Sharon Florentine: Hey, everyone! I’m Sharon, Florentine. I am the editorial director here at Cyber Risk Alliance for the Channel brands, which include ChannelE2E and MSSP Alert. And today I’m here with a very special guest. I have Mark Balovnev from Cyrisma. I probably mispronounced that. I apologize, Mark, but I will take a pause and let you introduce yourself and talk about your journey so far with Cyrisma. Mark Balovnev: Yeah, absolutely. Thank you, Sharon. So my name is Mark Balovnev, and you’re spot on. I’m the CEO of Cyrisma. So I’ve been a longtime founder myself, I wrote my first line of code when I was 9, built and scaled several businesses over the last decade or more than a decade, and now incredibly honored to be at the helm of Cyrisma for this next incredible stage of growth. So, very quickly about Cyrisma. Cyrisma is the one platform for MSPs and MSSPs to identify, mitigate, and report on cybersecurity risk. So we help MSPs build and scale profitable security programs through proactive work. So, attack surface management, data management, vulnerability management, and tying that into compliance and reporting for quantifiable progress around the CISO strategy action plans and reporting. Sharon Florentine: Okay. And so you kind of have a mantra, if I can call it that, of ‘cybersecurity for everyone.’ And, how do you make that happen? Mark Balovnev: Yeah, it’s actually, it’s been our ethos since the very beginning. So our goal has always been to make cybersecurity simple, accessible, and affordable for the MSP. And so that was all the way back, almost seven years ago now, where we set out to make those cybersecurity tools accessible for managed service providers to be able to create profitable and scalable security programs. And back then, in 2018, it was a little-known fact that the company name originally was Data Spotlight, because we actually started with the inside-out view. So, where is my data? And what can we do about it? So we showed — we lit up a spotlight on your data, and from there it was just a natural evolution of talking to customers, understanding their needs and going from just doing data scanning to vulnerability scanning to risk-based vulnerability management to understanding the attack surface and not just inside out. But, what does it look like from the outside looking in to mitigate both the attack surface and the exposure internally? And rolling that all up into this, all-in-one tool for everyone at a single simple price. So that’s sort of the story behind that. And that’s also how we make it possible by essentially starting in one place, talking to customers, and then starting to learn about all these different adjacencies that we can bundle in to help MSPs create a comprehensive cybersecurity offering. Sharon Florentine: Yeah, which is so key, instead of — from my perspective — trying to integrate and mash together a bunch of tools that may or may not play well together, they may leave gaps that could be exploited. And it sounds like that approach that you’re taking is very much needed in the space. Mark Balovnev: Absolutely. And this is where I’ll put my little product hat on for a quick second, and talk about how cool this is in the grand scheme of things, because none of these things exist in isolation. These are all perceptions of the world that we have. We can look at the world through the lens of an asset, through the lens of data, through the lens of vulnerabilities. And so this is about kind of putting that all together into a singular lens, and from a product perspective. This is where I get really excited, because not only can we just look at one of those things and say, ‘Hey, we ran a scan on your data. We ran an external scan, and this is what we came up with. We ran an internal vulnerability scan.’ No, it’s actually about consolidating that all into a single holistic view. And that’s where you can really layer on the value. So from a product perspective, what we’re working towards now is the idea of a sort of continuous attack surface. So from the outside, looking in, and threat exposure from the inside looking out where we can actually aggregate all of that data from both sides, from all these different sources. Correlate it, and then actually give unique prioritizations like, ‘Hey, this asset or this machine is more important because it has sensitive data. This one might not be.’ How can we tag and understand and prioritize different things in our environment, based on what all these other data feeds are telling us, right? And that’s what makes it really exciting. So originally it was just about, how can we jam-pack as many powerful features into a single tool at an affordable price? Now it’s how can we get them all the talk to each other to give you a bigger, more strategic picture of what’s happening with the end customer. Sharon Florentine: Yeah, and I like the focus on “continuous,” because I think that’s so key. Just because you may be protected or fortified one minute, everything in cybersecurity — threats especially — change so rapidly that you may not be protected the minute after, and the continuous feature really strikes a nerve with me. Mark Balovnev: Yeah, a lot of folks will laugh because I say this all the time, but I really believe it, especially when you look at vulnerability management and everything else — cybersecurity is one never-ending game of whack-a-mole. Right? You’ve got a million things you’ve got to do today. You can patch them all the next day. You’ve got a million more. You can’t win, right? So, at the end of the day, you have to learn how to play the game right. And the only way you can do a million things is either figure out which of those 1 million things are really important. So if I do, those 1,000 out of the 1 million, that’s really going to move the needle. That’s one way. So, prioritization, one of our key principles, or the other is, how can I just get more done with less? Right? So, how can I get the best bang for my buck? Or how can I deliver as much value to the end customer as possible with a minimal amount of overhead? And that’s automation. So I think those are the two real key pillars underpinning the whole thing because it’s a never-ending game, to your point. And so to the extent that we can arm you with the data and the tools to be able to turn that into a continuous program. We can evolve from running a scan and saying, ‘Hey, at this point in time, you know, this is what reality looked like.’ But by the time I send that report, reality might look completely different. Right? So, how do we stay on top of that on an ongoing basis? Sharon Florentine: If you can put your product hat back on for just another minute, can you dive in and talk a little bit about the technology, the speeds and feeds behind Cyrisma, and what that does for MSPs and MSSPs? Mark Balovnev: Yeah, absolutely. So in order to make all of this happen, we’re leveraging a complete blend of third-party and proprietary data sets that we’re building out. So we use private paid-for security research databases similar to the things that Qualys and Tenable use, and others. We also tie into NVD CIS and things like that. And on top of that sort of meta-level analysis, what I alluded to earlier, we’re building a proprietary data set using machine learning and procedural state. And now you’re going to regret that I put my product back on because there’s so much you can do with that in terms of asking statements of the data that we find, much like a human would. And so MDRs and others have been doing this for ages, but we’re learning from the best, and taking those best practices and applying them here, such that, well, if I see I have a vulnerability on a particular machine, what are the next steps that I, as Mark and as an operator, would ask in terms of figuring out what the next step is, what are the implications? How serious is this? Really, if I go and patch, what are the implications? Right? And actually turning those questions into code? So this is where I get really excited about real machine learning. And I know AI is everywhere these days. But real machine learning essentially automates those functions. So you can focus just on the prioritization. And the ‘so what? So what really matters?’ And how can we have a thoughtful conversation around what we’re going to do about it, what the implications are, and what the meaning is for you as an end customer? Why does this matter, right? And how is this going to move the needle and take you to the sort of higher order, level of insight and value? Sharon Florentine: I love that. Now, if you are an MSP or an MSSP, where should you go to check out more and to get a demo? Mark Balovnev: Well, I’m an open book. So first and foremost, you can email me @mark.b at cyrisma.com. If you would prefer to go the traditional route. You can always check out our website at Cyrisma.com, and there’s a very big button. You can’t miss it in the top right corner. It says, ‘Request a demo,’ and we’ll be happy to serve you there, too. Sharon Florentine: Sounds awesome. I’ve seen the demo, and it is amazing. So you should definitely go check that out. Thank you so much, Mark, for taking the time. It’s been great speaking with you, and I hope everyone will go and check this out. I’m Sharon Florentine for the CyberRisk Alliance channel brands. Thank you so much. See you next time.
