On January 12, NetSPI COO Charles Horton was featured in the Tech Strong interview regarding the nVisium acquisition. Read the preview below or listen to the interview online.

+++

Charles Horton, NetSPI COO, discusses the acquisition of nVisium to further scale NetSPI’s offensive security solutions and address heightened demand for human-delivered penetration testing. nVisium will support NetSPI’s continued efforts to deliver strategic security testing solutions to enterprises.

You can listen to the full interview online at Techstrong TV!

Charles Horton

On January 11, NetSPI VP of Research Scott Sutherland was featured in the Help Net Security article called 4 Key Shifts in the Breach and Attack Simulation (BAS) Market. Read the preview below or view it online.

+++

The increase in the number of attack surfaces along with the rise in cybercriminal sophistication is generating technical debt for security operations centers (SOCs), many of which are understaffed and unable to dedicate time to effectively manage the growing number of security tools in their environment.

Yet, regardless of these challenges, SOC teams are tasked to continuously evolve and adapt to defend against emerging, sophisticated threats.

There are several major players in the BAS market that promise continuous automated security control validation. Many can replicate specific attacker behavior and integrate with your telemetry stack to verify that the behavior was observed, generated an alert, and was blocked.

But as the BAS market continues to evolve, there’s also an opportunity to address shortcomings. In the new year, we expect to see several incremental improvements to BAS solutions, with these four themes leading the charge.

More Streamlined Product Deployment to Reduce Costs

Many fully automated security control validation solutions include hidden costs. First, they require up-front configuration for their on-site deployments, which may also require customizations to ensure everything works properly with the integrations. Additionally, BAS solutions need to be proactively maintained, and for enterprise environments this often requires dedicated staff.

As a result, we’ll see BAS vendors work harder to streamline their product deployments to help reduce the overhead cost for their customers through methods such as providing more SaaS-based offerings.

You can read the full article at Help Net Security!

Scott Sutherland

On January 10, NetSPI CEO Aaron Shilts was featured in MSSP’s article called Security Testing Merger: NetSPI Acquires nVisium. Read the preview below or view it online.

+++

NetSPI has acquired nVisium to enhance its offensive security solutions and address heightened demand for human-delivered penetration testing, the companies announced in a prepared statement. Financial terms of the deal were not disclosed.

This is technology M&A deal number 12 that MSSP Alert and sister site ChannelE2E have covered so far in 2023.

• See more than 2,000 technology M&A deals listed here.
• See all MSSP M&A deals listed here.

A Closer Look at NetSPI and nVisium

NetSPI, which specializes in enterprise penetration testing and attack surface management, is based in Minneapolis, Minnesota and has 418 employees listed on LinkedIn.

nVisium, a Falls Church, Virginia-based company focused on security testing, has 33 employees listed on LinkedIn.

With the acquisition, NetSPI now has more 450 offensive security experts globally who can support and scale to meet the needs of current and future clients. As NetSPI CEO Aaron Shilts explained:

“Our decision to acquire nVisium comes down to one core factor: acquiring amazing talent. We’re bringing two brilliant, culturally-aligned and complementary offensive security teams together who are committed to delivering the highest standard of penetration testing on the market today. I’m excited to see what nVisium and NetSPI can accomplish together.”

You can read the full article at MSSP Alert!

Aaron Shilts

On January 10, NetSPI CEO Aaron Shilts was featured in the InfoRisk Today article called NetSPI Doubles Down on Pen Testing With nVisium Acquisition. Read the preview below or view it online.

+++

The Minneapolis-based attack surface management vendor says Washington, D.C.-area nVisium’s deep understanding of the niceties of different cloud platforms will come in handy since Azure penetration testing differs from AWS pen testing, says CEO Aaron Shilts. Hacking – with permission – into cloud-based apps requires different skill sets than testing the security of traditional web applications or networks.

The terms of the acquisition, which closed Dec. 22 and was announced Jan. 3, aren’t being disclosed. All 50 of nVisium’s employees will join NetSPI, including founder and CEO Jack Mannino, who will focus on R&D and building next-generation technologies for clients and testers as part of the NetSPI labs organization (see: Pen Test Firm NetSPI Gets $410M Boost From KKR to Fuel M&A).

Why Customers Need Cloud Pen Testing

An ongoing mass migration to cloud environments from on-premises data is driving demand for cloud penetration testing, according to Shilts. He says NetSPI is already one of the leaders in the cloud pen testing space but will benefit from nVisium’s capabilities. The Washington firm excels at working with businesses with mature security programs in highly regulated industries such as energy and financial services, Shilts says. Financial services has long been one of NetSPI’s largest markets, but the CEO says little overlap exists between the NetSPI and nVisium clients’ bases.

Shilts plans to fully integrate nVisium into the NetSPI organization by Feb. 1, with a focus on training, onboarding and familiarizing nVisium’s staff with NetSPI’s platform and programs. According to Shilts, nVisium customers should be able to more easily meet developer and testing timelines thanks to the size of the NetSPI organization.

NetSPI’s automation tools focus primarily on the tester experience, report automation and report generation, and Shilts says these tools will be integrated and brought into NetSPI’s mainline code base. NetSPI today has both employee-facing automation tools similar to what nVisium offers as well as client-facing automation tools that are unlike anything nVisium provides today.

The nVisium deal comes just three months after NetSPI received a $410 million growth investment from private equity giant KKR to pursue acquisitions and expand its technological and geographic footprint – money that helped move the nVisium acquisition across the finish line.

You can read the full article at InfoRisk Today!

Aaron Shilts

On January 2, NetSPI VP of Research Nick Landers was featured in the eWeek article called Tech Predictions for 2023: AI, Cloud, Edge, Cybersecurity, and More. Read the preview below or view it online.

+++

So you think you can predict the course of technology in the year ahead?

Really? I have my doubts. In the many years I’ve covered enterprise tech, I’ve never looked ahead and seen such a rapidly shifting landscape. As the pace of innovation leaps ahead, the leading sub-sectors of IT have become increasingly complex:

• Artificial intelligence: The stunning debut of ChatGPT in November put us on notice: AI is growing exponentially, offering a toolset (for free!) that would’ve been sci-fi not that long ago.

• Cloud has become the foundation of tech, but never has a foundation continued to evolve so fundamentally. Cloud is now very much multi-cloud. So customers benefit from the vast potential of combining the top hyperscalers – which is equaled only by the frustrating management and cost concerns.

• Edge computing exploded in 2022; I can hardly count the executives I’ve spoken with recently who see it as a new leading focus. The Internet of Thing’s immersive computing environment is creating a data-rich infrastructure that supports commerce and collaboration and, eventually, the metaverse.

Data analytics – the engine that drives decision making – has forked into an array of mushrooming sub-sectors, from predictive analytics to data visualization to real time data mining. No longer a separate discipline, analytics is being built into ever more applications as a core element. I hope you like the mining of metrics for insight, because it’s becoming omnipresent.

Tech Predictions 2023 and Beyond

Fortunately, my reluctance to predict the course of tech is not shared by executives across the enterprise IT industry. The thought leaders below offer their forecast for the sectors that will shape the enterprise in 2023 and beyond.

CYBERSECURITY

Nick Landers, VP of Research, NetSPI

An emphasis on machine learning security, threats, and vulnerabilities

Machine learning is already deployed in numerous technologies, especially those concerned with security — for example email filters, security information and event management (SIEM) dashboards, and endpoint detection and response (EDR) products.

If you thought you could delay ML security conversations, think again. There is a growing group of security researchers focused on Adversarial ML, which includes both attacks on models themselves (inversion, extraction, cloning, etc) and the use of ML in network attacks and social engineering. In the upcoming year, we’ll see a growing list of vulnerabilities being published for ML-integrated systems.

You can read the full article on eWeek!

Nick Landers