Case Study: Vulnerability Analysis as a Precursor for Managed Security Services

An IT system house offers customized managed security services and relies on real-time facts from automated vulnerability analyses when addressing customers. This makes security-critical points transparent, shadow IT visible and offers concrete starting points for talking about IT security.

Background

Our partner, a leading provider of holistic automation with complementary managed security services, is aware of the precarious IT security situation of companies and wants to address the decision-makers in a targeted manner. Cross-selling of IT security services is usually done by the account manager within ongoing automation projects. From time to time, this leads to displeasure among the IT admins on the customer side, who perceive this as interference in their area.

At the same time, of course, there are new customer approaches on the part of security sales. These have to be well prepared, for which there is often a lack of time and sometimes also a lack of in-depth knowledge. In a pilot phase, the sales team used LocateRisk's IT vulnerability analyses in the form of management overviews in sales talks for the first time and was thrilled. "We use LocateRisk as a door opener. It's gigantically good for that."

Solution

A management overview is an easy-to-understand summary of the automated IT vulnerability analysis. Based on the main domain of a company, its IT attack surface is examined from an external perspective, security-critical vulnerabilities are identified, prioritized and supplemented with recommendations for action. The advantage of external analysis is that, unlike a pentest, no preparations need to be made by IT and it runs unnoticed. Depending on the size of the company, a test takes between 3 and 48 hours. The results are presented in two specific reports: the interactive detailed report for IT managers and the management overview for business executives. In addition, the security score shows the current IT security level compared to 5505 companies of similar size.

For the sales department, the external view of the company-wide IT security situation proves to be an exciting but harmless story to get into conversation with prospects and customers. Since their administrators are usually not entrusted alone with the publicly accessible IT environments, but rather agencies or managed security service providers, they do not immediately feel attacked.

Result

One sales colleague can no longer imagine starting new customer meetings without the Locaterisk reports. Another adds that everything would then have to be done by hand again, and that would simply cost far too much time. All in all, the consensus is that the reports make it extremely easy to get started with IT security. Interest is so great that most customers are happy to take up a consulting offer to talk about the report in detail. In the process, problems are often uncovered that lead directly to an order for managed services. 

Managed Security Services - New Business Almost Takes Care of Itself

If customers succeed in placing the IT security checks as monitoring, it pays off for everyone. This is because the recurring analyses help companies to minimize their IT attack surface in the long term and at the same time provide the system house with recurring income from the LocateRisk partner contract. In addition, they provide the consultants with important information regarding new customer needs. For example, changes in the company-wide, external IT infrastructure that may require additional administrators or extended project support. At the end of the day, the bottom line is that if you regularly engage with customers thanks to IT vulnerability assessments, new business for managed security services will almost happen on its own.

---