Mgmt.
- Runtime: CDR, CWPP, DAST, API Events/Logs and of course Agent Behavior Monitoring
- Pricing Model Technical Features: All Inclusive, often very competitive in a cross-comparison
- Also offer MDR 24/7 for the platform
- Still looking for channel partners in the DACH region
Cybersense:
- German provider of intrusion detection + deception, spun off fromConcentrade about 5 years ago, recently acquired by Chapters Group (PE)
- Approx. 100 customers, including Bilstein, University of Düsseldorf, a DIY chain
- Deceptives: file servers, backup servers, databases, ERP with virtual appliances, operating systems, applications based on the customer’s infrastructure and naming conventions. The decoy servers are then also part of the customer’s domain and patch systems. Typical size of 1 decoy / 100 end devices
- In addition, lures such as Canary user accounts and credentials, e.g. KeePass exports, passwords for network shares
- Monitoring via on prem Splunk instance (to be replaced by open source systems in the medium term)
- PoC: Setup ~2 weeks, then validation by red teaming possible
- (Co-) Managed operation and monitoring (MDR) possible
- As mentioned several times, I currently see increased benefits of deception solutions due to the deteriorating signal-to-noise ratio in the SOC
Hackuity:
- RBVM startup from France (approx. 40 employees), i.e. asset and vulnerability aggregation and deduplication and then prioritization
- Thus, digitally sovereign competition to Brinqa, Vulcan/Tenable, Nucleus, Armis, Axonius…
- Approx. 50 customers, all corporations, including Swiss Life, Engie, Banque Postale
- Integrations with popular scanners, CMDB, CTI, ITSM systems
- On prem or SaaS
- Licensing based on number of assets, but flat rate for all types
- On the roadmap: Patching
- We are still looking for channel partners for the DACH region (so far including Orange, Accenture, CapGemini)
As always, nothing here is AI-generated. Questions, suggestions, comments, experience reports, topic requests and also opposing opinions or corrections are welcome by email. Ditto for unsubscribing from the mailing list.
For the people who have received the market commentary for the first time: Here you can register if you are interested or set up a works council with the archive team.
Best regards,
Jannis Stemmann
