Asset visibility remains a persistent challenges in cybersecurity. Despite working on this challenge for decades, CISOs continue to struggle with knowing what assets exist in their environments, where they’re located, and what risks they present. The problem has only intensified with dynamic cloud resources spinning up and down in seconds, APIs proliferating across environments, and third-party integrations creating complex dependency chain. Traditional scanning tools simply can’t keep pace.

In this episode, Franz Fiorim, Field CTO at Trend Micro, explains how their Cyber Risk Exposure Management (CREM) solution addresses these challenges through continuous asset discovery and risk prioritization across the entire attack surface. Joining him are Krista Arndt, Associate CISO at St. Luke’s University Health Network, and Brett Conlon, CISO at American Century Investments. They discuss how CREM consolidates external attack surface management, cloud security posture management, and vulnerability remediation into a unified platform that discovers hidden assets through multiple methods including agentless cloud integrations, network discovery sensors, and third-party API connections.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, Trend Micro

Full Transcript

[Voiceover] Connecting security solutions with security leaders, Security You Should Know starts now. 

[Rich Stroffolino] Welcome to Security You Should Know. Today, we’re going to be talking with Trend Micro and what they’re doing in GRC. Specifically, we’re going to be looking at their Cyber Risk Exposure Management or CREM solution. The problem they’re addressing with this is a lack of visibility into your assets.

It’s a big one. It seems to be coming up all the time on our CISO Series Podcast rundowns. And helping us get some answers to these questions are Krista Arndt, associate CISO over at St. Luke’s University Health Network, and Brett Conlon, CISO at American Century Investments.

So, Krista, let me start with you. Why is asset visibility still such a problem? 

[Krista Arndt] I mean, everybody is running in some sort of fragmented environment, everybody [Laughter] has that shadow IT problem, and the risk and number and type of assets in your environment is constantly changing because of the user end. So, really it comes down to a short blurb is you can’t protect what you don’t know.

[Rich Stroffolino] Too true, too true. Brett, I’m going to come to you here. Same sentiments as Krista here? I mean, why are we still struggling? This seems like a pretty table stakes thing, asset visibility. Why is it still a problem? 

[Brett Conlon] I think just what Krista said. It was a problem when everything was pretty solid and just sort of deployed to the environment. Now you have resources that spin up for seconds and spin back down. And so it becomes a very hard to understand what that dynamic environment looks like, especially with tools that are more hourly-based, scan-based, or stagnant-based versus continuous.

[Rich Stroffolino] All right. Well, today we’re going to be talking with Franz Fiorim, field CTO over at Trend Micro. Now, to start out, we’re going to be answering three essential questions about CREM. So, Franz, help us out here. How do I explain the value of your solution to my CEO?

What does your solution do, what does it not do? And what is the pricing model? Can you help us out here? 

[Franz Fiorim] Of course. Thank you, Rich. So, the point is we are helping to continuously discover and prioritize cyber risk risks, right? That means across our entire attack surface. That means if you think about cloud services, you think about devices, API usage, telemetry data, and also third-party solutions, we are bringing all of those risks from those different sources, right?

And bring it to you in a way that you can discover them, predict – if possible, right? – prioritize, comply, quantify. And “comply,” when I say “comply,” it’s with different compliance frameworks, right? Quantify and mitigate – that’s a single approach in our platform.

Four, how we price it is a credit system, right? That means you apply credits for devices. So, in general, its devices can also be cloud infrastructure. So, if they’re cloud infrastructure, we also have ways that you can add your cloud provider account.

[Rich Stroffolino] Fantastic. All right. Well, CISOs, we’ve gotten a taste of this solution, at least some of the preliminaries. We’ve had the table set. I’m sure though, lots of specifics to dig into. So, Brett, I’m going to start with you. What other questions do you have for Trend Micro about CREM?

[Brett Conlon] Okay. So, first question here. I think we hear a lot about continuous real-time visibility across all assets. So, can you share a technical example of how CREM discovers the hidden assets, and what your response might be to CISOs that say complete visibility is unattainable, especially in complex environments?

[Franz Fiorim] Thank you, Brett, for sure. So, first thing, there is a couple ways that you can do it. So, imagine if you are talking about the cloud environment, so we have native integration with your cloud provider. That means I’m talking about Google Cloud, AWS, Oracle Cloud, Azure, and Ali Cloud.

So, of those different cloud providers, we can bring the asset list. It could be fully agentless, right? Can also be through network discovery. That means we have a sensor that is scanning your network, checking what’s there, and also can bring information.

Could be on-premise or could be in the cloud. We also have our agents. That means our agent that you have installing your services. And also third-party integration, so it could be, for example, Microsoft Entra, could be Active Directory on-premise, could be LDAP, could be ServiceNow, could be Jira.

So, all of those different sensors, different micro-sensors could bring that information or can also rely on third-party integration. 

[Rich Stroffolino] All right. Krista, I know you’ve got some questions here. What other questions do you have about CREM? 

[Krista Arndt] Franz, I like that you ended with the third-party stuff because that’s near and dear to my heart. So, a lot of the tools and resources that I’ve used for third-party, it doesn’t give you that contextual data until days later, let’s say after a breach occurs, for example, and it’s been validated to be true.

So, how do you use contextual intelligence to help give more near-real-time visibility to your third parties and supply teams that do control the assets that you don’t have control under to give you a better stance at maybe severing connection or responding to an incident?

[Franz Fiorim] Thank you for the question, Krista. So, first thing, again, we have the native API integration. That means if you have any kind of let’s say you are tracking integrations with your GitHub repository, or maybe your developers are pushing a new code, right?

We can grab, “Oh, let me think about the pipeline,” right? And if you are using additional service, maybe inside your code, you have API to a third-party service, right? We are also mapping out that specific one. So, in general, there is a couple ways.

One is native integration to the API of the service. We can also do log collection. So, that means imagine it’s a third-party solution that we don’t have a native integrated system, right? Or it could be that they don’t have API that we can build it.

You can also forward the logs to us. The good thing about it, we are ingesting any kind of new source in maximum three hours. So, even if the source that we don’t know was never an integration with Trend Micro, we can ingest those logs in maximum three hours, since you start seeing it, right?

[Krista Arndt] And that actually makes me think of, and I don’t want to commandeer this, but think about healthcare and when you talk about third-party assets and asset visibility. We have some pretty distinct restrictions on the visibility that we can get due to agents and things like that for medical devices.

And the medical devices, there’s something that just came out about software bill of materials requirements that are going to be pushed here. I mean, how do you help us to maintain adequate visibility to those, considering you can’t install anything on medical devices?

So, how can you help with that? 

[Franz Fiorim] Yeah, for sure. So, the first thing is you can forward all of those events, so audit logs, application logs, to us, so we can ingest those specific logs. Even if you have let’s say an environment that is not allowed to communicate to internet, we can add the collector there.

You mentioned about SBOMs, right, or software bill of materials. We can also deliver a feature that you can use and generate SBOMs in the asset or in a container, for example. So, we are using, again, don’t want to go too detailed in the format, but we are using CycloneDX.

It’s a common format for SBOMs, but we can also ingest those specific SBOMs and do correlations, right? It’s very important not only to have your, again, list of all of the libraries that you’re using, software, and also to track vulnerabilities. That is also one of the topics about risks, right?

[Krista Arndt] Yeah, I think another thing, just thinking vulnerabilities and the assets that maybe some vulnerability scanners can’t get access to and how you get visibility to those. I mean, you can maybe deal with Windows devices on PCs, but you can’t deal with Apple and those types of things, and to have something to do that comprehensively would be critically important.

[Franz Fiorim] Yeah, again, as I mentioned, right? So, there’s a couple ways that we can do vulnerability scanning. Could be fully agentless if you are running the cloud provider. Could be with our agent, right? That means we have an agent that’s including four different platforms.

So, Linux with different flavors of Linux. Could be with Windows, with macOS. We can also do any kind of binary, right, because we can also do what we call artifact scanning. So, we can scan the specific binary, and we can check if there’s any kind of vulnerability or not.

And again, if you already have a vulnerability management tool, so let’s say Qualys, Rapid7, or any other, we can also ingest that information in our own platform, and you can do the correlation. The correlation here is important not to bring if the CVS score is 7, 8, or 10.

It’s also check if there’s any kind of exploit available in the wild and also check how easy it is to do, let’s say, the exploitation’s specific vulnerability. And if you implement any kind of mitigation, maybe it’s behind a firewall, maybe it’s behind IPS, so we also need to consider it to give you the right risk base on that, right?

[Brett Conlon] Can I elaborate a little bit on that is it looks like you’re taking sort of the external attack surface management, then you’re bringing in sort of cloud security posture management and vulnerability remediation management all into one tool.

How does that consolidation work in practice? Are there still scenarios where you feel that the standalone tool, like a Rapid7 or a Qualys, outperform CREM’s integrated approach? 

[Franz Fiorim] So, a few things, right? We can do the integration. So, if the users, again, is more familiar with a specific tool, they can bring that information to our data lake, our platform, but there is not a need. So, if you want, you can use [Inaudible 00:09:15] Trend Micro native service to do the scanning for vulnerabilities, to do the correlation.

And we are discussing here about the vulnerabilities, but could be any kind of other risks, right? So, identity risk, maybe you have a user that is logging from one country, and a few minutes later for another country, right? Or it could be that, again, you see multiple logins attempting one specific server with like wrong credential.

So, all of those kind of items are risk for us. You don’t need to have multiple tools. You can consolidate with Trend Micro, but again, up to you, right? As a user, you can select, if you are more familiar with a specific little bit scanning or identity access management tool, right?

You can keep it, or you can convert everything to Trend Micro. 

[Krista Arndt] Yeah, it’s interesting. That was actually going to be my question is how the identity complexity is managed with this and beyond just kind of like physical and virtual assets, right? Like users’ roles, entitlements, access paths, like how do you integrate and kind of correlate all that or account for it?

[Franz Fiorim] Yes, so going back, so we are talking about maybe user identities, right? That means human identity, right? But it can also be cloud identity, right? Could be like automation identity, could be something that you are using for your AI.

So, we are accessing the risk of all of those specific identity, right? And could be human or not human. That is integration, again, as I mentioned before, right, with common identity manager access. So, that means Microsoft Entra, Google Cloud Identity or any other, right?

And those correlations happen in our data lake, in our backend. And you can see, “Hey, I’m seeing that Krista is logged in from this specific asset, I’m seeing this specific vulnerability in that specific asset. I’m seeing that she is logging many different applications.” So, we are bringing all of this information together.

We are correlating everything and present your risk. And up to you, so that means you can fully automate the response. That means, hey, if something happens, I want to force the password reset for that specific user, or I want to lock that user. Or you can say it’s partially automated.

That means someone is to say yes to the action, do the remediation, for example. Or you say, just log in and let my SOC team interact with it. 

[Krista Arndt] That’s important especially you mentioned AI. The agentic identities are getting really big as something to manage and to get a handle on, and I guess beyond the core best practices of service account, identity management, to be able to touch on that would be really important as well for everybody right now.

[Franz Fiorim] For sure. And again, when you say AI, you are using like AI service for a cloud provider like AWS, Bedrock, right? You can also maybe have some models running on-premise. So, how can you also evaluate those specific models that are running in your on-premise environment or the environment you’re hosting and make sure that these specific models don’t present a risk for you, right?

So, it’s, again, when we say AI and the risk in AI, it’s not only the cloud provider infrastructure, it could be also some place that you are hosting, including your on-premise service. So, how can you evaluate the risk in those specific models? 

[Rich Stroffolino] We’ve got time for one more question. Brett, did you want to have the last word here? 

[Brett Conlon] Yeah, if it’s okay, I want to shift gears just a little bit because everyone’s friend is compliance. And I noticed that you mentioned about how you sort of bring that effortless compliance with standards like NIST and GDPR. How does CREM sort of simplify the compliance compared to what we’re probably used to in the manual process?

And what’s the response to companies like myself that are heavily regulated and are worried about sort of overreliance on automated compliance tools? 

[Franz Fiorim] For sure. I think compliance is always challenging, right, for everyone. I remember when I was a customer, right? We had to deal with spreadsheets, and we’ll take like every time that auditor comes to me was like, oh, it would take like days or weeks to answer that specific one.

One thing that we can realize, we are automating using the APIs. So, most of the times we can collect information from the APIs and all of the service that you have already integrated with. That means it’s a good thing. You can automate a lot of items.

There is some things that you cannot automate. That means require some specific interaction with the user. So, we can automate. That means the person can ask information. We have what we call a companion. It’s a chatbot inside the platform. 

So, if, for example, we cannot collect that information from a specific integration or documentation that you already uploaded, it will give you the information and then we need to go and do some manual steps. But the good thing, it will also help you to keep a knowledge base.

So, if that question surfaces again, you can also rely on this knowledge base. If you don’t have the information, can also create the tickets to someone to help you to answer that one or a third-party person, right? But good thing is we are trying to mapping everything.

Again, if you have, for example, a cloud provider, we can bring that through the APIs. If you have a third-party solution, maybe we can collect from the APIs, and we can also ingest audit logs. So, we also help you with a couple requirements. 

[Brett Conlon] Awesome.

[Rich Stroffolino] All right. Well, Franz, what’s one thing we didn’t ask about that we need to know? 

[Franz Fiorim] I think first thing, it’s Trend Micro Vision One is a huge platform, right? We are talking about one specific topic, the cyber risk. But again, be aware, Trend Micro’s a company that is in the market, the cybersecurity space for 37 years, right?

And we have a lot of different tools. But talking about specific, about risk. So, just remember, so the way that you are approaching is a way that you can continuous assess the risk, right? So, continuous assess everything, make sure that we identify the risks.

You can also predict if something happens. So, if those three, let’s say, items match, so you have a S3 bucket that everyone can access. If you have in that specific same environment, you have maybe a EC2 machine that can read the RDS database. So, we are mapping everything and say, “Hey, this could be an issue in the future.

So, pay attention right now before it happens.” Prioritize, so make sure that we are also creating score. And compliance, as we mentioned before, quantify the issue because like one thing is for the technical folks say, “Hey, this is a risk between 50 of 100, right?” But how about quantifying the way that you can see values, right?

That means if that happened, we can lost maybe 100,000, right? So, what can happen with that one? So, also a way that you can monetize if something happens, right? And also mitigate that could be, again, fully automated, partially automated, or could be manual.

[Rich Stroffolino] Well, that’s just about it for this episode of Security You Should Know. To learn more, head on over to trendmicro.com. And if you have any feedback or questions, send them over to us at feedback@CISOseries.com. A huge thank you to Krista Arndt and Brett Conlon for helping us learn more about what Trend Micro is doing, and a big thanks to Franz Fiorim for your time and being game to answer all of these questions, and thank you for listening to Security You Should Know.

[Voiceover] That wraps up another episode of Security You Should Know. If you like this program, please subscribe, tell your friends, and leave us a review. All companies showcased on this program are sponsors of CISO Series. If your company would like to be spotlighted and interviewed by our security leaders, go to our contact page on CISOseries.com or just email us at info@CISOseries.com.

Thank you for listening to Security You Should Know, connecting security solutions with security leaders.