Risk intelligence – Osterman Research https://ostermanresearch.com Insightful research that impacts organizations Mon, 10 Mar 2025 03:58:21 +0000 en-US hourly 1 https://i0.wp.com/ostermanresearch.com/wp-content/uploads/2021/01/cropped-or-site-icon.png?fit=32%2C32&ssl=1 Risk intelligence – Osterman Research https://ostermanresearch.com 32 32 187703764 Notes on our briefing with Cybersixgill – the RSAC2024 files https://ostermanresearch.com/2024/05/24/rsac2024-cybersixgill/ https://ostermanresearch.com/2024/05/24/rsac2024-cybersixgill/#respond Fri, 24 May 2024 02:45:50 +0000 https://ostermanresearch.com/2024/05/24/rsac2024-cybersixgill/ We attended RSAC 2024 in San Francisco from May 6-8. Our days at the conference were packed with back-to-back briefings. 

Here’s some notes on our briefing with Christopher Strand (Chief Risk and Compliance Officer). The briefing was organized by Liz Youngs of Trier and Company.

Key takeaways:

  • Cybersixgill offers automated threat intelligence solutions drawing on data collected from the clear, deep and dark webs. Their website puts it this way: Cybersixgill covertly extracts data in real-time from a wide range of sources, including limited-access deep and dark web forums and markets, invite-only messaging groups, code repositories, paste sites and clear web platforms.
  • Cybersixgill’s approach delivers threat intelligence as more than just a threat intel feed. It aggregates data in a data lake, enabling the addition of context to newly curated data, which is aimed at helping security defenders make better informed decisions on mitigations and responses. 
  • If you are a Cybersixgill customer, you can receive threat reports for your vertical industry periodically (depending on your service level). This is a written report to provide analysis and context. It is complementary to the context-rich threat intelligence data.
  • The company is investing in building out the conceptual framework of a risk intelligence approach. Threat intelligence is part of this framework, but not the whole story anymore. Risk intelligence is a long-term play for Cybersixgill. Christopher has written a couple of blog posts on this topic – see part 1 and part 2.
  • In terms of risk intelligence, the big idea is moving beyond threat intelligence only to incorporate vulnerability intelligence (identifying and prioritizing), attack surface intelligence (gap identification for defense fortification), third-party intelligence (assessing security posture of supply chains and third-parties), and regulatory intelligence (sector/industry-specific regulations). It is, therefore, a much more holistic view of risk beyond adversary intent, capabilities, and techniques.
  • See also our write up on Cybersixgill’s State of the Underground 2024 report.

For more, see Cybersixgill.

]]>
https://ostermanresearch.com/2024/05/24/rsac2024-cybersixgill/feed/ 0 4605