Skyhawk Security announced our Continuous Proactive Protection solution at re: Invent in 2023. The response has been nothing short of spectacular – and the feedback we are getting is – you had me at GenAI-based Purple Team.
Many organizations have red teams and blue teams that are constantly simulating attacks and evaluating defenses to identify points of weaknesses, posture gaps, and other weaknesses in their current security strategy. However, at the end of the day, they go home – and they should! It would be cruel for these people to be chained to desks! With an AI-based autonomous purple team – they do not need to go home. AI-based teams can work around the clock, 24 hours a day, to identify issues with every change in your cloud. This is the real value – the feedback loop on your changing cloud infrastructure.
Realize the Promise of the Cloud for the very first time.
Organizations move to the cloud as it offers a more flexible and agile infrastructure that can be quickly spun up and spun down to meet changing business requirements. The speed of change in the cloud typically exceeds the speed at which the security team can react to the cloud infrastructure. This misalignment of security and infrastructure causes security gaps, and opportunities for threat actors. Skyhawk Security’s Continuous Proactive Protection continuously monitors your security to ensure it is aligned with your priorities. With this GenAI-based purple team in place, organizations can fully utilize the cloud without compromising on security.
What does Skyhawk’s GenAI-based Purple Team do?
There are five steps in the process that the purple team continuously executes.
- Discover: All crown jewel assets are discovered, the inventory and configuration of the cloud environment is fully assessed.
- Analyze: The least resistant paths to the crown jewels are identified. The attack surface is fully identified and exposures are surfaced.
- Simulate Attacks: Attack recipes are executed against the high priority crown jewels.
- Evaluate Defense: Understand how your defenses will detect and respond to attacks. The output will identify posture gaps, generate automated response and remediation recommendations.
- Adapt: Finally, the results are used to adapt detection capabilities resulting in an adaptive CDR that is always in line with your cloud architecture.
Then this is repeated. Similar to Continuous Threat Exposure Management, this is done continuously and the feedback is used to continuously improve the overall security of the cloud. Within the Skyhawk platform, this is used to update and improve the following.
- Proactively identify potential security risks: The autonomous based purple team executes an AI-based tabletop exercise, to see where the most vulnerable assets are in the cloud. This information can then assist the SOC in prioritizing security issues based on the business value of the exposed asset.
- Prioritize risk based on the business value of the asset to effectively manage risk: Organizations do not want any risk, but the fact is, you can’t be 100% secure or compliant, so there is going to be some risk. With the GenAI-based Purple Team, security teams can easily see how threat actors can compromise their crown jewels and then prioritize fixes according to asset value and accessibility by threat actors. This is probably one of the most valuable benefits of a GenAI-based Purple Team when implemented as part of a CTEM framework. Finally, an organization can effectively manage risk and clearly demonstrate the thought process.
- Protection that evolves as your cloud architecture evolves: As mentioned, it is very easy to change your cloud infrastructure, but it is not easy to update your security protocols. With the continuous evaluation of security versus the cloud infrastructure, the most significant security gaps are quickly identified and can be addressed.
- Manage the Attack Surface: Through 2026, non-patchable attack surfaces will grow from less than 10% to more than half of an enterprise’s total exposure, reducing the impact of automated remediation practices. Surfacing these non-patchable surfaces so security teams can determine the best approach is critical to ensuring the security of the cloud assets the non-patchable assets expose.
- Trust and implement automated remediation and response: While auto-remediation and auto-response are not new, many organizations hesitate to fully leverage security automation due to trust issues. Our attack simulations provide comprehensive tabletop testing of automated remediation and response, ensuring organizations can trust they are protected.
Want to learn more? Register for our webinar, Prevent Cloud Breaches with Skyhawk Security’s Time Machine on May 29, 2024 at 11 AM EDT.
