The tendency to focus on merely checking boxes to achieve compliance can lead to superficial solutions that may not effectively reduce operational risk. A strategic pivot towards ensuring compliance through holistic security measures is key; long-term, it demands less effort and provides more substantial protection.

In this episode, Craig Unger, founder and CEO of Hyperproof, discusses the company‘s efforts to help companies achieve compliance and manage third-party risks. Craig is joined by our panelists, Trina Ford, CISO of iHeartMedia, and former CISO TC Niedzialkowski.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, Hyperproof

Full Transcript

[Voiceover] Connecting security solutions with security leaders. Security You Should Know starts now.

[Rich Stroffolino] Welcome to Security You Should Know. Today, we are talking about Hyperproof and what they are doing in GRC. Now, the problem they’re addressing is organizations managing compliance and risk. A big problem for a lot of organizations out there and helping us get some answers to these questions are Trina Ford, CISO at iHeartMedia, and TC Niedzialkowski, former head of security at Thumbtack and Nextdoor.

We have some expertise to bear here. I’m excited for this conversation. Trina, I’m going to get started with you. Why is managing compliance and risk still a problem? That’s the name of the game, right?

[Trina Ford] Absolutely. Part of the reason is because we’re still trying to accomplish security through compliance versus if you can accomplish compliance through security, it’s going to require less effort, less time because you’re covering it as a whole. The other aspect of that is that we’re too focused on IT.

This is a broader issue and challenge that we all have to solve, and we all have a vested interest in reducing operational risk. So, in a nutshell, that’s my opinion as to why we are still having these challenges. We’re still trying to check boxes and have that compliance through security versus having security through compliance.

[Rich Stroffolino] So, TC, I got the same question for you. Why are we still struggling with managing compliance and risk?

[TC Niedzialkowski] Those are some really great points that Trina made. I think from a business perspective, a lot of times adopting a compliance framework or demonstrating compliance is something that’s in pursuit of another business goal, whether it’s going public and SOX, S-O-X, compliance or needing to have something like a SOC 2, something like ISO 27001 because that’s what your customer’s demanding.

And so, I think the challenge is teams are already tasked with a lot of work, the IT teams, the engineering teams, security teams. And so, they also have to get this compliance framework in place and demonstrate compliance and then maintain those compliance controls. So, a lot of times the strategy is the first time you do it, it’s going to be manual controls, manual processes because it takes time to automate those controls.

You can’t automate everything overnight. That’s just too much project work. So, I think, again, why it’s still a problem, because a lot of new companies are doing this for the first time, and they have to do this in addition to their normal job, and they don’t have the maturity in place where everything’s humming perfectly using AI and automation so that they have more time to focus on other critical business work.

[Rich Stroffolino] All right, well, today we’re going to be talking to Craig Unger, founder and CEO of Hyperproof. Now, Craig, to start out, we need to answer three essential questions. How do I explain the value of your solution to my CEO? What does your solution do and what does it not do? And what is the pricing model?

Can you help us set the table here?

[Craig Unger] Absolutely. So, for our solution, we offer a solution that allows you to manage your compliance really through the year. So, we’ve kind of pulled back from just saying, “Hey, compliance is what you do when it’s time for an audit.” And we’ve entered the market with a solution that lets you really model your compliance kind of as the other side of the coin of your security stance through the year.

So, you can see all through the year how your security stance is doing, and then when it comes time for an audit, you’re very well prepared. You have controls that you’ve picked that are automated, evidence is collected, your peers are kept up to date. There’s a strong collaboration element and you’re really ready for the audit.

We charge by the framework typically. So, if you’re trying to pursue SOC, let’s say ISO NIST 27001, that would be three frameworks, and you would be charged a certain amount per framework. We do have additional modules. We have a risk register, we have third-party risk, user access reviews and some others, that you can add on those modules.

That’s how we charge.

[Rich Stroffolino] All right, we’ve gotten a taste for this solution, but I know we have a lot of questions. There’s a lot to dig into here. So, I’m going to start with you, TC. What other questions do you have for Hyperproof?

[TC Niedzialkowski] Yeah, I guess to start with, what kind of metrics or ROI can you show in terms of timesaving, helping companies implement this tooling, and demonstrate that they meet these compliance requirements and maintain those compliance requirements over time?

[Craig Unger] That’s a great question. In fact, for the first couple years of the company, we didn’t publish any metrics because we didn’t have enough data points. And then after about two years, we had done some studies with our customers and it’s a pretty broad range, but we see about 30 to 60% savings on all things audit.

So, that has to do with how much time you save in automating evidence collection, in automating the testing of it, but also in keeping your team up to date and up to speed, and then also in really optimizing the back and forth with your auditor, including some very specific relationships we have with specific audit firms that are very trained on how to use Hyperproof and are expert in the system.

[Rich Stroffolino] All right, Trina, I’m going to throw it to you. What questions do you have for Hyperproof?

[Trina Ford] So, Craig, based on the understanding that this is a GRC platform and there’s also a third-party risk component to it, how does your product support the overall lifecycle approach to third-party risk and/or vendor risk? Part two of that is, do you have a contract management module as part of your solution as well?

[Craig Unger] Okay, I’ll take the second part first, Trina. There isn’t a specific contract management part, but we do have full document storage capabilities. So, some of our clients will take their contract with their third party and store it in Hyperproof. We don’t try to facilitate the contract workflow itself.

But everything from there on out, we do facilitate, including the ability to design questionnaires, distribute those to whomever you need information from, if it’s vendors or others or third parties, schedule those, whether they’re one-time only or repeating, and then a full ability to score the answers of those questionnaires and create a health rubric so that you’re aware of how your vendors are doing and whether they kind of match your standards.

And so, when you end up looking at Hyperproof, you end up seeing really a list of your vendors and the current health in the system based on all the workflows that they’ve done. So, that’s the way we treat it as a workflow. We know it’s kind of an ongoing workflow and we are leading the charge towards continuous third party, very much the same way that continuous compliance is taking hold.

[TC Niedzialkowski] Yeah, I got a question to follow up on, Trina. So, I know that a lot of organizations, they already have a tool that they really like when it comes to contract management, like Ironclad, right? And there can be some pretty sophisticated workflows that have already been built out and customized.

And then I know also from like a purchasing, finance perspective, there’s different kind of SaaS spend management tools that’ll help you do the negotiations, help track through the process. These two areas, they’re doing a lot of things that feed into GRC when it comes to that vendor lifecycle management that Trina was talking about.

How does it integrate with those other toolings that are already part of this vendor management lifecycle?

[Craig Unger] Yeah, great question. In several ways, like one way to integrate Hyperproof in the workflows through passing data in any one of a number of ways, if there’s crucial data that’s coming out of the contract management system, it can be passed in to actually drive further workflows in Hyperproof, either through the API or through what we call custom fields that you can use and build on top of your third-party model inside Hyperproof.

And so, those are both great ways to get data from other systems to hand off and then drive workflows in Hyperproof. For instance, maybe it’s the frequency of how often you’re actually sending out these questionnaires, just by way of example. Another capability in Hyperproof we call Hypersyncs, and those will go out their integrations.

We have about 70 or more of them, between 70 and 80. And we have some for document management and contract management systems. If not, our customers have full access to an SDK that can build their own. And then they can get data from anywhere, whether it’s the 70 or 80 that we have or ones that they envision on their own and then drive their workflows from that data.

[TC Niedzialkowski] It sounds like you have pre-built integrations with some of the top ones like Ironclad, I’m assuming.

[Craig Unger] So, Ironclad is actually not one that’s been built yet. We’ve started out with all of the mega scaler systems, AWS is the Azure’s of the world because getting all your configuration data is so crucial for your compliance workflows. Also, we’ve been went to all of the DevOps systems. So, think of the Jira’s, GitHub’s of the world, GitLabs, all the security systems because we want you to be able to bring in all of your scans.

So, that would be Qualys or Cloudflare or CrowdStrike, a number like that. And then also a lot of general enterprise applications like a Salesforce, etc. We also have Workday and a lot of the HRIS is because onboarding and offboarding tends to kick off workflows in the same way that we’re talking about contract management.

So, I think right now, Ironclad might be on the backlog, but also very easy to build. It’s quite easy to build a connector in Hyperproof or Hypersync.

[Trina Ford] I like that you’re bringing in a lot of data. My question is going to be around how does Hyperproof actually aggregate and correlate that data that you’re bringing in to bring more efficiencies to your teams that are trying to utilize this? Again, I’m thinking of it from a more holistic picture, cost savings, and kind of streamlining for the teams because we’re always busy.

There’s all types of assessments coming in. You do have these different frameworks. You are talking about compliance, regulatory compliance that you can also assist with, but that’s a lot of data still. So, how is it that Hyperproof is helping to correlate that data and maybe even alert on it so that the teams don’t have to think about it?

[Craig Unger] Yeah, that’s a great question. We designed all of those capabilities for collecting data to really, as we were talking about, kick off some of these workflows. So, a really common scenario in Hyperproof is that you would collect data and then you would use it, for instance, to drive a test.

I’ll give you an example from KnowBe4. We use KnowBe4 for training and we want to make sure that everybody has done their security training on time. So, we would bring in the data from KnowBe4 and then we write a very simple test. In Hyperproof, it iterates over all the records we get, make sure that nobody’s out of compliance for their training and if somebody is, it’ll end up, for instance, creating a task for the individual or the administrator and it also could automatically affect the overall health of the program.

So, that’s an example of where we bring in the health and then we act and we operate on it with the goal of avoiding any manual collection of data and also avoiding having to observe or eyeball some of these controls where that’s been the history. Somebody has to look over your shoulder and make sure everything’s done.

Instead, Hyperproof can do that for you.

[Trina Ford] So, I just have one other question because I’m taking it from the pain point perspective, right? There’s an expectation that there are reassessments based on the tiering of your vendors. That also has to do with keeping you compliant, right? I’m trying to hear if Hyperproof actually helps with taking the thought process out of knowing that it’s time to assess a tier one or tier two vendor.

Does that happen?

[Craig Unger] Yes, there’s a repeating kind of, or a scheduling capability that allows you to repeat. Okay, perfect. Not only questionnaires, but actually any task that gets set up in Hyperproof can actually be what we call a repeating task where you can schedule it every quarter or every week or whatever it is.

And when it comes to actually that task being run or any results that you’re wanting from an individual, you can actually give that user a certain number of days from when that task is created in order to get back to you. So, you can actually create those kinds of tasks and repeating workflows right inside Hyperproof and then just get the results of how they got operated.

[Trina Ford] TC, I have one more if you don’t mind.

[TC Niedzialkowski] Oh, absolutely.

[Trina Ford] I know that there is a focus on compliance. Compliance is an easy check the box. It’s either yes or no. Third party is more challenging because you have your fourth and fifth parties. I’m going to go back to that correlation of data. Is it helping with understanding when our data may be in the hands of a fourth or a fifth party when it’s the third party that we’re kind of doing business with?

So, in other words, does Hyperproof have a model where you have one client that has the product, and you also know that another client who happens to be doing business with that client is also utilizing Hyperproof? Do you have any type of correlation there? I know it might be kind of crossing lines, but that’s one of the biggest challenges for the third-party program, third party risks is because we have no visibility or insight into those fourth and fifth parties.

So, is that on the roadmap?

[Craig Unger] It’s a great question. Today, you are sending the questionnaires over to the third party, and it’s only if the fourth or fifth party actually were Hyperproof customers, would they also be able to then kind of like continue on in that questionnaire, asking their multi-level of vendors. It is something we’ve thought about and something that we’re considering on the roadmap.

The other way that some people handle it inside Hyperproof is you can actually frame what the shape of the data is that you want to collect from the third party. And so, you can ask them to assure that they’re submitting data on behalf of their third parties as well. That’s actually pretty common at certain levels where you want to make sure that the person you’re doing business with, for instance, has a SOC report or has something like that.

But I understand what you’re saying. It would be better if Hyperproof over time is the one that actually certified the fact that the vendor of vendor is actually answering that questionnaire. So, yeah, there’s some other strategies to do it in Hyperproof, but we don’t do the questionnaire on top of questionnaire that I think you’re getting at there.

[Rich Stroffolino] All right, well, unfortunately, TC, we are out of time here, but Craig, what’s one thing we didn’t ask about that we need to know about Hyperproof?

[Craig Unger] Well, I would say more about the market as a whole. There’s a lot of activity in the market. There’s a lot of tailwinds and new regulations that are coming out. One thing that we have our eye on is DORA, which is the Digital Operations and Resilience Act that has now went into law as of January 17th, I believe, in the EU.

And I just want to alert everybody to the fact that resilience is really another level of compliance, and it has to do more with being able to kind of be at the table when something serious happens operationally, whether it’s an emergency or something like that. You prepare for it with maybe simulations or tabletop exercises, but that is a very key direction for the whole GRC compliance area going forward.

We’re definitely thinking about it and beginning to invest in Hyperproof, and I’d recommend everybody thinks about it as part of their programs.

[Rich Stroffolino] All right, well, that’s it for this episode of Security You Should Know. To learn more about Hyperproof, head on over to hyperproof.io. A huge thank you to Trina and TC for helping us learn more about Hyperproof and a big thanks to Craig from Hyperproof for your time and being game to answer all of these questions.

Thank you for listening to Security You Should Know.

[Voiceover] That wraps up another episode of Security You Should Know. If you like this program, please subscribe, tell your friends, and leave us a review. All companies showcased on this program are sponsors of CISO Series. If your company would like to be spotlighted and interviewed by our security leaders, go to our contact page on ciso-dev.davidspark.dcgws.com or just email us at info@ciso-dev.davidspark.dcgws.com.

Thank you for listening to Security You Should Know, connecting security solutions with security leaders.