In this episode of Ivanti Insights I spoke with Chris Goettl, Sr. Director of Product Management and a first-time guest, Sri Mukkamala who is the co-founder and CEO of RiskSense a pioneering risk-based vulnerability management and prioritization company. What’s even more exciting is that today Ivanti announced the acquisition of RiskSense to drive the next evolution of patch management. We talked about risk based-vulnerability management and what organizations need to look out for. Before we dive in, what is risk-based vulnerability management? Put simply, it’s a process that reduces vulnerabilities across your attack surface by prioritizing patching based on the risks that are posed to an organization.

The Last Mile Problem

We talked about how organizations need to be able to identify vulnerabilities in their environments and then prioritize. Most organizations are good at figuring out what to fix, but also knowing how to fix is important too. With this acquisition, Ivanti and RiskSense will solve that last mile problem. What this means is that once an organization identifies the risk, they will be able to act on it within seconds. With Ivanti and RiskSense coming together, organizations will be able to be proactive in tackling these vulnerabilities.

But the question is how do you prioritize? RiskSense actually labels exploits and tells you exactly why a particular criticality score is important based on not only the type of the exploit, but how actively it's been talked about, how actively it's used. As organizations are asked to do more with less, this is a solution that will help ensure they are not missing critical updates.

What Should Organizations Focus On?

It’s nearly impossible to patch everything. In fact, industry analyst firm, Gartner has even talked about not patching everything, but instead focusing on the vulnerabilities that have been weaponized and how much damage they can cause. Sri gave the example that a bullet from an AK-47 rifle is much different than the bullet from a handgun, or even a grenade. All three weapons can cause damage, but they don’t all cause the same amount of damage.

Another area to look at is whether the vulnerability is being shared in the wild, and what the delivery mechanism is. If you link all of these pieces of information together then you get a pretty good picture of what should be prioritized. That’s the benefit that RiskSense and Ivanti are going to help customers realize. We covered a lot in this episode! Be sure to check out what else I discussed with Sri and Chris like:

  • Sri’s background and how he co-founded RiskSense
  • Tactics used by cybercriminals to exploit vulnerabilities like remote code execution
  • President Biden’s Cybersecurity Executive Order
  • Patch Tuesday and cyber hygiene

Find out all of this and more in the full episode below.