YesWeHack unveils Attack Surface Management product that unifies offensive security testing

YesWeHack has unveiled an Attack Surface Management (ASM) product that enables clients to orchestrate their offensive security and vulnerability remediation strategy through a risk-based approach.

The new product continuously maps an organisation’s internet-exposed assets, detects their possible exposure to known vulnerabilities, and automatically prioritises those vulnerabilities (based on severity, exploitability and asset criticality).

Unlike standalone platforms, YesWeHack’s ASM integrates vulnerabilities from automated scanning (by the ASM) and YesWeHack’s Bug Bounty, Pentest Management and Vulnerability Disclosure Policy (VDP) products – creating a one-stop-shop for all vulnerabilities.

Amid tight security budgets, the ASM also automates and harmonises workflows to reduce costs, workloads and time-to-fix.

The five operational phases of Gartner’s Continuous Threat Exposure Management (CTEM) model are implemented: scope, discover, prioritise, validate, mobilise.

This enables a unified, comprehensive and risk-based approach to security testing and remediation of the most critical vulnerabilities at scale.

The turnkey-deployable ASM also introduces a design revamp to YesWeHack’s overall platform.

A rapid expansion of attack surfaces, increasingly complex tech stacks and rapid development cycles are fuelling an inexorable rise in vulnerabilities, often present in unknown assets. However, Gartner forecasts that CTEM programs could drive a two-thirds reduction in breaches.

Aïmad Berady, YesWeHack’s VP Product, comments: “With the time-to-exploit for new vulnerabilities plummeting, clearing the ‘fog of war’ surrounding the organisation’s information system and maintaining an up-to-date big picture is crucial. After all, knowing your enemy is useless if you don’t know your digital territory.”

Guillaume Vassault-Houlière, YesWeHack’s CEO, comments: “A 360-degree cockpit combining unified vulnerability management with external attack surface management enables clients to think like, and therefore thwart, an attacker – spotting and sealing off the weakest, most hackable vectors.”