Aviv Cohen, Pentera | Black Hat USA 2023

This is Textron tv. Hi, this is Shera Rubinoff. I'm here with Aviv from Pantera Aviv.

It's such a pleasure to be with you here today. Can you please share with our audience who you are and what you do with Pantera? Hi Shira.

Thank you for having me. Pleasure. My name is Aviv Cohen.

I head marketing in Pantera. Pantera, for those who don't know, is a security validation software company. What we do is identify risk and help its mitigation, and we do it by emulating real attacks.

Exactly. Taking the adversary point of view and running tests against one infrastructure. Actually, our customers do it themselves in a A D D I Y, uh, fashion.

Mm-hmm. Just run the tests against the latest attacks and see what they need to fix in their infrastructure to reduce exposure. It's, it's as simple as that really.

Excellent. And how do you differ from other companies out there? So, um, the big banner, banner we carry is automated security validation, which means, as opposed to if we go back at the day, uh, pen testing is a manual operation, and security audits are also manual.

We do it completely automated. Right. It's just amazing.

Some people compare it like to a house iRobot Roomba. Okay. Where, uh, you set the scope or the template and you press test, and Panera actually does the rest and it does work of a pen tester, fully automated, available to you 24 7.

Many of our customers, and we have over 800 enterprise customers in production today. I use Panera daily. So if you want to compare it to what was like, uh, old days, like once a year pen test.

Okay. And then throughout the year, you have no really good idea of what your posture is in terms of the attacker perspective. Now you can run it daily and make incremental, like in a very agile sprint way to kind of do incremental patching and remediation and keep that strong posture.

Mm-hmm. So, uh, automation is one of, of the big differentiator. And we're also an agentless technology.

Oh, that's important. So, uh, some people compare it to different, uh, breach and attack simulation players desk. Mm-hmm.

In that case, you need to install agents in all places of your infrastructure and run some playbooks of, uh, attacks between them. Forget about all that. Too many layers.

It, it's too many layers, too much maintenance. And actually it's not how hackers do, like hackers don't come install agents. And then, uh, Hang on a second.

Let me get everything in place, then we'll go. Right. Okay.

So the thing about security validation, you want to validate as close as possible to the real threat. So Pantera acts, and that's why it's, by the way, agentless completely like an attacker. You don't need to give it anything.

You don't need to install an issue, anything, and it's fully automated. So these are the two great differentiators, like fully automated and an agentless platform. You can run every day and test your security again against the latest of the attacks.

Uh, perhaps it's worth mentioning a couple more differentiators. One is our substantial research team. Mm-hmm.

So what we do when threats come about, and sometimes we're ahead of the curve, we re-engineer a safe replica of that, let's say malware. Okay. And insert it constantly into the updates of the platform.

So the test you ran yesterday is not the test you're going to run today. Of course, as threats evolve, you want your automated security validation to also keep updated. And we assure that because we have this substantial, uh, research team.

Well, that's very important and you're certainly taking a strong stance and the proactive stance of cybersecurity proactivity, you know, in the past it was really being reactive. How do we deal with it once it happens? And you're really mitigating threats and, uh, teaching and training as well, which is really important.

And I'd actually like to segue to something incredible that you guys produced and, you know, kudos to you, uh, your book Castle Defenders and, uh, this is a children's book that you wrote and, uh, it talks about teaching children about being cyber secure. Can you talk to our audience a little bit about this and the importance behind teaching young children about being cyber secure, what that means and what was the brainchild behind this book as well? So, um, thank you for saying that.

So as Panera continues to grow and we're a cyber unicorn, uh, we feel obligated to contribute, uh, to the community. And this is one of our way to, to contribute. The first thing we thought about is really, um, it came out of a place of respect to this community, to the defender community, uh, cyber community defenders actually defend our way of life.

So think about a single day that all of cyber defenses would be down instantly. You won't have electricity, food, energy, transportation, healthcare, communication, if, and, and, and to substantiate that, just think about all the attacks that happened, let's say in the past 10 years, happening just in one day. So it, it would be complete havoc.

Now these people put a lot of effort and I would say also sacrifice working day and night to defend our way of life. And I think the way that they're perceived are not like, say equivalent other essential workers like, uh, police officers, firefighters, they're treated in one way. And cybersecurity people are much less understood and therefore much less appreciated.

I think one of the things that's most important got us to write this book is from a place of respect and appreciation. So, and it starts with a family. Yes.

So if a few of the children we ask, um, many of our customers, do your children know what you're doing? Say no, they don't. No.

They just know I go out to work and I come back late. That's all they know. Okay.

So the book would change that to be much, you know, much more understood. Then the next thing is about the, you know, the young generation, the young generation, uh, is online and needs to understand the risk, uh, the risk of fraud, all the risks that are online and understand, let's call it cyber literacy, is something we should encourage both for their wellbeing as well as for them to possibly join, uh, the defender ranks later on. So when you see like a, a hero image when you're young, when you grow up, you wanna follow suit, perhaps, of course, uh, your parents.

So understanding the parents, understanding cybersecurity. Now, the process of writing this book actually took us quite a few months. Uh, we had children's psychiatrists advise us to make sure everything is proper, to take all these complicated concepts of internet, cyber prevention, detection, response, zero trust, and put them in a book about, uh, defending a castle, which is the essence of the book.

And, um, we actually gave it as a beta test to a few children. We got like great reviews, and now we're rolling, uh, the book out to more and more people, which are sending them us like a lot of raving pictures of the kids reading, um, kids actually saying like, dad or Mom, can you read it to me again? That's the, that's the greatest compliment of course.

So, um, it's, it's very well received. And I think it came in just to that niche where there was nothing for the ages of five to 12 to explain what cybersecurity is in terms children can understand. So that's a great start.

Well, I Think that's very important. And this day and age, kids are growing up with the internet, with devices, with connectivity, with communication, and to teach them from a young age what it means to be cyber secure and to what it means to be a defender, as you put it really also, not just keeps them secure, but think about a larger type of system or organization. Let's say this child's parent is, you know, a c e o of a company or a large family office or a bank, and they're a child that might be risky behavior online that could lead to all sorts of problems.

So starting any type of education from young, certainly cybersecurity is so critical. And there was a hole, I would say, in the industry in a lot of talk around educating middle schoolers and high schoolers. But this age group is, is so important.

So really congratulations to you for really finding this space and, and, and taking care of it. So a little bird whisper to me that you have some background in psychology. Yes.

Right? Yes. I used to be a psychologist before my cybersecurity career.

And in children, specifically In in children and teenagers. Yes. So the thing about cybersecurity is that yes, there's the technology aspect, but there's also the human aspect.

Yep. So about, uh, the, the human factor is always what, what is called like the weakest link, but it's weakened just in terms of cybersecurity. The thing is that even companies invest a lot in educating Yes.

The employees, but I for, for children to defend themselves. And the book also has like the 10 commandments of sa safe online, uh, conduct. Yeah.

So to to speak yes. Uh, is really important to become like cyber deliberate. And in the same way you say to don't talk to strangers on the street in cybersecurity is don't click on this link.

It's, it's a way that people need to evolve and understand the online modern world from a young age. And I think, I think the book is like a very positive step towards that. But again, it came from a place of respect to this community.

So Panera on one hand is doing like great as, as a, as a cyber unicorn, one of the top five growing cybersecurity companies in the world today. But we had a privilege myself and, and a great team of marketing that, uh, put this book together to actually also contribute something that has nothing to do with our technology. Right.

So I feel that's a little bit of a privilege. Uh, there's the book, right. And um, we also have a coloring book to go with it.

Excellent. And I always say soon the audio book and, you know, uh, the movie and the play. Right.

Excellent. It's like you need them All Different. We need to put them all together.

Well, the thing that you mentioned, you know, the human factors piece, you know, that's where I deal heavily in the cybersecurity world. We talk about the people, the process and the technology. You need great people, you need to deal with the human factors.

You can have the best technology out there, but the process is the glue. And as you said, they say the people are the weakest link in the chain. So I counter that.

I said, make them part of the solution. And you're doing this from a young age. You're literally taking that human factors piece of saying the human's the weakest link.

Why are they the weakest link? The weakest link? Because they're not either educated, they don't know.

They call it the negligent insider threat. Take all that away, teach them from a young age up, have a part of their culture that they are cyber secure and they do recognize what is important and how to conduct themselves. It'll lead to much better security as they grow older, but also within their lives.

So it's, it really covers many bases. It's very much in line with statistics that says that within the insider threat family, the majority of it is unintentional. Correct.

Where people unintentionally bring in like, uh, contamination and, and uh, and threats into the organization. But that's just because they got it somewhere else. And unknowingly, uh, played a role in, in the kill chain, uh, without any intent.

So that's definitely that. Right. Aside from that, I would say it's, it's a fun book and I do advise like, uh, especially people with children at the ages of five to 12 to just take a read.

Um, it can be found on Amazon. So just Castle Defenders on Amazon is, is a good start. And it's, uh, it's already a bestseller, so Oh wow.

It'll pop up on, on the top of the search. No worries. Oh, That's wonderful.

And I know that, uh, Pantera's here at Black Hats. And could you share with our audience, we're live streaming at Black Hat, where you are, um, on the booth floor, uh, what your number of the booth is that people come visit you and see a demo and talk to some folks there, as well as any other happenings you have going on at Black Hat. So definitely, um, we're at the booth 2,400 and we have six demonstrations waiting for people to come and see, uh, you know, the Panera technology at work and how we validate security and advise on remediation in an automated way.

Uh, also what Northy is, uh, uh, worth, um, noting is, sorry, is that we're having on Thursday night, a big party in the hackathon, uh, said to be the big party of the event. So I advise also to come to the 2,400 booth to, to get your wristband and, and register and uh, really happy to partner with anyone and kind of grow, uh, at the end of the day, grow an enterprise to be cyber strong. Excellent.

That's the point. To be proactive, reduce risk dramatically and be cyber strong. Uh, if you see, uh, an like analysis of breaches, most of them could have been prevented with a current stack.

That's the reality. Something was misconfigured, it's always the anomaly. One file, one password, that's all it takes.

All it takes. Yeah. But you can also find those if you have, uh, security validation software that covers your entire attack surface on a continuous regular basis and does so with a click of a button, that that's the value.

And anyone who wants to kind of listen or hear more really happy, happy to receive people in our booth. Well, Excellent. It certainly sounds like something that people should take a look at.

And I encourage the audience to stop by the booth, anyone who's here at Black Hat, you know where to find them. And Aviva, it was a pleasure speaking with you today and I look forward to speaking to you again soon. And, uh, this is Shera Rubinoff reporting live here at Black Hat.

And stay tuned for upcoming interviews. Thank you.