Cytix Value Propositions Flashcards
How do we define Cytix
Specifically the product
As stated on our website
A continuous testing platform for application security teams
What does Cytix promise to do for customers?
As stated on our website
Threat model live development tickets & prioritise your security testing plan
Name two security benefits of automatically threat modelling live development tickets
1) Increasing visibility on development changes they didn’t know were happening; typically minor changes pass the need to be security checked, which allows vulnerabilities to slip through the net
2) Giving confidence that the right tests and actions are happening for every change, to ensure coverage of all relevant vulnerabilities
We can integrate into any development ticketing system… How many can you name?
There are 8 listed in the answer
Try to name at least thee top 3
Jira
Azure DevOps (ADO)
Linear
Notion
ServiceNow
ManageEngine
Trello
Monday
In order of popularity
Jira is used by over 50% of our customers
Unlike most competitors, we offer a hybrid of what two forms of security testing?
Manual penetration testing and automated DAST scanning
The main benefit of offering the hybrid is that it means we can identify which type of vulnerability more reliably?
Business logic flaws
“Identity and access management issues” and “complex injection flaws” ar
How long does it take for us to threat model a development ticket?
An average of 13 - 30 seconds
From identifying a change to completing all testing, how long does it typically take us?
Including threat modelling the ticket and delivering the testing
2-3 days
What is a micro-pentest?
Think of the “Three As”
Testing A particular area of An Application for A specific set of vulnerabilities
How long does a micro-pentest take to complete?
Including only the actual time spent testing
Between 15 minutes and 2 hours
What are the main limitations of traditional (baseline) penetration testing?
It is slow and laborious, and therefore expensive
Most businesses are only able to perform the testing once per year
This leads to vulnerabilities going undetected for a long time
SAST and DAST are unable to identify roughly ____ % of recognised classes of security vulnerability
This is supported by research done with Lancaster University
25%
Why might poor quality output from automated tooling create friction inside a business?
It frustrates development teams who are expected to remediate false positives and findings based on limited information
Who do we see as our biggest competitors?
We operate in quite a unique space where we don’t really have major competitors, however our customers are often comparing us to their existing penetration testing and scanning suppliers
There are companies like SnyAck and CovertSwarm also trying to solve the continuous testing challenge
Cytix is capable of finding security vulnerabilities in Cloud Infrastructure
True or False?
False
We are exclusively focused on application security
How can companies better understand the value Cytix provides?
We offer a low-burden proof of concept
As well as our change analysis tool on our website
