|By Xenia von Wedel||
|February 26, 2014 12:35 PM EST||
Thanks for taking the time to answer my questions. Please tell us, what is Agiliance all about and what do you do?
Torsten George: Cyber-attacks, insider threats, monetary fraud, and data breaches - affecting some of the world's most renowned organizations - make headlines every day. At the same time, the worst economic downturn since the 1930s has focused intense attention on inadequate risk management and the effectiveness of governance practices. The key to addressing these complex, interlocking problems is implementing a context-aware, scalable risk management infrastructure that makes risk visible, measurable, and actionable across financial, operational, and security domains.
That's where Agiliance® comes into play. We're known as the Big Data Risk CompanyTM and leading independent provider of integrated solutions for operational and security risk programs. Our mission is to help organizations to unlock and use their knowledge of risk to optimize business investments and performance.
As the pioneer of the Big Data Risk Management category, we're disrupting the established practice of performing risk management as continuous consulting, replacing it with continuous, automated software-based monitoring.
What are you launching at RSA?
George: Agiliance is launching RiskVisionTM 7, which redefines the management of enterprise and supplier risk, regulatory compliance, security, and incidents using a big data-driven model. RiskVision 7 performs near real time analysis of petabytes of governance and security risk data to accelerate incident response actions, identify cross-domain threats, automate process change, speed user productivity, scale operational efficiency, and ultimately assess risk based on business impact.
Organizations are operating in a dynamically changing risk ecosystem, which is characterized by mushrooming government regulations (e.g., UK FSA, Singapore MAS) that scrutinize inadequate, assessment-based risk management and governance practices, as well as new cyber-attack vectors such as bring-your-own-devices (BYOD) and an organization's supply chain. As a result, it has become imperative to strategically align datacenter operations, cloud operations, and supplier services with accurate risk prioritization, remediation, and audit reporting.
RiskVision 7 addresses these market requirements by enabling continuous diagnostics and remediation on more than one million assets and correlating threats, vulnerabilities, controls testing, and policies for near real-time risk management. It is also the only commercial integrated risk management system in production for enterprise and supplier incident response with a ten-thousand practitioner deployment.
Who is your target audience and how do you intend to reach them?
George: Agiliance's priority target segments are Global 2,000 companies and government agencies in North America, Europe, Singapore, and Australia. These organizations face complex threats and compliance requirements, have mature security defenses, and typically have implemented failed silo-based departmental approaches to risk management. Target buyers for Agiliance solutions are the Chief Information Security Officer, or their superior, normally the Chief Information Officer or Chief Risk Officer.
I'd be curious to hear any general thoughts you have on market trends...
George: For 2014 we predict five major trends: #1 Organizations will finally transition away from a compliance, check-box mentality and adapt a risk-based, pro-active approach. This trend is primarily driven by the realization that you can schedule an audit, but you cannot schedule a cyber security attack. Furthermore, we are foreseeing as the #2 trend that legislation and industry standards will shift their focus from providing mandates for preventive measures to risk awareness and remediation response. Early examples in this context are MAS, OCC Guidance, and PCI DSS 3.0. For instance, introducing set response times in Singapore MAS is challenging organizations to change their culture. #3 We foresee that threats will finally be recognized as one of the main factors that determine risk. In support of the adoption of threat modeling and intelligence feeds, standards such as VERIS and STIX will emerge. Confirmation for this trend can be seen by the growing number of threat intelligence feed vendors; notably four out of the ten RSA Sandbox Innovation Awards finalists are tied to threat intelligence. #4 Based on the uptick in cyber-attacks targeting the supply chain, we predict that vendor risk management will completely change. The days where end user organizations relied on vendor risk assessments via questionnaires are coming to an end. Instead end user organizations will turn the table on their suppliers and in case of software vendors require an independent accreditation certification before allowing the technology to be deployed in the enterprise. And last, but not least we anticipate 2014 to be the break-through year for Managed Security Services. This is simply based on the fact that the data volume, velocity, variety, and complexity is overwhelming many organizations. Thus, outsourcing of threat diagnostics and remediation responses will be highly accepted service.
What is the viral aspect of your product?
George: It's only February and we've already experienced several massive data breaches at Target and Neiman Marcus. Any time that there is a data breach intense attention is being put on inadequate risk management and the effectiveness of governance practices, offering Agiliance ways to provide public commentary and then take these media clips viral.
What's the business model? How will you make money?
George: Agiliance's business model is best described as Managing Risk-as-a-ServiceTM (M-RaaS). The RiskVision solution is delivered by a broad range of organizations, both on-demand and on-premise, across a mix of physical and virtual environments. This flexibility allows customers to purchase according to their organizational maturity and scale; allowing them to extend usage as their maturity increases.
RiskVision pricing is based on number of applications, connectors, and managed assets. The platform and the majority of content are covered by annual subscriptions. Pricing starts at $25,000 per application per year with cumulative volume discounts for all applications, connectors, and managed assets purchased.