Tyler Diderich

Cybersecurity's "official" IPO drought is at 954 days and counting. No funny business here — "hybrid" companies, SPACs, micro-cap, over the counter exchanges...none of it. We're talking pure, unadulterated, All-American cybersecurity companies. Yesterday, the opening line to my post was about Rubrik putting an end to "the longest IPO drought the cybersecurity ecosystem has seen since the 90s." It stoked some controversy (!). > Is our IPO drought really over? Was this really the longest one since the 90s? Okay, okay. I get it. Technically, no. ForgeRock was the last pure cybersecurity to go public, way back in September 2021. This is another case of "it depends how you define the cybersecurity industry." Rubrik and HashiCorp are not cybersecurity companies by the most strict definition of the term. They are mid-cap technology companies who generate a portion of their revenue from cybersecurity products, to be very specific. This means the cybersecurity IPO drought isn't technically over. Bummer. That's the real answer. 954 days is a looooooooong time! The span between Fortinet (November 2009, don't tell me they're not a cybersecurity company) and Proofpoint (April 2012) was close: 884 days. As far as I can tell, the longest gap we've had is Check Point (June 1996) to Fortinet: 4,891 long, cold days back when cybersecurity was barely an industry. (I did my homework, but check me if I'm wrong on the Check Point-Fortinet part. I was in high school for most of that time...) Even without Rubrik, I'm confident our 954-day-and-counting slump is going to end soon. Can't wait.

51

15 Comments

What people think running a security company is like. But reality is different... ➡️Most security companies shut down in less than 2 years. ➡️Most security company owners never make significant money. ➡️Most get trapped in the idea of owning a security company. I ran a security company for more than 10 years before selling it. I know the pain and fear you have to go through to run a company. You need more than money as a motivation to persist. Most security companies fail due to:  1️⃣ Lack of sales  2️⃣ Lack of operational management  3️⃣ Lack of trust and tools I tried a lot of solutions to these problems, but most were bad at best. That's the reason I started officerReports, to help security companies and owners like me. And I have also created free resources for anyone who needs help. 💰Here's my free e-book on security service sales: https://lnkd.in/gsZz2itK 🛡️ My free e-book on security operations: https://lnkd.in/e4fVdQ8s 💡Bonus:  14-day free trial of the best security officers management tool Link: https://lnkd.in/gqQugwDQ PS. Share this with someone who needs this ♻️

34

4 Comments

SOC 2 or not to SOC 2? That is the question!

9

🍌 If you're a small #MSP you know you have to hustle to get your name out there and #prospect. But where do you start? Finding leads, sifting through email databases, scraping business directories.... I was re-watching Brian Gillette's podcast with FortMesa where he was talking about how small MSPs feel stuck just getting the ball rolling. So I'm going to help 💪 Tell me about your Ideal Customer Profile (ICP) and I'll build a leads list for you. I'm even throwing in cyber #ScoreCards so you have something good to talk to your prospects about. Click the link in the comments and get your Cyber Kick Start kit so we can break the ice and get you moving towards your 1 new client/month goal 🏆 #CyberPowered ...yes I spent 30min in Canva making all these guerrilla pics

24

2 Comments

The problem with the SOC 2 in a screenshot. 💯 points to anyone that can identify at least 1 issue.🕵️‍♂️ #tprm #thirdpartyrisk

4

6 Comments

Think your SaaS startup doesn't need SOC2 Type 2 compliance? Think again. Even if you're small, dealing with sensitive data elevates your business. You become a trusted player in the market. No matter the size of your SaaS startup, SOC2 Type 2 isn't just a fancy badge. It's a commitment to your customers that their data is safe with you. Pro tip: Don't wait for a customer to ask you for your report before taking action. It takes an absolute minimum of 3 months to get your report. Proactivity is the key. Get SOC2 Type 2 compliant. It's not just about avoiding fines or lawsuits. It's about trust, reputation, and long-term success. Your customers will thank you, and so will your bottom line.

23

4 Comments

Psst. Appfire is doing some really cool stuff at #AtlassianTeam24. Sure, six Appfire experts are speaking, but in between sessions, there's still plenty going on. You can win raffle prizes at the Appfire booth (#4, so stop by), and score some swag. (Not even joking when I tell you that the swag is so good, Appfire employees wear it daily.) And there's Atlassian trivia at the Marketplace Theater between sessions, too. In case you couldn't tell, I'm sad I didn't get to go! Can't call it FOMO, because I know I'm missing out. (I'm not just afraid I am). But if YOU'RE there, take full advantage. Because there's Appfire goodness aplenty. My super smart colleague Ed Gaile covered all the details in his Atlassian Community post, so check that out for session info and the complete rundown of what's happening. https://lnkd.in/eQfdv9vh

48

1 Comment

Cybersecurity companies raised $2.3 billion in Q1 2024. Looking back this is similar to Q1 2023, just at the end of the 2022 hiring boom. We've got a huge amount of Sales & GTM hiring going on right now at Ignition Growth, and I can only see this ramping up in Q2&3 as vendors seek to hit their AAR growth goals. Our clients have been leaning on us to make their key strategic hires that require a very specific profile, reducing time to hire in the process. I predict a busy spring and summer! #cyber #software #vendor #hiring #sales #gtm

7

What's the significance of $1M ARR for your vCISO revenue line? I've seen well established MSPs launch a vCISO program, yet struggle to hit the magic 7 figure number for this revenue stream. It's usually because they're: 🚫 Expecting one person to run the program and drive BD 🚫 Not integrating the service properly with clients 🚫 Viewing revenue generation in a silo I want you to do it differently: 🟢 Build scalable systems that enable teamwork and margins 🟢 Position value with ultimate purpose to 🤯 clients 🟢 2x and 3x MRR for adjacent cyber services Bottom line? That $1M ARR mark for vCISO is the tip of the spear to the next level of revenue in your MSP. And it's the secret weapon I'm helping forward-thinking MSPs build. So if you want to get your vCISO blueprint, scale this service past $1M ARR, and supercharge all other facets of your cyber revenue... Drop a comment or DM with the word "Supercharge." or head here next: 👇 https://lnkd.in/dV2xyx9j

15

10 Comments

If every client you pitch security to goes with the cheapest option, you're doing it wrong. The biggest failure I see after an MSP sells a cyber package is that it just sits; it's a black box. Sure, you might send a quarterly report of the security metrics... But guess what? Your clients aren't reading that. They don't understand it. And they don't care. This makes the next recommendation exponentially harder to sell - because they don't see any use for it. 𝗦𝗼 𝘄𝗵𝗮𝘁'𝘀 𝘁𝗵𝗲 𝗳𝗶𝘅? To value-position services, your program needs to tell a cohesive story. Specifically, how cyber risk management is critical to decision-making. This means you 𝙢𝙪𝙨𝙩 include vCISO as table stakes for your package. And it's not an option. If you have recurring vCISO meetings with the client to: - Show their program's performance - Drive change through security hygiene - Peel the veil back to guide them through - Leverage a risk-centric approach to decisions You've gained the position of trusted advisor - and your clients will actually listen to you. So if... • You're struggling to move the needle with prospects. • And your current clients don't seem to be listening. I can help. I can show you how to build "connective tissue" into your MSP's cyber program with vCISO services. Enter a world where your client's security is a team sport - clients are engaged and participating, and... They actually take your recommendations. If you want to stop grinding and scraping in a race to the bottom on price, and build a vCISO practice that delights your clients, come join me in the PowerGRYD™ community. 👇 Link below and in comments #powergryd https://lnkd.in/dV2xyx9j

25

22 Comments

There are a lot more security data fabric startups than I realized! I wrote a post about this market in March and highlighted six companies who had raised capital or been acquired. I figured I was missing a few, but I had no idea how many. Over 100 comments later, my list of companies had nearly *doubled.* I wanted to do a follow-up post to include more companies since there is so much interest. Here's a quick summary of the companies I should have included the first time around: – Auguria is a security knowledge layer that automates the cleanup, classification, and ranking of security events and alerts to accelerate incident response and threat hunting. – Dassana was highlighted in Snowflake's Startup Spotlight series for its work as a partner building on Snowflake's Data Cloud. – DataBahn is a security data fabric and observability platform built by early Securonix team members, and the founding team's cybersecurity experience shows. The product has the full stack of security data focused features — from data observability to posture management — with pre-built security content. Their new AI features are going to set the standard for what's possible in this space. – DataBee is an internal startup in Comcast's Technology Solutions business unit. They've built a data transformation and content engine with use cases across security operations, GRC, vulnerability management, and more. – Paladin Cloud is a risk and prioritization focused solution that uses AI-powered risk scoring to identify threats from data collected across their security fabric. – Tenzir is an open source solution that gives security teams building blocks to create their own data pipelines. --- The security data fabric market has quickly become one of the most important and relevant new markets in cybersecurity. I'm planning a series of posts to dive in deeper, so more to come soon! ___ Note: I tightened up my definition of "security data fabric" a little more this time based on feedback from the last post. Cribl and Onum both get honorable mention here as relevant products in the space, just not 100% focused on security use cases. Avalor is a security data fabric company recently acquired by Zscaler. I only included non-acquired startups this time. I also miscategorized Synqly last time, but I still think it's an interesting product in the overall picture of security integrations.

176

60 Comments

"The fear of a breach will not drive SMBs to better cybersecurity compliance. Instead, the promise of more money will." What do you think ? Here's what I believe: Most of the companies we work with call us because they are in a hurry. They are about to close a new or existing opportunity, but they can't until they finish a security assessment that the potential client's security team sent them by email. In reality, security surveys will be commonplace because they are required by security compliance. Because of vendor management controls, most businesses need to make sure they have both a policy or process in place to handle vendor security and proof that an audit was done, such as a security questionnaire filled out by the vendor. What does that mean for your small or medium-sized business? Security is important for making money and needs to be planned for. When I talk to a company about security compliance, these are the things I ask: ✅ What kind of security compliance do my clients request the most? TIP: Pay attention to just one, especially if you don't already have a security system in place. ✅ Where are the gaps? What isn't in place right now that needs to be in order to meet compliance requirements? ✅ How will this affect the work that my company does? What changes will the staff have to make to meet security needs, and how will this affect their work? ✅ What time frame do I have? ✅ Figure out if your company needs to be fully compliant or if you can meet the security needs by handling only some of the necessary security controls. ✅ What is the scope? I think that a third attestation report will define security trust, for better or worse. If this becomes 100% true, then to stay competitive, it will become more than just a competitive advantage, it will be mandatory. What do you think? Do I have it wrong? #securitycompliance #soc2 #iso27001 #securityawareness #securityroi #cmmc

3

🚨 Attention all cybersecurity professionals! 🔒 Neiman Marcus has fallen victim to a significant data breach, impacting over 64,000 individuals. Hackers infiltrated a Snowflake cloud database by exploiting stolen customer credentials, highlighting the critical importance of robust authentication measures. 🔐 According to Lawrence Abrams from Bleeping Computer, the compromised data includes sensitive information such as names, contact details, dates of birth, and gift card numbers. This breach is part of a larger series of Snowflake data theft attacks targeting organizations without multi-factor authentication. 📊 I fear this will not be the last of the reporting based in this specific theme Read more about the Neiman Marcus data breach here: https://lnkd.in/gPygVC_A #CybersecurityAwareness #DataBreach #IdentitySecurity 

2

I've always had a hard time classifying the cybersecurity market as "infrastructure." I can't seem to figure out why. Whenever I see an investor report or dataset that groups cybersecurity companies in with infrastructure, it throws me off. It might be some kind of disconnect in my mind from thinking like a practitioner but working on the industry side now. Part of this is the distinction between *securing* infrastructure and *being* infrastructure. I've always thought of those as related but separate functions. Security people and products protect the "real" infrastructure — networks, servers, endpoints and all the other core stuff that's...not security. Or so the belief goes, anyway. I'm not saying anyone is wrong here (or if so, it very well could be me). I just think this disconnect is interesting. I'm curious how you think about this.

24

14 Comments

Did you miss the LBMC Cybersecurity webinar? -- "PCI 4.0: Q&A with QSAs" It's not too late to listen in. If you shoot me over a message, I'll be sure you receive a copy of the recording. Andy and I had a lot of great PCI 4.0 questions that apply to many organizations. #webinar #PCI40

12

Saw this on Reddit and chuckled. Combining Simpsons with InfoSec? Always appreciated. But I’d be remiss if didn’t point out that an absence of alerts is not always a good thing. Your logging pipelines and monitoring tools could be broken or misconfigured, or even the tool itself. Always include a health check poll or establish a heartbeat to check in logs. That way you know when a tool isn’t doing its job.

6

In the context of SOC 2 compliance, we've seen a shift over the last 24 months. Let's consider the old vs. the new approach. Old way: • Reliance on manual spreadsheets. • Infrequent, large-scale audits. • Reactive instead of proactive threats management. • Limited visibility into operations. New Way: • Adoption of automated tools for continuous monitoring. • Regular mini-audits for ongoing compliance. • Proactive identification and mitigation of threats. • Increased transparency with real-time dashboards. The shift? Automated, proactive threat management with higher transparency > Manual, reactive approach with limited visibility. Ultimately, we need to prove trust and integrity to our clients and customers. Don't make the process any more painful or inefficient than it needs to be. #Cybersecurity #SOC2Compliance

4

*Evaluating CrowdStrike / Windows BSOD* disclaimer: I have never worked for an anti-virus company, CrowdStrike and Microsoft. The opinions are purely personal based on limited information available publicly. Facts: * MSFT Windows maintains a file-handle counter table to manage files. For a user, this manifests are "File is in use and cannot be deleted. Close programs before trying again" sort of errors. * An error stack that shows a unhandled null pointer exception (NPE) * Resolution to the Blue Screen of Death (BSOD) is to remove the file manually Cause: The specific error/exception is trying to read a file but receives an "read access" exception. The memory location is a valid memory address (as against 0x0f which is null). How a file and its content is read in a program (in all programming language): First open the file and then start reading its content - line-by-line, or in buffer chunks (1024 or its multiples). A (pseudo) code would look like if exists(file) { file_handle = open(file) { while (content = read_line_using(file_handle) != end_of_file) { // do something with content } } } Possible lay of the land (anti virus application): - The anti-virus program would be running with administrator (admin) level privilege. This means it has much superior access and much closer to the operating system stack (Windows in this case). This is against a program run by a user, an error from that would be caught by an application at a lower level (like at the O/S stack). - An anti-virus program would be running operations in parallel (as against serially). This means it would be using threads (and sub-processes) to do many things in parallel like * checking virus threats real-time (let's call this CHECKER) * updating virus definition file(s) (and this as UPDATER) * keeping a watch on virus definition file (to prevent manipulation by a virus) (and this as WATCHER) * showing errors/findings to user (and this to be INFORMER), etc. What could really be happening in the case of this BSOD: 1. A virus definition update would have taken place which potentially required a particular definition file to be deleted by the UPDATER. 2. After the UPDATER was done, it would force a reload of the CHECKER to load new definition files. 3. WATCHER has been watching this file (along with others) in its list to watch for.

14

6 Comments

💡 How does my PKI’s status compare to that of others? Understanding where your Public Key Infrastructure (PKI) stands compared to others can be a game-changer. It’s not just about identifying benchmarks and best practices but also uncovering areas ripe for improvement. 🌟 While it’s crucial to tailor your PKI evaluation to fit your organization’s unique needs and constraints, benchmarking against industry reports, case studies, and peer-reviewed publications can offer invaluable insights into your PKI’s performance. 📊✨ Though the PKI Consortium doesn’t publish individual maturity assessment results, we provide a vibrant community where you can exchange experiences and learn from others. Join our working groups and tap into a wealth of shared knowledge! 🤝🌐 Learn more about PKI Maturity Model: https://pkic.org/pkimm/ #pki #pkimm #pkic #maturity #improvement #assessment #benchmark #guidance PKI Consortium

13