Search results

A gross dollar retention rate of over 90% and 36% year-over-year new business growth highlight adoption across industries AlgoSec’s Horizon Platform Fuels Company Growth and Global Application-Centric Security A gross dollar retention rate of over 90% and 36% year-over-year new business growth highlight adoption across industries September 9, 2025 Speak to one of our experts RIDGEFIELD PARK, NJ, September 9, 2025 – AlgoSec , a global cybersecurity leader, today announced a gross dollar retention rate of over 90% in the first half of 2025, following the launch of its AlgoSec Horizon platform. Since its release, the Horizon platform has gained adoption across industries, underscoring the market need for convergence of cloud and on-premises networks. This widespread adoption has driven a 36% increase in new annual recurring revenue (ARR) in the first half of 2025 compared to 2024. The Horizon platform utilizes advanced AI capabilities to automatically discover and identify an organization’s business applications across complex hybrid networks, and remediate risks more effectively. Its Intelligent automation minimizes misconfigurations and enhances operational resilience to accelerate application delivery from weeks to hours. In one such example, one of the largest financial institutions in the U.S. uncovered 1,800 applications and their connectivity requirements within the first two weeks of using Horizon. Throughout September and October, AlgoSec is running the Horizon Tour, a series of sessions showcasing the platform’s capabilities and expert insights for enterprise security teams across EMEA and the U.S. “Security teams today are being asked to protect applications in a hybrid world, from multi-clouds to datacenters globally,” said Chris Thomas , Chief Revenue Officer at AlgoSec. “We’re excited about our early 2025 successes and our evolving AlgoSec solutions which will help us meet our mission to enable the world’s most complex organizations to gain visibility, reduce risk and process changes. To hear first-hand AlgoSec’s strategic direction and product innovation roadmap, join us for our annual virtual AlgoSummit event on September 30.” To learn why over 2,200 of the world's most complex organizations trust AlgoSec to help secure their most critical workloads, visit www.algosec.com . About AlgoSec AlgoSec, a global cybersecurity leader, empowers organizations to securely accelerate application delivery up to 10 times faster by automating application connectivity and security policy across the hybrid network environment. With two decades of expertise securing hybrid networks, over 2200 of the world's most complex organizations trust AlgoSec to help secure their most critical workloads. AlgoSec Horizon platform utilizes advanced AI capabilities, enabling users to automatically discover and identify their business applications across multi-clouds, and remediate risks more effectively. It serves as a single source for visibility into security and compliance issues across the hybrid network environment, to ensure ongoing adherence to internet security standards, industry, and internal regulations. Additionally, organizations can leverage intelligent change automation to streamline security change processes, thus improving security and agility. Learn how AlgoSec enables application owners, information security experts, SecOps and cloud security teams to deploy business applications faster while maintaining security at www.algosec.com . MEDIA CONTACT: Megan Davis Alloy, on behalf of AlgoSec [email protected]

Explore Algosec's customer success stories to see how organizations worldwide improve security, compliance, and efficiency with our solutions. Leading Bank Transforms Digitalization Journey With AlgoSec Organization Leading Bank Industry Financial Services Headquarters United States Download case study Share Customer
success stories "AlgoSec is like a person sitting in my bank taking care of everything - simplifying day-to-day operations and reducing human errors because everything is automated.” Background Background The bank is a full-service commercial bank headquartered in India. It offers a wide range of banking and financial products for corporate and retail customers through retail banking and asset management services. The bank offers personal, corporate, and internet banking services including accounts, deposits, credit cards, home loans, and personal loans. The Challenges The client’s key issues related to the management of the firewalls, dealing with rule duplication and human errors. Their network security operations teams were hampered by manual, slow, and error-prone security change-management processes. It often took around four days to process a single change across their complex network environment. The frequent errors that arose from manual processes opened security gaps and put them at risk of cyberattacks. Some of their challenges included: Human errors leading to misconfiguration – The organization was handling over 30 firewalls and 30 to 40 rules in a day across multiple firewalls. They lacked the skilled resources to implement these rule changes. This led to errors and misconfigurations. Lack of visibility – They lacked visibility into their overall network and traffic flows and failed to understand which rules applied to each firewall. Duplicate rules – They had many duplicate firewall policies, negatively impacting performance. Policy optimization – The organization required policies to be frequently optimized. Lack of visibility – The organization needed visibility across their networks, allowing them to quickly find and fix issues. Time-consuming manual change management processes. Solution The organization looked for a partner that understood their challenges, could integrate into their existing solutions, and could take full responsibility for any issues. In the words of the bank’s executive vice president, “ We were looking for a partner, not a product.” The key factors that the bank was looking for were: Alignment with their digital transformation vision – They wanted to align with key stakeholders among business, operations, network, and security teams. Automation as a key focus – Automation was important to reduce human errors, align with the considerable number of requests and adapt to the agile nature of critical applications. With automation, they were looking to implement firewall changes faster. Easy to use and integrate within the existing infrastructure. Unified view of their multi-vendor firewall estate – They wanted a single console where they could see all their firewalls, understand their collective risk, and gain a holistic view of the current state of their firewall policies. As a result, the customer implemented the AlgoSec Security Management Solution. Results: The AlgoSec Security Management Solution transformed the bank’s digitalization journey, leading to: Time to implement rule changes decreased from 4-5 days to less than 48 hours – a 60% reduction. Automatically implemented changes – Changes are automatically implemented, without needing to guess which rules and devices are in path. Reduced human error and elimination of repetitive, manual tasks. Simplified daily operations. Automated change management across application-centric infrastructure. Identified and mitigated risks. Transformed digitization journey. AlgoSec now has end-to-end visibility of which firewall it needs to implement the changes on. The bank was in the process of switching from a traditional infrastructure to Cisco ACI. The transition was smooth. AlgoSec seamlessly integrated into Cisco ACI and their existing Palo Alto Network devices. “I think we are the first in India who approached AlgoSec and got these solutions implemented – getting Cisco ACI, Palo Alto, and AlgoSec working hand in hand with full integration. This is the best thing we’ve seen till now,” noted the vice president. Looking ahead, they plan to extend AlgoSec’s offering, mapping rule applications, and other capabilities to help them migrate to the cloud. Schedule time with one of our experts

DevOps security connectivity management allows for better cooperation between security DevOps Use AlgoSec to ensure secure, compliant development environments Click here for more! Optimizing DevOps: Enhanced release quality and faster time-to-market Select a size Which network Can AlgoSec be used for continuous compliance monitoring? Yes, AlgoSec supports continuous compliance monitoring. As organizations adapt their security policies to meet emerging threats and address new vulnerabilities, they must constantly verify these changes against the compliance frameworks they subscribe to. AlgoSec can generate risk assessment reports and conduct internal audits on-demand, allowing compliance officers to monitor compliance performance in real-time. Security professionals can also use AlgoSec to preview and simulate proposed changes to the organization’s security policies. This gives compliance officers a valuable degree of lead-time before planned changes impact regulatory guidelines and allows for continuous real-time monitoring. What is DevOps security management? Key pain points in securing your CI/CD pipeline Streamlined security, compliance, and faster deployments Speeds up application delivery without compromising security Empower your DevOps workflow with seamless connectivity integration Lock down container security with smart threat management Key benefits of using AlgoSec Get the latest insights from the experts DevOpsifying Network Security Watch video Integrate Security Into DevOps for Faster, Safer Application Delivery Into Production Read document Best Practices for Incorporating Security Automation into the DevOps Lifecycle Watch video Schedule time with one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Continue

Explore Algosec's customer success stories to see how organizations worldwide improve security, compliance, and efficiency with our solutions. TECHCOMBANK SAVES TIME AND RESOURCES WITH SIMPLIFIED FIREWALL POLICY MANAGEMENT Organization Techcombank Industry Financial Services Headquarters Hanoi, Vietnam Download case study Share Customer
success stories "AlgoSec enables us to identify ways to consolidate and optimize rules and perform deep risk analysis and automate workflows in ways that other products cannot match" Background Techcombank is one of the largest joint stock commercial banks in Vietnam. With more than 300 branches and 7,000 staff, Techcombank provides deposit products, loans, leasing, cash management and other services to more than 3.3 million individual customers and 45,000 corporate clients. Challenge Tens of firewall devices and hundreds of routers and switches protect the financial data of Techcombank’s customers, as well as the operations of hundreds of branches throughout Vietnam. As a bank, all security policies and firewall configurations must comply with PCI-DSS and ISO27001 standards. Ensuring compliance, however, created ongoing headaches for the IT security team. “With equipment from many different vendors, even simple policy audits were challenging tasks,” says Mr. Van Anh Tuan, CSO of Techcombank. “As a result of the diversity of products and lack of visibility, it was difficult for us to monitor changes to rule configurations in real time in order to maintain internal security compliance as well as PCI compliance.” “Cleaning up and fine tuning firewall policies was a particularly complex process, which made it difficult to respond quickly to the changing needs of our business applications,” adds Mr. Tuan. “We wanted a way to optimize and consolidate rules across all of our firewalls, regardless of manufacturer, and completely automate the end-to-end workflow for firewall rule change management.” In addition, Techcombank sought a solution that would simplify the process of conducting risk analysis, evaluating PCI compliance and identifying the necessary steps for remediation. Solution Following an in-depth competitive evaluation, Techcombank selected AlgoSec’s Security Management solution. “AlgoSec met many of our key requirements, better than its competitors in our evaluation,” Mr. Tuan notes. Techcombank particularly liked AlgoSec’s superior security policy analysis and ability to make actionable recommendations with a high level of accuracy. “AlgoSec will enable us to identify ways to consolidate and optimize rules, perform deep risk analysis, automate workflows and ensure compliance in ways that other products cannot match,” says Mr. Tuan. Techcombank’s IT team wants to be able to quickly identify security policy risks and see what specific steps they need to take for remediation. The bank uses AlgoSec to identify overly permissive firewall rules based on actual use as well as duplicate, unused and expired rules and objects. This information gives Techcombank the data they need to close off potential access points and help prevent attacks. AlgoSec also provides clear, detailed recommendations on how to best reorder rules for optimal firewall performance. In addition, AlgoSec validates firewall policy and rules against regulations such as PCI, as well as industry best practices and customized corporate policies to uncover and prioritize risks and track trends over time. For Mr. Tuan, one of the most valuable benefits of AlgoSec is the increased visibility into security policies across the full range of devices. “Now we can easily monitor our firewall operations and quickly detect any mistakes or non-compliant changes made. These operations used to be invisible to me.” Mr. Tuan comments. The AlgoSec deployment process went very smoothly for Techcombank. “Our team received training from AlgoSec and their partners here in Vietnam and we were fully utilizing the product almost immediately. Post-implementation support has addressed every issue quickly and enabled us to take advantage of all aspects of the product in order to optimize our firewall rules and improve our security posture even faster than we anticipated,” Mr. Tuan adds. Since implementation, AlgoSec has enabled Techcombank’s IT team to “greatly reduce our time and resources when complying with internal policies and PCI standards, and when monitoring changes in rules,” says Mr. Tuan. “We are very happy with the improved security and visibility provided by AlgoSec and will continue to use and exploit more AlgoSec features and add licenses,” he concluded. Schedule time with one of our experts

Security Policy Management with Professor Wool Network Security for VMware NSX Network Security for VMware NSX with Professor Wool is a whiteboard-style series of lessons that examine the some of the challenges of and provide technical tips for managing security policies across the VMware NSX software-defined data center and traditional data center. Lesson 1 VMware’s NSX enables datacenter owners to secure East-West traffic using filtering policies that are enforced by the VMware infrastructure. However, migrating from existing traditional filtering technologies to VMware NSX can be a daunting task. In this lesson Professor will discuss why it’s important to understand the motivations for a migration to NSX in order to successfully plan and implement the actual migration to the VMware NSX platform. Migrating to NSX: Understanding the Why in Order to Figure Out the How Watch Lesson 2 When setting up an NSX data center you need to write filtering policies for any traffic that goes into an NSX data center, exits from it, or moves between different servers inside the NSX data center. In this lesson, Professor Wool recommends a multi-stage process to help users write secure and effective policies for east East-West traffic. Tips on How to Create Filtering Policies for NSX Watch Lesson 3 Once the NSX environment is up and running it needs to be part of the organization’s network security policy change process, and subject to the organization’s governance, audit, and regulatory compliance requirements. In this lesson Professor Wool discusses how to approach managing changes, auditing and compliance when the security team doesn’t ‘own’ the virtual environment. Best Practices for Bringing NSX Security Policy Management into the InfoSec Fold Watch Have a Question for Professor Wool? Ask him now Choose a better way to manage your network Choose a better way to manage your network Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Continue

Learn how Google Cloud and AlgoSec solutions help companies improve visibility and reduce risk in large complex hybrid networking environments Webinars Hybrid Cloud Security with Google and AlgoSec Learn how Google Cloud and AlgoSec solutions help companies improve visibility and reduce risk in large complex hybrid networking environments Learn how Google Cloud and AlgoSec solutions help companies improve visibility and reduce risk in large complex hybrid networking environments November 15, 2023 Faye Feng Product Manager at Google Ava Chawla Global Head of Cloud Security Relevant resources Why misconfigurations continue to plague public cloud network services and how to avoid them? Keep Reading Security policy management for the hybrid cloud environment Read an Ebook Choose a better way to manage your network Choose a better way to manage your network Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Continue

Proper firewall configuration is essential for a secure network Explore how to overcome challenges and learn tips for effective firewall configuration What is Firewall Monitoring? Select a size Which network Can AlgoSec be used for continuous compliance monitoring? Yes, AlgoSec supports continuous compliance monitoring. As organizations adapt their security policies to meet emerging threats and address new vulnerabilities, they must constantly verify these changes against the compliance frameworks they subscribe to. AlgoSec can generate risk assessment reports and conduct internal audits on-demand, allowing compliance officers to monitor compliance performance in real-time. Security professionals can also use AlgoSec to preview and simulate proposed changes to the organization’s security policies. This gives compliance officers a valuable degree of lead-time before planned changes impact regulatory guidelines and allows for continuous real-time monitoring. What is firewall monitoring? The importance of firewall monitoring for modern network security Key features & capabilities of firewall monitoring tools and solutions What to look for in a firewall monitoring solution? 5 Common firewall monitor challenges FAQ How does AlgoSec help with firewall monitoring? Get the latest insights from the experts Schedule time with one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Continue

Learn how firewall rules secure your network from cyber threats. Explore types, best practices, and management strategies to optimize your firewall security. Firewall rules & requirements (inbound vs. outbound) ---- ------- Schedule a Demo Select a size ----- Get the latest insights from the experts Use these six best practices to simplify compliance and risk mitigation with the AlgoSec platform White paper Learn how AlgoSec can help you pass PCI-DSS Audits and ensure continuous compliance Solution overview See how this customer improved compliance readiness and risk management with AlgoSec Case study Choose a better way to manage your network

As with all cloud vendors, AWS users share responsibility for securing their infrastructure against risk. Amazon provides the tools you... AWS Security group architecture for AWS: How to overcome security group limits Prof. Avishai Wool 2 min read Prof. Avishai Wool Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 8/9/23 Published As with all cloud vendors, AWS users share responsibility for securing their infrastructure against risk. Amazon provides the tools you need to filter traffic, but configuring those tools is up to you. Firewalls are one of the tools you’ll use to filter traffic and secure Virtual Private Cloud (VPC) instances. Instead of using traditional firewalls, Amazon provides users with AWS security groups, which are flexible, stateful firewalls capable of filtering inbound and outbound traffic. However, there are limits to what you can do with AWS security groups. First, they only allow traffic – you can’t configure them to deny traffic. Second, the maximum number of rules you can set for a single group is 60. This isn’t a big issue for an Amazon EC2 instance designed to address inbound traffic. You’ll either want your AWS EC2 to accept ingress from the entire internet or you’ll want to configure access for a few internal IP addresses. But for outbound traffic, 60 rules simply isn’t enough. You’ll use a dozen of them just allowing access to GitHub’s API . Add in a few third-party partners and you’re already well past the limit. Amazon VPC resource limits explained Amazon sets clear limits on the AWS services and resources it makes available to users. In some cases, you can increase these limits by contacting AWS support. These limits are generally assessed on a per-Region basis. Here are some of the limits Amazon places on AWS users: Security group limits 2500 VPC security groups per Region 60 IPv4 rules per security group 60 IPv6 rules per security group 5 security groups per network interface VPC and subnet limits 5 VPCs per Region 200 Subnets per VPC 5 IPv4 CIDR blocks per VPC 5 IPv6 CIDR blocks per VPC Limits to elastic IP addresses and gateways 5 Elastic IP addresses per Region 2 Elastic IP Addresses per public NAT gateway 5 Egress-only internet gateways per Region 5 NAT gateways per Availability Zone One carrier gateway per VPC Prefix list limits 100 prefix lists per Region 1000 versions per prefix list 5000 prefix list references per resource type Network ACL limits 200 Network ACLs per VPC 20 Rules per Network ACL How to manage AWS cloud security group limits effectively Traditional firewalls may have thousands of security rules, including a complex combination of inbound rules and egress filters. Crucially, they can also enforce outbound rules that include denying traffic – something Amazon does not allow regular security groups to do. While AWS offers powerful tools for securing cloud workflows, Amazon VPC users must find ways to overcome these limitations. Fortunately, there are a few things you can do to achieve exactly that. Optimize your VPC security groups. Use Network Access Control Lists to secure assets at the subnet level. Use a domain name filtering system that reduces the number of IP addresses security group rules need to resolve. Optimize your Amazon virtual private cloud configuration Amazon VPC is a virtual network that contains many of the elements you’d expect from a traditional network. It has IP addresses, route tables, subnets, and internet gateways. Unlike a traditional network, you can easily configure many of your VPC environment through a command line interface (CLI). You can establish VPC peering connections, implement identity and access management (IAM) protocols, and configure elastic network interfaces without manually handling any hardware. But first, you need to set up and protect your VPC by setting up and configuring security groups. If you don’t specify a particular group, Amazon EC2 will use the default security group. If you haven’t added new security groups since creating your AWS account, you may only have that one default security group. The first step to optimizing security is expanding the number of security groups you have available. Here’s an example of the code you can use to create a new security group in the AWS console:aws ec2 create-security-group –group-name web-pci-sg –description “allow SSL traffic” –vpc-id vpc-555666777 This creates a new group named web-pci-sg and describes it as a group designed to allow SSL traffic on the network. Remember that security groups don’t support deny rules. Here is the code you would use to add a rule to that group: aws ec2 authorize-security-group-ingress \ –group-name web-pci-sg \ –protocol https \–port 443 \ –cidr This rule specifically allows SSL traffic using the HTTPS protocol to use port 443, which is the standard port for HTTPS traffic. You can use the last argument to specify the cidr block the rule will direct traffic through. This gives you the ability to manage traffic through specific subnets, which is important for the next step. This example focuses on just one type of rule in one context. To take full advantage of the security tools AWS makes available, you’ll want to create custom rules for endpoints, load balancers, nat gateways, and more. Although you’re limited to 60 rules per security group, creating many groups lets you assign hundreds of rules to any particular instance. Security architecture and network ACLs Network Access Control Lists provide AWS users with additional filtering capabilities. Network ACLs are similar to security groups in many ways, but come with a few key differences: Network ACLs can contain deny rules. You can write Network ACL rules to include explicit actions, like blocking particular IP addresses or routing VPN users in a specific way. Network ACLs are enforced at the subnet level. This means they apply to every instance in the subnet, in addition to whatever rules exist at the security group level. As mentioned above, each Network ACL can contain up to 20 rules. However, you can have up to 200 Network ACLs per VPC, which gives you a total of 4000 potential rules. Along with instance-specific security group rules, this offers much more flexibility for setting up robust AWS security architecture. Since Network ACLs can deny traffic, they are a useful tool for managing access to databases and other sensitive assets. For example, you may wish to exclude users who don’t have the appropriate permissions from your Amazon RDS instance. You may also want to filter SSH (Secure Shell) connections coming from unknown sources, or limit connections between different internal instance types. To do this effectively, you need to group these assets under the same subnet and make sure that the appropriate rules are enabled for all of them. You can also write asset-specific rules at the security group level, ensuring every asset has its own optimal configuration. The larger your AWS environment is, the more complex this process may become. Take care to avoid misconfigurations – it’s very easy to accidentally write security group rules and Network ACL rules that aren’t compatible, or that cause problems when you access the instance. To avoid this, try to condense your rules as much as possible. Avoid limits by filtering domain names directly Although you can create a large number of rules by creating additional security groups, you still may want to add more than 60 rules in a single group. There are many scenarios where this makes more sense than arbitrarily adding (and managing) new groups. For example, you might have a production instance that needs updates from several third-party partners. You also need to periodically change and update the technologies this instance relies on, so you’d like to keep its rules in a single security group. This reduces misconfiguration risk by keeping all the relevant rules in one place – not spread out across multiple groups. To overcome this limit, you need to reduce the number of IP addresses that the security group filters. You can do this by deploying a third-party solution that allows security rules to perform DNS resolution. This eliminates the need for AWS to resolve the domain name. Since AWS security groups can’t compute domain names on their own, you’ll need to deploy a third-party NAT gateway on your public VPC to filter outbound traffic in this way. Once you do this, you can write rules that filter outgoing connections based on their domain name. This effectively bypasses the 60 IP limit because you are not referring to specific IP addresses. At the same time, it simplifies management and makes rules much easier to read and understand. Instead of looking up and adding all of Github’s API IP addresses, you can write rules that reference the domain “Github.com”. If Github decides to change its IP infrastructure, your security rules will automatically reference the new addresses – you won’t have to go back and update them. The earlier you address AWS security group limits, the better There is an unlimited number of ways you can arrange your security groups and Network ACLs. Even in a small environment, the prospect may seem daunting. However, the flexibility Amazon provides to its cloud users is a valuable security feature. Those who go the process enjoy clear security performance benefits. If you start to planning for the architecture of your security and filtering policies early, you’ll be better equipped to scale those policies upwards as your organization grows. This will prevent security processes from becoming a growth bottleneck and maintain a high level of efficiency even as those policies become larger and more complex. See me explain this issue in person in my new whiteboard video: Schedule a demo Related Articles 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read 5 Multi-Cloud Environments Cloud Security Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

While we optimistically hoped for normality in 2021, organizations continue to deal with the repercussions of the pandemic nearly two... Risk Management and Vulnerabilities Cybersecurity predictions and best practices in 2022 Prof. Avishai Wool 2 min read Prof. Avishai Wool Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 2/8/22 Published While we optimistically hoped for normality in 2021, organizations continue to deal with the repercussions of the pandemic nearly two years on. Once considered temporary measures to ride out the lockdown restrictions, they have become permanent fixtures now, creating a dynamic shift in cybersecurity and networking. At the same time, cybercriminals have taken advantage of the distraction by launching ambitious attacks against critical infrastructure. As we continue to deal with the pandemic effect, what can we expect to see in 2022? Here are my thoughts on some of the most talked about topics in cybersecurity and network management. Taking an application-centric approach One thing I have been calling attention to for several years now has been the need to focus on applications when dealing with network security. Even when identifying a single connection, you have a very limited view of the “hidden story” behind it, which means first and foremost, you need a clear cut answer to the following: What is actually going on with this application? You also need the broader context to understand the intent behind it: Why is the connection there? What purpose does it serve? What applications is it supporting? These questions are bound to come up in all sorts of use cases. For instance, when auditing the scope of an application, you may ask yourself the following: Is it secure? Is it aligned? Does it have risks? In today’s network organization chart, application owners need to own the risk of their application; the problem is no longer the domain of the networking team. Understanding intent can present quite a challenge. This is particularly the case in brownfield situations, where hundreds of applications are running across the environment and historically poor record keeping. Despite the difficulties, it still needs to be done now and in the future. Heightening ransomware preparedness We’ve continued to witness more ransomware attacks running rampant in organizations across the board, wreaking havoc on their security networks. Technology, food production and critical infrastructure firms were hit with nearly $320 million of ransom attacks in 2021, including the largest publicly known demand to date. Bad actors behind the attacks are making millions, while businesses struggle to recover from a breach. As we enter 2022, it is safe to expect that a curbing of this trend is unlikely to occur. So, if it’s not a question of “will a ransomware attack occur,” it begs the question of “how does your organization prepare for this eventuality?” Preparation is crucial, but antivirus software will only get you so far. Once an attacker has infiltrated the network, you need to mitigate the impact. To that end, as part of your overall network security strategy, I highly recommend Micro-segmentation, a proven best practice to reduce the attack surface and ensure that a network is not relegated to one linear thread, safeguarding against full-scale outages. Employees also need to know what to do when the network is under attack. They need to study, understand the corporate playbook and take action immediately. It’s also important to consider the form and frequency of back-ups and ensure they are offline and inaccessible to hackers. This is an issue that should be addressed in security budgets for 2022. Smart migration to the cloud Migrating to the cloud has historically been reserved for advanced industries. Still, increasingly we are seeing the most conservative vertical sectors, from finance to government, adopt a hybrid or full cloud model. In fact, Gartner forecasts that end-user spending on public cloud services will reach $482 billion in 2022. However, the move to the cloud does not necessarily mean that traditional data centers are being eliminated. Large institutions have invested heavily over the years in on-premise servers and will be reluctant to remove them entirely. That is why many organizations are moving to a hybrid environment where certain applications remain on-premise, and newly adopted services are predominantly transitioning to cloud-based software. We are now seeing more hybrid environments where organizations have a substantial and growing cloud estate and a significant on-premise data center. All this means that with the presence of the old historical software and the introduction of the new cloud-based software, security has become more complicated. And since these systems need to coexist, it is imperative to ensure that they communicate with each other. As a security professional, it is incumbent upon you to be mindful of that; it is your responsibility to secure the whole estate, whether on-premise, in the cloud, or in some transition state. Adopting a holistic view of network security management More frequently than not, I am seeing the need for holistic management of network objects and IP addresses. Organizations are experiencing situations where they manage their IP address usage using IPAM systems and CMDBs to manage assets. Unfortunately, these are siloed systems that rarely communicate with each other. The consumers of these types of information systems are often security controls such as firewalls, SDN filters, etc. Since each vendor has its own way of doing these things, you get disparate systems, inefficiencies, contradictions, and duplicate names across systems. These misalignments cause security problems that lead to miscommunication between people. The good news is that there are systems on the market that align these disparate silos of information into one holistic view, which organizations will likely explore over the next twelve months. Adjusting network security to Work from Home demands The pandemic and its subsequent lockdowns forced many employees to work from remote locations. This shift has continued for the last two years and is likely to remain part of the new normal, either in full or partial capacity. According to Reuters, decision-makers plan to move a third of their workforce to telework in the long term. That figure has doubled compared to the pre COVID period and subsequently, the cybersecurity implications of this increase have become paramount. As more people work on their own devices and need to connect to their organization’s network, one that is secure and provides adequate bandwidth, it also requires new technologies to be deployed. As a result, this has led to the SASE (Secure Access Security Edge) model, where security is delivered over the cloud- much closer to the end user. Since the new way of working appears to be here to stay in one shape or another, organizations will need to invest in the right tooling to allow security professionals to set policies, gain visibility for adequate reporting and control hybrid networks. The Takeaway If there’s anything we’ve learned from the past two years is that we cannot confidently predict the perils looming around the corner. However, there are things that we can and should be able to anticipate that can help you avoid any unnecessary risk to your security networks, whether today or in the future. To learn how your organization can be better equipped to deal with these challenges, click here to schedule a demo today. Schedule a demo Related Articles 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read 5 Multi-Cloud Environments Cloud Security Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

Cybersecurity is an ever prevalent issue. Malicious hackers are becoming more agile by using sophisticated techniques that are always... Cloud Security Prevasio’s Role in Red Team Exercises and Pen Testing Rony Moshkovich 2 min read Rony Moshkovich Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 12/21/20 Published Cybersecurity is an ever prevalent issue. Malicious hackers are becoming more agile by using sophisticated techniques that are always evolving. This makes it a top priority for companies to stay on top of their organization’s network security to ensure that sensitive and confidential information is not leaked or exploited in any way. Let’s take a look at the Red/Blue Team concept, Pen Testing, and Prevasio’s role in ensuring your network and systems remain secure in a Docker container atmosphere. What is the Red/Blue Team Concept? The red/blue team concept is an effective technique that uses exercises and simulations to assess a company’s cybersecurity strength. The results allow organizations to identify which aspects of the network are functioning as intended and which areas are vulnerable and need improvement. The idea is that two teams (red and blue) of cybersecurity professionals face off against each other. The Red Team’s Role It is easiest to think of the red team as the offense. This group aims to infiltrate a company’s network using sophisticated real-world techniques and exploit potential vulnerabilities. It is important to note that the team comprises highly skilled ethical hackers or cybersecurity professionals. Initial access is typically gained by stealing an employee’s, department, or company-wide user credentials. From there, the red team will then work its way across systems as it increases its level of privilege in the network. The team will penetrate as much of the system as possible. It is important to note that this is just a simulation, so all actions taken are ethical and without malicious intent. The Blue Team’s Role The blue team is the defense. This team is typically made up of a group of incident response consultants or IT security professionals specially trained in preventing and stopping attacks. The goal of the blue team is to put a stop to ongoing attacks, return the network and its systems to a normal state, and prevent future attacks by fixing the identified vulnerabilities. Prevention is ideal when it comes to cybersecurity attacks. Unfortunately, that is not always possible. The next best thing is to minimize “breakout time” as much as possible. The “breakout time” is the window between when the network’s integrity is first compromised and when the attacker can begin moving through the system. Importance of Red/Blue Team Exercises Cybersecurity simulations are important for protecting organizations against a wide range of sophisticated attacks. Let’s take a look at the benefits of red/blue team exercises: Identify vulnerabilities Identify areas of improvement Learn how to detect and contain an attack Develop response techniques to handle attacks as quickly as possible Identify gaps in the existing security Strengthen security and shorten breakout time Nurture cooperation in your IT department Increase your IT team’s skills with low-risk training What are Pen Testing Teams? Many organizations do not have red/blue teams but have a Pen Testing (aka penetration testing) team instead. Pen testing teams participate in exercises where the goal is to find and exploit as many vulnerabilities as possible. The overall goal is to find the weaknesses of the system that malicious hackers could take advantage of. Companies’ best way to conduct pen tests is to use outside professionals who do not know about the network or its systems. This paints a more accurate picture of where vulnerabilities lie. What are the Types of Pen Testing? Open-box pen test – The hacker is provided with limited information about the organization. Closed-box pen test – The hacker is provided with absolutely no information about the company. Covert pen test – In this type of test, no one inside the company, except the person who hires the outside professional, knows that the test is taking place. External pen test – This method is used to test external security. Internal pen test – This method is used to test the internal network. The Prevasio Solution Prevasio’s solution is geared towards increasing the effectiveness of red teams for organizations that have taken steps to containerize their applications and now rely on docker containers to ship their applications to production. The benefits of Prevasio’s solution to red teams include: Auto penetration testing that helps teams conduct break-and-attack simulations on company applications. It can also be used as an integrated feature inside the CI/CD to provide reachability assurance. The behavior analysis will allow teams to identify unintentional internal oversights of best practices. The solution features the ability to intercept and scan encrypted HTTPS traffic. This helps teams determine if any credentials should not be transmitted. Prevasio container security solution with its cutting-edge analyzer performs both static and dynamic analysis of the containers during runtime to ensure the safest design possible. Moving Forward Cyberattacks are as real of a threat to your organization’s network and systems as physical attacks from burglars and robbers. They can have devastating consequences for your company and your brand. The bottom line is that you always have to be one step ahead of cyberattackers and ready to take action, should a breach be detected. The best way to do this is to work through real-world simulations and exercises that prepare your IT department for the worst and give them practice on how to respond. After all, it is better for your team (or a hired ethical hacker) to find a vulnerability before a real hacker does. Simulations should be conducted regularly since the technology and methods used to hack are constantly changing. The result is a highly trained team and a network that is as secure as it can be. Prevasio is an effective solution in conducting breach and attack simulations that help red/blue teams and pen testing teams do their jobs better in Docker containers. Our team is just as dedicated to the security of your organization as you are. Click here to learn more start your free trial. Schedule a demo Related Articles 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read 5 Multi-Cloud Environments Cloud Security Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

Before your organization can move business applications to the cloud, it must deploy network security solutions that can reliably block... Network Segmentation Host-based firewalls vs. network-based firewalls for network security? Prof. Avishai Wool 2 min read Prof. Avishai Wool Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 8/28/23 Published Before your organization can move business applications to the cloud, it must deploy network security solutions that can reliably block cybercrime and malware. Firewalls are essential cybersecurity tools that protect network traffic against threat actors. There are many different types of firewalls available, but put the same basic principles in action. Before finding out which types of firewalls offer the best security performance for your cloud implementation, it’s important to cover how firewalls work and what characteristics set them apart. How firewalls work: Different types of firewalls explained Firewalls are best explained through analogy. Think of firewalls as 24/7 security guards with deep knowledge of millions of criminals. Whenever the security guard sees a criminal approaching an access point, they block access and turn the criminal away. This kind of access control is accomplished in a few different ways. Some firewalls inspect packets for suspicious characteristics. Others use stateful inspection to identify malicious traffic. Some incorporate contextual awareness to tell the difference between harmless traffic and cyberattacks . Here are some of the major types of firewalls and how they work: Packet filtering firewalls inspect data traveling through inline junction points like routers and switches. They don’t route data packets themselves, but compare them to a list of firewall rules. For example, they may filter packets that are traveling to untrusted IP addresses and drop them. Circuit-level gateways monitor TCP handshake data and other protocol messages for signs of unauthorized access. These firewalls don’t inspect individual packets or application layer monitoring, though. Proxy firewalls apply application layer filtering that filters data according to a wide range of characteristics. This category includes web application firewalls, which are a type of reverse proxy firewall – they protect the server from malicious traffic by filtering clients before they reach the server. Stateful inspection firewalls examine and compare multiple packets to find out if they are part of an established network session. This offers a high degree of control over incoming and outgoing traffic while providing comprehensive logs on network connections. Next-generation firewalls combine packet inspection, stateful inspection, antivirus, and additional technologies to protect organizations against unknown threats and vulnerabilities. These firewalls are expensive and have high bandwidth requirements, but they also offer a high level of protection. All of these firewalls exist in different forms. Traditional hardware firewalls are physical devices that sit between network devices and the internet. Network-based firewalls are software-defined apps designed to do the same thing. Hardware, software, or cloud? firewall deployment methods compared Organizations have multiple options when deciding to host firewalls on their private networks. The market offers a vast number of security devices and firewall providers, ranging from Cisco hardware to software solutions like Microsoft’s Windows firewall. Large enterprises use a combination of firewall solutions to adopt a multi-layered security posture. This allows them to achieve network scalability and segmentation while offering different levels of protection to data centers, individual devices, and user endpoints. As firewall technology becomes more accessible, smaller organizations are following suit. Here are some of the delivery formats that firewall solutions commonly come in: Network-based Firewalls are self-contained hardware appliances. They typically run custom operating systems using Linux distributions designed for secure computer networking. They can be challenging to configure and deploy, but are appropriate for a wide range of use cases. Host-based Firewalls run as software on a server or other device. You can run host-based firewalls on individual computers, or at the host level of a cloud environment. The firewalls offer granular control over security rules and individual hosts, but consume resources in the process. Cloud Hosted Firewalls are provided by third-party security partners as a service. These firewalls may be entirely managed by a third-party partner, making them ideal for small organizations that can’t afford building their own security infrastructure from the ground up. How to select an optimal firewall solution for your organization Every organization has a unique security risk profile. Finding the right firewall deployment for your organization requires in-depth knowledge of your network’s security vulnerabilities and potential for long-term growth. Some of the issues you have to consider include: Identifying technical objectives for individual firewalls. There are no one-size-fits-all firewall solutions. One solution may match a particular use case that another does not. Both stateless packet inspection firewalls and sophisticated next-generation solutions operate at different levels of the OSI model, which means each device should serve a well-defined purpose. Selecting firewall solutions that match your team’s expertise. Consider your IT team’s technical qualifications. If configuring a sophisticated next-generation firewall requires adding talent with specialized certifications to your team, the cost of that deployment will rise considerably. Deploying firewalls in ways that improve security performance while reducing waste. Optimal firewall architecture requires effective network segmentation and good security policies. Deploying a secure local area network (LAN) and using virtual private networks (VPNs) can help optimize firewall placement throughout the organization. Determining which kinds of traffic inspection are necessary. Different types of network connections require different levels of security. For example, a public-facing Wi-Fi router is far more likely to encounter malicious traffic than an internal virtual local area network (VLAN) that only authenticated employees can access. How to choose between host-based firewalls and network-based firewalls when moving to the cloud Organizations that are transitioning to cloud infrastructure need to completely rethink their firewall deployment strategy. Firewalls are the cornerstone of access control, and cloud-hosted infrastructure comes with the shared responsibility model that puts pressure on security leaders to carefully deploy security resources. In many cases, you’ll face tough decisions concerning which type of firewall to deploy at particular points in your network. Building an optimal deployment means working through the pros and cons of each option on a case-by-case basis. Host-based firewalls and network-based firewalls are the two main options you’ll encounter for most use cases. Let’s look at what each of those options look like from a complete network security perspective . 1. Host-based firewalls offer flexibility but may introduce vulnerabilities A cloud-native organization that exclusively uses host-based firewalls will have a cloud environment filled with virtual machines that take the place of servers and individual computers. To protect those devices, the organization will implement host-based firewalls on every virtual machine and configure them accordingly. This provides the organization with a great deal of flexibility. IT team members can clone virtual machines and move them within the cloud on demand. The host-based firewalls that protect these machines can move right alongside them, ensuring consistent security policies are enforced without painstaking manual configuration. It’s even possible to move virtual machines between cloud environments – like moving a virtual server from Amazon AWS to Microsoft Azure – without having to create completely new security policies in the process. This makes it easy for IT teams to work securely without introducing friction. However, if attackers gain privileged access to host-based firewalls, they gain the same level of control. They may switch off the firewall or install malicious code in ways that other security technologies cannot detect. Even highly secure organizations are subject to this kind of risk. Imagine an attacker compromises the credentials of a system administrator with firewall configuration privileges. Very few obstacles stand between an insider threat and the sensitive data they wish to exfiltrate. Network-based firewalls offer independent security Compared to host-based firewall products, it’s much harder for a malicious insider to compromise a network-based firewall solution managed by a cloud provider. That’s because the physical hardware is operating on a completely separate system from the host. In a cloud-native environment, the network-based firewall would be a fully hardened device managed by a third-party provider running their own intrusion detection systems. This makes it much harder for attackers to successfully infiltrate and compromise systems without being noticed. At the same time, independent network-based firewall architecture means that the attacker would have to compromise both your network and the cloud provider’s network without triggering security alerts from either. This adds a great deal of complexity to any attack, and significantly increases the chance it will be detected. However, few organizations can afford to exclusively deploy hardware firewalls at every layer of their network. Even those that can afford it will run into significant challenges when planning for growth and scalability. Segment your network for optimal protection While they offer increased security, hardware firewalls are costly to deploy and maintain. Most organizations segment their networks in ways that offer extensive multi-layered protection to their most sensitive data while allowing more flexible host-based firewalls to protect less critical assets. Every organization has a unique balance between optimal network-based firewall and host-based firewall deployment. This depends heavily on the volume of sensitive data the organization regularly accesses, and the security of its connections with users and third-party service providers. Proper network segmentation helps reduce the organization’s attack surface and decrease the risk of business disruption. Schedule a demo Related Articles 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read 5 Multi-Cloud Environments Cloud Security Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call