Customer Demand Drives New Eclypsium Integration with Kenna.VM

Organizations Apply Risk-Based Vulnerability Management to Firmware and Hardware Infrastructure

Eclypsium, the enterprise device security company, announces a new technology integration with Kenna Security’s Kenna.VM, to extend risk-based vulnerability management (RBVM) to the firmware layer. The integration, developed at the request of a major financial institution and now available for other customers, provides joint customers with a consolidated and comprehensive view of vulnerability risk down to the firmware of a device.

Firmware and device-level attacks have become a staple of attackers from state-backed threat actors to financially motivated ransomware campaigns. Attackers have become increasingly sophisticated, finding new ways to introduce vulnerabilities throughout the supply chain, evade security tools, persist within compromised devices, and cause the greatest damage possible. Malware and ransomware like TrickBot have increasingly targeted vulnerabilities in firmware, giving attackers virtually complete control over a device – including the ability to subvert the operating system and other security protections. As a result, managing risks at the hardware and firmware layers is increasingly a requirement that must be integrated with an organization’s ongoing risk management efforts.

Recommended AI News: NTT DOCOMO’s Ambitious New Eco Targets Validated by Science-Based Targets Initiative

“Modern IT and security teams face a cybersecurity landscape that is both expansive and sophisticated, with the majority of organizations lacking insight into their firmware and hardware attack surface,” said Alex Bazhaniuk, Co-Founder and CTO of Eclypsium. “The integration of the Eclypsium solution and Kenna.VM changes that. For the first time, organizations can now take action with ease to reduce attack surface risks at the hardware layer.”

Eclypsium gives organizations visibility and control over their firmware and hardware risk. The solution scans devices at levels that traditional vulnerability scanners and security tools miss, to reveal device level vulnerabilities, misconfigurations, and threats. With Eclypsium, teams can easily maintain visibility into their server and endpoint hardware, and VPN and other network infrastructure to find vulnerabilities, misconfigurations, and signs that the integrity of the device has been compromised.

“Our research shows that Windows 10 hardware alone has an average of 14 high-risk vulnerabilities per device. It’s imperative that organizations have the ability to identify and remediate the riskiest vulnerabilities across their vast endpoint infrastructure at scale,” said Jason Rolleston, Chief Product Officer at Kenna Security. “Eclypsium’s integration with Kenna.VM enables our joint customers to enhance their existing risk-based vulnerability management programs with increased visibility and efficient remediation of threats that reside in their endpoint devices, down to the firmware level.”

Recommended AI News: NTT DOCOMO’s Ambitious New Eco Targets Validated by Science-Based Targets Initiative

Historically, organizations see vulnerabilities and risk at the software level. Network-based vulnerability scans often only discover vulnerabilities at the operating system or service level but lack insights into the underlying device itself. Identifying and remediating vulnerabilities at the device-level is often a manual and highly technical process that is mostly performed by exception, leading to longer dwell times when firmware attacks do occur.

The integration enables Eclypsium firmware security data to be imported into Kenna.VM, where it is combined with real-world threat and exploit intelligence and advanced data science to determine which vulnerabilities pose the highest risk and which can be deprioritized. Giving IT and security teams a complete view of their device risk and enabling them to make smarter patching and hardware configuration decisions.

Recommended AI News: Impartner SVP Mark Rogers Recognized as 2021 CRN Channel Chief