Jason Lamar (15:36)

Really Matters this whole area of offensive security matters. Why? Because being proactive is really critical to keeping your business safe from new and evolving cyber attacks. We have penetration testing, and that is changing more and more frequently as part of the software development lifecycle. And customers increasingly are adopting a pen testing as a service model because that's an area where this whole model shines. There's also a lot of automation, you know, where you have different capabilities being used. Offensive security is all about being proactive. It's about, you know, getting in the mindset of a external attacker, looking for the weaknesses that you have on your external attack surface.

Dave Buettner (16:34)

Well, I want to dig into pen testing as a service, but before we do, what other things fall under the umbrella of offensive security measures? What sort of things would you categorize there?

Jason Lamar (16:47)

I would say there's things like red teaming, where you're trying to understand your particular scenarios that are high risk for your particular kind of organization or threat stack, and how your defenses work in that is also really important. So having an adversarial mindset, looking at not just probing for vulnerabilities like a scanner, or even just basically trying to become more testing like you're the adversary.

Dave Buettner (17:21)

Let's dig into some of the details about penetration testing as a service. Can we start off again sort of at a high level here? I mean, where do you think we stand when it comes to the types of offerings that are out there for this?

Jason Lamar (17:38)

We see a lot of snake oil, to be honest, script kiddies that are running the same couple of tools calling it a pen test or even claiming that's offensive. You know, there's automated DAS scans that people are doing, and then they have some kind of human review calling that offensive. So there's a lot of snake oil. What we recommend is people look for the provider's methodology and how have they exercised that over years? Have they got experience with it? And offensive security is about going beyond pen testing and delivering a breadth of engagements based on maturity of an organization. Some organizations are Just starting out, they need to do scans to pick up the easy to find things. But as they mature they want to do pen testing to bring a variety of testing and outside in perspective. And then as they get even more mature, they'll do things like red teaming, secure code reviews and those kind of engagements. So depends on the maturity of the customer. But everyone's on a journey, I would say, to up their game.

Dave Buettner (18:58)

Do you have any suggestions or words of wisdom for the types of questions people should be asking out there when you know if they want to align that provider with where they are on their own journey?

Jason Lamar (19:10)

Well, I mean I think there's. Every industry has kind of a standard analysts or different folks that monitor the industry and give recommendations for the offensive security arena and especially the pen testing as a service arena. GigaOM is a great resource. They have a thing called the gigaom radar. And the gigaom radar really takes you through specific selection criteria areas where you might evaluate different providers or different companies that you know, you would get this from. And they'll talk about how the company's doing with actionable reporting or you know, how good their integrations are, you know, and they have a, how scalable they are, how quickly they can do testing for you. Because not everyone can plan ahead. But this GIGA ohm radar I think is super helpful in characterizing understanding different players and their strengths. And also who are the front runners or the folks that I think the terms they use are outperformers. But I mean it just helps you understand what the field is of providers and based upon your requirements, you can interpret what's most important there.

Dave Buettner (20:34)

What about setting a cadence for this sort of thing? How often do you engage, how often do you have penetration test and testing happen? You know, how do folks go about dialing that in?

Jason Lamar (20:49)

Well, I think it's always important to talk with the organization that you want to partner with and have them consult with you as part of the ongoing discussion you have about procuring tests or engaging them. Usually there's a, an assessment or some kind of, it's not even a costly thing. Do some kind of understanding of where you're at in, in your maturity of your testing program and that can help you understand what you need most. If you're not sure what you need to do, if you have very specific requirements and you know what you want, then it just depends on the kind of activity that you're looking at. You might say, well, I just need a very quick compliance test for a new product that I'M deploying. There's folks out there that can start a test within 24 hours and have you up and running. I know of one that can do that. And then there's whole programs where you've got a very mature application or group of applications and you know, they change less frequently. So you don't, you know, you do your annual test there, but maybe you spend your testing time on things that are changing a lot within applications, particularly around this area of LLM AI. Existing applications that have been stable and kind of not changing a lot are getting new experiences added to them. So we've had folks come and say, hey, I want to test this AI stuff. They may want to do a smaller test where they're just doing prompt injection kind of test, or they may want to have a new experience altogether and they want to do a comprehensive test. So it depends on what your application or asset is, the rates of change on it, and the risk that you want to try to mitigate by testing and at least having that visibility and then understanding how your controls will do and what compliance needs that you have to fulfill your organization's objectives.

Dave Buettner (23:09)

And what are the advantages of engaging with someone from outside of your own organization to do this rather than handling it in house?

Jason Lamar (23:18)

Well, if you're blessed with a team that is able to do this kind of testing, that's really great. A lot of organizations don't have the ability to hire for this in house, and even those that do often need what I would call surge resources. There's overflow work. And so that's where you want to look outside. If you don't know where to start, obviously engage with someone that you know, especially as part of the meet us kind of part of the relationship. You know, you'd. You'd want to have a discussion about your maturity and what your needs are. If you have specific projects that you know you need to do, you know they're on a timeline and scope is really clear and that kind of thing. Then you know, it's a good opportunity to use resources that can go fast. So you engage someone who's got a large network of testers available. That's going to be an easier process than going through a statement of work with each, you know, with different vendors for each test. There's some economies that you can have by working with organization that does pen testing as a service or red teaming as a service. And other benefits would be you have the ability to have a relationship with a company, do some testing with them. They know you, they know your assets and your organization kind of understand what your unique situation is and what you want to get out of things. And as more projects come up, then you can just add those into the work that you're already doing ongoing. Some customers, they have annual testing, you know, and that's kind of their thing. Other customers have like they want to do agile testing where especially increasingly with software development, there's an area of an app that's been undergoing a significant amount of change. Hey, we want to pen test that area outside of our annual cadence. Very common for that to happen as well. So you want a relationship with organizations that have those flexible capabilities to meet you in the kind of testing that you need.

Dave Buettner (25:45)

You know, I can imagine that particularly for companies who are just starting down this path, that there's, there could be a certain amount of intimidation here that, you know, you're asking someone to come and poke at all the soft, exposed parts of your company here. I mean, is that part of that onboarding conversation to put people at ease and let them know exactly what to expect?

Jason Lamar (26:08)

Absolutely. And to get yourself comfortable. First of all, do you like the folks you're talking with? That's always important, but folks that do this a lot, we do over 4,000 tests a year. Right. So there's a familiarity and understanding of folks that are entering the process and their care abouts and concerns that, you know, we are particularly tuned with and others like us. So don't be intimidated, but do engage and help the folks that you're talking with understand what your actual needs are. And if you don't know what your needs are, be willing to go through a conversation to uncover those. Because a lot of times that can be very enriching whether you buy anything or not.

Dave Buettner (27:02)

That's Jason Lamar, senior vice president of product at Cobalt. We'll have a link to their research in our show Notes. And finally, Google's latest breakthrough in quantum computing, a chip named Willow, tackles the notorious challenge of error correction in scaling up quantum computers. Traditionally, adding more qubits, the building blocks of quantum systems, results in more errors, derailing the dream of functional quantum computing. But Willow flips the script, reducing errors as more qubits are added. Hartmut Nevin, head of Google Quantum AI, proudly announced they achieved below threshold error rates, a historic feat since Peter Shor introduced quantum error correction in 1995. Nevin likened the milestone to building the first convincing prototype for a scalable logical qubit, a step closer to truly large, useful quantum computers. But quantum enthusiasts, hold your champagne. The tech is still in the experimental phase. Remember when Google claimed quantum supremacy in 2019, IBM quickly played referee, disputing Google's assertion that its quantum processor outpaced supercomputers. Meanwhile, IBM continues its Quantum Crusade, launching a $100 million initiative with US and Japanese universities to create quantum centric supercomputers. Quantum industry veteran Bob Sutor reminds us that while companies like Google and IBM are pouring resources into solving Quantum's puzzles, progress requires more than just deep pockets, collaboration across regions, countries, and alliances. So while Willow's achievement is a major leap, the road to practical quantum computing is still filled with hurdles, debates, and undoubtedly a few more bold claims from competitors. Until then, Quantum's promise remains a tantalizing mix of science, strategy and a dash of corporate rivalry. And that's the Cyberwire. For links to all of today's stories, check out our daily briefing@the cyberwire.com we'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to cyberwiren2k.com we're privileged that N2K Cyberwire is part of the daily routine of the most influential leaders and operators in the public and private sector. From the Fortune 500 to many of the world's preeminent intelligence and law enforcement agencies, N2K makes it easy for companies companies to optimize your biggest investment your people. We make you smarter about your teams while making your team smarter. Learn how@n2k.com this episode was produced by Liz Stokes. Our mixer is Trey Hester, with original music and sound design by Elliot Peltzman. Our executive producer is Jennifer Iban. Our executive editor is Brandon Carp. Simone Petrella is our president, Peter Kilpie is our publisher and I'm Dave Bittner. Thanks for listening. We'll see you back here tomorrow.