How would you describe Autobahn Security in three words?
Automated vulnerability prioritization
Now please introduce yourself briefly and tell us something about your background.
My name is Aleksander Groshev. Together with Karsten Kohl, I am co-founder of Autobahn Security and lead the company as CEO. Before joining Autobahn Security, I worked at Telco Security and FinTech, but I was always drawn to IT security with the desire to make the world a bit safer.
What sets Autobahn Security apart?
Our mission at Autobahn Security is to change the way organizations interact with their cyber data. Organizations often struggle to gain meaningful insights from their IT security data. We want to make cybersecurity understandable and manageable for everyone – not just security experts. To do this, our platform automates time-consuming and sometimes tedious workflows, such as consolidating and prioritizing vulnerabilities or researching the right mitigation.
How does Autobahn Security help companies?
Our platform, Autobahn Fit, aggregates vulnerabilities from various sources and offers an integral engine for customers who are not yet using vulnerability scanners. We help our customers by providing them with a “digital security analyst,” which expands the capacity of the security or IT teams by automating multiple vulnerability management workflows. This includes the assessment of vulnerabilities, false positive checks, grouping of findings, and provision of remediation instructions – our Cyber Fitness Workouts. These are step-by-step instructions that tackle the root cause of hundreds or thousands of vulnerabilities and eliminate them efficiently. Instead of working through each vulnerability individually, our Workouts fix the root cause. Companies that have little or no cybersecurity staff on board can thus scale their security operations, hand over monotonous work, and devote themselves to innovation topics. With our Hackability Score, we also provide a KPI that managers and decision-makers can use for benchmarking, progress measurement, and reporting – allowing them to shine in board meetings.
What do you perhaps see slightly differently to prevailing opinions in the field of cyber security?
I see cybersecurity as an integral part of the business strategy, not as an isolated department. Unfortunately, the opposite is still too often the case. A lot of panic is often generated, which inhibits the innovative strength of companies. We need to balance security and innovation to be more flexible and not trapped in a ‘security cage’. It’s a balanced approach that rationally assesses risks and combines security with the ability to change, is crucial. This is the only way to create an environment in which innovation can flourish – without stifling creativity.
From your point of view, from what customer size is the use of an automated pen test / security validation solution worthwhile as a supplement to manual pen tests?
The use of automated pen tests or security validation solutions can be worthwhile for companies of different sizes, especially if they supplement manual tests. These tools can be of great benefit for SMEs with 200 or more employees and limited resources, because they often do not have in-house cybersecurity teams and may not have the budget for regular manual pen testing. Automated solutions can perform regular security checks and efficiently detect vulnerabilities, allowing these companies to maintain solid cyber resilience.
But even large companies with extensive cybersecurity teams benefit from automated and regular vulnerability assessments. They can supplement manual tests by easily checking large networks or applications for known vulnerabilities. They are particularly interesting for companies that must comply with legal regulations, since they are obliged to carry out regular cyber assessments Automated solutions can help to meet these requirements efficiently by providing documented proof of the security checks.
What are your differences to vulnerability scanners such as Tenable or Qualys?
Vulnerability scanners provide raw or input data required to start the actual vulnerability management workflow. The workflow itself includes many more steps, such as consolidating vulnerabilities from different tools, deduplication, or realistic vulnerability assessment. This last step is important because vulnerability severity is often grossly overestimated, creating unnecessary panic in reporting. Security and IT teams spend a lot of time sorting through thousands or millions of vulnerabilities in the tools and deciding which are relevant. Autobahn Security automates these steps. In addition, vulnerability scanners only provide very rudimentary instructions on how to remediate the vulnerabilities – often only a link to the vendor’s documentation. We believe that this is not enough and therefore provide “foolproof” step-by-step remediation instructions. Finally, we shine with an easy-to-understand user interface that does not require in-depth cyber knowledge.
What are typical surprises that you experience during PoC / PoV?
Our customers are surprised to see assets show up that they believed were unlive, some of which have seriously critical vulnerabilities. They are also amazed at how easy it is to get concrete guidance from thousands of vulnerabilities. With Autobahn Security, customers do not have to wade through long lists of issues; instead, we provide them with clear and concise recommendations for action and enable an immediate go-live after a successful PoC.
What’s next – what’s on your technical roadmap, what are your plans?
- Further integrations: At the end of the day, we want to be a “single pane of glass” for our customers – the tool that integrates all cyber tools. That is why it is important for us to offer as many standardized integrations as possible.
- Custom Workouts: Our Workouts are developed by our security team and are designed to be suitable for as many companies as possible. However, we are aware that some companies have specific processes and structures. For this reason, we allow companies to customize the Workouts to their specific needs.
- Automation: Who has time to tag or assign assets or tickets manually? That is why we want to automate asset and vulnerability tags as well as ticket creation for asset owners.
If you could send an email to all CISOs to address a security issue, what would you choose?
Not a security problem per se, but many companies cannot find enough cybersecurity personnel and/or are overloaded with the amount of information their tools generate. This problem can only be solved through automation or technical outsourcing. When it comes to vulnerability remediation, we are here for you!
