You have seen some bold quantitative claims from us smattered across the content in this website, e.g., 100x visibility, 95% or greater reduction in breach risk and 10x improvement in security team efficiency, etc. Actually, these claims all have a logical underlying mathematical basis which we explain below.

100x cybersecurity posture visibility

Balbix provides organizations with 100x better visibility of their cybersecurity posture than any other method. This “100x” number is explained below.

  • First, with Balbix’s real-time, automatic and self-discovering inventory capabilities, you will discover all your assets. After deploying Balbix, our customers generally find between 15% and 35% (average 25%) more assets than they thought they have.
  • Balbix analyzes 100+ attack vectors including unpatched software, password reuse, easily phishable users, encryption issues, misconfiguration, trust-relationships and malicious insider. As a result, our customers learn about many additional types of “vulnerabilities” (typically 4x) beyond what are normally surfaced by traditional vulnerability assessment tools and manual penetration and application testing efforts.
  • With Balbix, prioritization of vulnerabilities incorporates in 5 things— vulnerability severity, threat level, business criticality, exposure and the risk-negating effect of compensating controls. In contrast, traditional approaches only look at vulnerability severity for security. Balbix customers generally see a 5x reduction of ongoing cybersecurity issues that need urgent attention due to accurate prioritization.
  • Legacy security assessment tools are cumbersome to operate. You typically have to configure vulnerability scans and schedule manual red-team tests. Then you have to wait (sometimes for days and weeks) for results. With Balbix you get a real-time view into your cybersecurity posture and can get your cybersecurity questions answered using google-like natural language search. The speed and quality of your cybersecurity efforts and decision-making is at least 4x more with Balbix.

Summarizing this discussion, here is the equation that multiples up to 100x:

95% or greater reduction in breach risk

Balbix provides a prioritized set of actions that you can take to transform your cybersecurity posture and reduce cyber-risk by 95% or more. Here is how we get this 95%.

First consider the following: the stronger your defenses, the lower your breach risk. Your breach risk and the quality of cyber-defenses have an inverse relationship. So if we show that your defenses can be 50x better with Balbix, than you will have reduced your risk by 1/50 – i.e., to 2% of its original value. This is a 98% reduction in breach risk, which is > 95%.

Let’s see how we get to this 50x metric.

  • First, the adversary can breach you at your weakest link. Therefore a 1.25x more complete inventory immediately translates to a 1.25x better defense assuming that you are doing a reasonable job of securing the extra assets that Balbix finds for you.
  • Similarly, as discussed above, with Balbix you get to see 4x more types of vulnerabilities and get the opportunity to address these issues before the adversary can use these weaknesses to breach the enterprise.
  • Due to Balbix’s ability to provide greater real-time context to stakeholders and it’s gamification capabilities, the fix-rate for security issues is at least 2x greater in an environment where Balbix is deployed compared to one without.
  • Finally, Balbix customers generally see a 5x reduction of ongoing cybersecurity issues that need urgent attention due to accurate prioritization.

Putting this together:

10x improvement in security team efficiency

As you can imagine, having the ability to prioritize tasks effectively and being able to make decisions based on rich context provided by Balbix along with real-time natural language search capabilities is a huge force multiplier. Let’s consider these in turn:

Without effective prioritization based on risk, all cybersecurity issues appear to be “critical”. Consider for example a CVE with 9.5 severity that involves Internet Explorer. You might think this CVE needs to be patched right away to avoid your users’ systems from getting compromised. Depending on the size of your organization, this may be a lot of work, and especially frustrating if this event happens during a holiday season as was the case with CVE-2018-8653. However, with Balbix’s prioritization which takes into account not just vulnerability severity, but also threats, exposure, compensating control and business impact, you may arrive at a different conclusion. If a user’s default browser is not IE but Google Chrome, the risk of this CVE very low, if not zero. Balbix customers experience that less than 20% of previously considered serious security issues are actually serious after this 5-pronged prioritization.

Consider how you would go about answering a simple question like “risk from sambacry”. For many of our customers, the security teams must construct careful queries (and sometimes write scripts) to interface with cumbersome inventory and/or vulnerability assessment systems. Depending on the size of the organization, such tasks can take anywhere from 10s of minutes to hours and days to run. With Balbix, all of this information is available in real-time via natural language search. We will claim at least 2x improvement in productivity due to this.

Combining, we get the equation: