eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Verodin emerged from stealth mode today with a new platform that measures the effectiveness of security personnel and technologies.
The startup has raised $3.1 million in funding to date, with Cisco Investments, among the company’s backers. Christopher Key, co-founder and CEO of Verodin, also founded security vendor Enira Technologies, which ArcSight acquired in 2006.
“When the latest headline on a security breach shows up, a CEO will ask—can this happen to us?” Key told eWEEK. “The reality is that many organizations can’t accurately answer that question.”
Verodin, which been in the research and development phase for the last two and a half years, is providing a way to evaluate an organization’s security posture and the ability to deal with a cyber-attack. The goal of Verodin’s executives is to understand how an organization and its staff will respond to attacks before they happen and then provide direction and evaluation on a continuous basis for how to improve security.
Testing an organization’s security posture to identify risks is not a new idea, and is commonly done today by way of penetration-testing exercises. Key emphasized that what Verodin is doing isn’t a typical penetration test—that is, seeking to expose the vulnerabilities in an organization.
“The goal of our tool is to help mature the defenders and making sure that if a breach can happen, that the attackers can’t come back in the future and do the same thing again,” Key said. “We’re trying to be a tool that brings contextual relevance of attacks to defenders, showing them what the tools they’ve employed to defend will do.”
As such, if a specific attack comes into an organization, Verodin will demonstrate how the attack is viewed by the organization’s existing tools and show them what they are missing. The purpose is to identify whether an organization is seeing, analyzing and responding to attack patterns in ways that are effective.
Simulating breaches beyond just penetration-testing tools has been a hot topic in security in recent months. Both AttackIQ and SafeBreach announced technologies this year that aim to simulate attacks to help defenders identify risks.
Verodin isn’t just a simulation and is aiming to understand how an organization’s people, process and technology work together to defend against security threats, Key said.
“We are simulating attack behaviors in a production network, but the key is that we’re tightly integrated with defender tools,” Key said. “The goal of this is for the defender to understand exactly what an attack looks like before it happens for real.”
Part of Verodin’s approach is a methodology it calls “instrumented security,” which aims to understand the effectiveness of technology in a way that can be measured. Key said Verodin providers a means of putting a management and instrumentation layer in place to help organizations understand how effective an organization’s security tools might be.
“We’re not just trying to automate exploits and see results,” Key said. “Verodin is about putting in the management layer to help organizations make security decisions that are based on real information.”
Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.