The recent explosion of cloud and SaaS offerings from a cross-industry wave of digital transformation has made it harder than ever for organizations to accurately assess their entire attack surface. While asset discovery and management tools chip away at the gap between known and perceived digital footprint, none have been able to effectively match the scale and ever-evolving ingenuity of malicious attackers searching for forgotten assets — until now. Introducing, Bugcrowd Attack Surface Management on the Bugcrowd Security Knowledge PlatformTM. 

Bugcrowd ASM is the first solution of its kind to reduce risk from unknown or un-prioritized attack surface by matching the effort and scale of attackers with the intuition and impact of trusted attack-minded defenders. With an embedded layer of security intelligence from over 1200 managed programs, Bugcrowd ASM’s platform-powered workflows augment and expedite the complex reconnaissance strategies employed by our elite group of hackers, while reducing noise through intelligent attribution and prioritization. From shadow and legacy IT, to third-party applications, recent acquisitions, control systems, development environments, or any internet-connected asset, ASM has you covered.

The Bugcrowd Difference

ASM is unmatched by any other existing asset discovery or asset recon product on the market today for three critical reasons:

  • Crowd-powered – The same way that scanners miss critical vulnerabilities, automated asset discovery solutions often miss forgotten shadow or legacy IT, misconfigurations, recent acquisitions, patterns in development environments, etc. 
  • Organic risk ranking – ASM doesn’t rank findings by asset size or complexity, we rank by real risk according to extensive program data, current trends, and top researcher insights.
  • Ability to quickly action results – Gartner projected that while 70% of organizations will purchase asset discovery solutions by 2020, less than 25% will demonstrate business value, due to inability to quickly integrate and action findings. Bugcrowd is on a mission to disrupt this market by enabling seamless migration of uncovered assets to assets under coverage through any one of our on-demand or continuous security testing programs.

The Value We Deliver

Bugcrowd ASM provides several points of value to customers looking to better understand and actively address growing attack surface:

  • Visibility – ASM enables customers to see more of their existing attack surface, to include the assets and applications forgotten by new processes, or missed by existing asset discovery and management solutions.
  • Risk reduction – ASM utilizes data from more than seven years and 1200 managed programs to provide customers with the only organic measure of real risk — prioritization of identified assets according to likelihood of attack.
  • Flexible reporting – ASM customers receive a report detailing full risk profile, method for attribution, as well as appropriate next steps for securing identified assets.
  • Seamless migration to active testing programs – Because Bugcrowd also offers world class asset security testing programs, customers may immediately migrate identified assets into new or existing Bug Bounty or Pen Testing programs for targeted testing and continuous coverage.

How It Works

Bugcrowd Attack Surface Management is a tailored service unlike any of our other product offerings. The process begins with careful resourcing, using CrowdMatchTM technology to identify the right set of security researchers, with the right set of skills and reconnaissance experience to fit your program needs. Bugcrowd takes care of the grants and rewards that are used to incentivize researcher efforts. While customers may provide “seed” information to Bugcrowd in order to orient the hackers and kickoff recon activities, this isn’t necessary, and a green-fields approach to discovery and prioritization is more than welcome. Platform-powered reconnaissance workflows are then leveraged to augment the complex strategies deployed by hackers in order to expedite and validate results.

The Bugcrowd Platform also performs asset mapping and attribution during this time in order to reduce noise and determine what actually belongs to your organization. Next, Bugcrowd works alongside the security researchers to inform priority ranking for uncovered assets, as well as recommended next steps. Finally, customers receive a consolidated report that contains identified and risk-ranked assets, as well as attribution methods and proposed actions, which may include the option to roll priority assets into active testing programs on the platform, like a Bugcrowd Managed Bug Bounty or a Bugcrowd Pen Test.

Identify unknown attack surface, prioritize real risk, and secure your “Hacker’s Advantage” with Bugcrowd Attack Surface Management. Download the solution sheet today!

Also join us on Tuesday, November 5 at 11 a.m. PT for a product introduction webinar to learn more about Attack Surface Management. Register here.

For researchers on the platform, learn what ASM means for you.

Tags: