Mary Elliott


![PtaaS book comic](//images.ctfassets.net/9snkwzlabuv8/3SUhg76HtrAfyYo1wuIUmA/21fda7bd4eb23a36858a4a47f65094bb/Screen_Shot_2022-01-07_at_9.54.45_AM.png)

### Hot off the Press: "The PtaaS Book"

Pentesting is constantly evolving, so whether you’re knowledgeable about the term already or looking to learn more about pentesting and Pentest as a Service, you can learn a thing or two from "[The PtaaS Book: The A - Z of Pentest as a Service](https://resource.cobalt.io/the-ptaas-book)." Authored by InfoSec community advocate and Chief Strategy Officer at Cobalt, Caroline Wong, The PtaaS Book features 7 chapters that go in depth to answer a variety of questions including:

- What is and what isn’t Pentest as a Service?
- How does it work? What sets it apart from traditional models?
- What makes it more agile than regular pentesting? How does that agility impact your security posture?
- What does it do for teams outside of security? Why should they care?
- Does it scale sustainably? And does it help your security program scale sustainably?

![PtaaS book comic ](//images.ctfassets.net/9snkwzlabuv8/4ENf9zgXN4Dc0PbMjoibkL/16d0067143d2d3cdd33f5b83578cabc8/Screen_Shot_2022-01-06_at_2.01.30_PM.png)

> “The PtaaS model has transformed the way companies run pentests. Caroline is the ultimate authority on this subject and the rest of us stand to gain immensely.” - Greg Nicastro, DevSecOps Executive, Board Member, and Angel Investor

Caroline Wong is a well versed information security professional who first entered the realm of book writing for cybersecurity with "Security Metrics: A Beginner’s Guide." She hosts the [Humans of Infosec podcast](https://soundcloud.com/humans-of-infosec), speaks at dozens of security conferences each year, and produces LinkedIn Learning coursework. 

It’s a one-stop-shop for all you need to know about PtaaS — "[The PtaaS Book: The A - Z of Pentest as a Service](https://resource.cobalt.io/the-ptaas-book?utm_source=homepage-news)" addresses the “why” behind pentesting, the dos and don’ts, its impact on security, and more. For everything you and your organization need to know about a modern approach to pentesting, read more in the full book and [download](https://resource.cobalt.io/the-ptaas-book?utm_source=homepage-news#what-you-will-learn) today. 

<a href="https://resource.cobalt.io/the-ptaas-book?utm_source=homepage-news#what-you-will-learn" target="_blank"> ![CTA PtaaS Book](//images.ctfassets.net/9snkwzlabuv8/2tfLfFY5UjgIaTNXz7StLA/ff171deb790e896bfbb14409bc084183/Content_Image_-_CTA_-blog_assets-.png) </a>


Launching "The PtaaS Book: The A - Z of Pentest as a Service"

Cobalt

As program plans for 2022 start taking shape, words like “agility,” “efficiency,” and “stronger security” return to center stage. Many security tools have evolved to match companies’ need for speed, but one has proven particularly tricky: third-party external pentesting. 

It’s a useful exercise. 85% of 600 IT security professionals in the US confirmed that pentests provide valuable insights on how to improve their programs, and nearly all said pentests save their companies money in the long term by preventing breaches and associated penalties. 

![What is driving PtaaS](//images.contentful.com/9snkwzlabuv8/3C5kizN1blHRxRMjlgcBIM/3f7d93ef6d9efe4199b0f5dbf27102e6/What_is_driving_PtaaS_.png)

But things could be better. Traditional vendors like consulting firms have stuck to established ways of offering pentest solutions, which are usually accompanied by slow setup, waterfall workflows, and information buried in email threads or PDF documents. 79% of the survey respondents said these inefficiencies cost them valuable time, and nearly three-fourths shared that they need these problems to be addressed in order to test more often. 

Following the widespread adoption of agile and DevOps, Pentest as a Service — or [PtaaS](https://resource.cobalt.io/ptaas) — has started taking shape. Offering cloud tools, on-demand setup, and faster access to insights, PtaaS is rapidly becoming the alternative to traditional pentests. 

To objectively compare the two, we explored the following questions:  

- How much time does it take to set up and manage either option?
- Which produces findings faster? How much faster?
- Are there differences in costs? 
- What’s the difference in overall ROI? 

These are the focal points for our latest report <a href="https://resource.cobalt.io/roi-of-modern-pentesting-report" target="_blank">“The ROI of Modern Pentesting.”</a> Breaking down the pentesting cycle into stages, it compares how consulting firms and PtaaS vendors like Cobalt stack up against each other in terms of time, costs, and impact. 

![Pentesting Stages](//images.contentful.com/9snkwzlabuv8/49YAEb1vwx49VrOPhzVClf/28dbb6fb31cc565d73a9a3733e599c9f/Pentesting_Stages.png)

The report presents stats from 6 interviews with security professionals managing programs in a variety of settings, including: 

- A national marketplace for business catering that serves several thousands of restaurants and caterers
- A creator of an award-winning customer engagement platform used by 2,000+ enterprise brands and agencies 
- A leading cybersecurity and compliance company that helps 3,000+ global brands stop targeted threats
- A cybersecurity company that enables 8,000+ customers to reduce vulnerabilities, monitor for malicious behaviour, and investigate attacks

Each interviewee has commissioned or managed pentests with both traditional consulting firms and PtaaS vendors, and can speak to their differences. 

![PtaaS Stats](//images.contentful.com/9snkwzlabuv8/7JFZDDmycPyg3t8CBRc9Gt/5f384c88d25f57800b167a4a074b79ef/PtaaS_Stats.png)

All the numbers come down to this conclusion: PtaaS is faster, includes less admin, is more affordable, and brings exceptional value to teams focused on agile workflows. There are many components that lead to this result, so we invite you to <a href="https://resource.cobalt.io/roi-of-modern-pentesting-report" target="_blank">download the full report</a> and dive into the stats most relevant to you. Or better yet, head on over to our <a href="https://go.cobalt.io/roi/" target="_blank">ROI calculator</a> to see what PtaaS can do for your team. 

<a href="https://resource.cobalt.io/roi-of-modern-pentesting-report" target="_blank"> ![ROI Report CTA Image](//images.contentful.com/9snkwzlabuv8/6Px77EHEBdqwIbxUjhfr6v/b95245d5103a1f45651c7b7e4531e375/A_Comprehensive_Guide_to_Building_a_Pentest_Program.png) </a>

Faster and Cost-effective: How Pentest as a Service (PtaaS) Stacks Up Against Consultancies

At Cobalt, we keep our customers’ security top of mind. That’s why we are delighted to announce the launch of our Cobalt Professional Services. This set of six different offerings is designed to boost the maturity of your organization’s current security program, and through strategic services, also enable security teams to offer the utmost value to their company.

__What professional services does Cobalt offer?__

### Pentest Program Management

Cobalt partners with your organization to provide the strategic guidance needed to take your pentesting program to the next level. Our seasoned security consultants are here to help with asset identification, prioritization, pentest setup, integration support, recurring security roundtables, and more. 

Key benefits include improved overall security posture through a matured pentest program and optimization throughout the pentest process with your team, including:

- Technical scoping
- Strategic planning
- Quarterly Maturity Assessments and more

For more information, download our [Pentest Program Manager brief](https://demo.cobalt.io/hubfs/Professional%20Services%20Briefs/Pentest%20Program_Service%20Brief.pdf). 

### Advisory Services

__Don’t let a security question go unanswered due to a lack of time, talent, or resources.__ 

Your security team is one email away from getting the answers you need from seasoned industry professionals. Whether you need a second set of eyes on a presentation, help determining which security controls to focus on next, or an explanation of a compliance standard, Cobalt’s Security Advisors are standing by to help.

- Quick access to security expertise 
- Response times in under 2 business days
- Access to best practice templates
- Strategic guidance
- Option to schedule calls with a security consultant for complex problems 

For more information, download our [Advisory Services brief](https://demo.cobalt.io/hubfs/Professional%20Services%20Briefs/Advisory%20Services%20Brief.pdf). 

### Phishing Engagements

__Did you know that successful phishing attacks are one of the most common causes of a cyber breach?__

It’s important to understand how your controls and users stack up to this attack method. Cobalt’s seasoned Security Consultants work directly with you to understand exactly what you need tested and to build a custom program. 

For more information, download our [Phishing Engagements brief](https://demo.cobalt.io/hubfs/Professional%20Services%20Briefs/Phishing%20Services_Service%20Brief.pdf). 

### IoT & Device Testing

With Cobalt’s IoT and Device Testing, you can ensure that physical access, or proximity, to your company’s IoT devices doesn’t leave you unnecessarily vulnerable. Our engineers go beyond normal network and application pentesting techniques and focus on hardware, firmware, and radio communication vulnerabilities.

For more information, download our [IoT & Device Testing brief](https://demo.cobalt.io/hubfs/Professional%20Services%20Briefs/IoT%20and%20Device%20Testing_Service%20Brief.pdf). 

### Red Teaming

Cobalt’s Red Teaming services are an extension of our modern streamlined pentesting platform. Our security experts will define the scope of work and timelines before kicking off the testing process. Testing is transparent and collaborative, with a few of the key benefits including:

- Test the strength of your defenses
- Better understand your unique technical risk
- Validate your security posture to executives

For more information, download our [Red Teaming brief](https://demo.cobalt.io/hubfs/Professional%20Services%20Briefs/Red%20Teaming_Service%20Brief.pdf).

### Code Review

Code is a critical business asset — not only does it contain all of the critical details of your application’s functionality, it also holds insights into hidden, exploitable vulnerabilities. Our experienced engineers are equipped with the right skills to review code and identify vulnerabilities that can prevent a future breach.

For more information, download our [Code Review brief](https://demo.cobalt.io/hubfs/Professional%20Services%20Briefs/Code%20Review_Service%20Brief.pdf).

It’s time to take the next step to drive your business forward efficiently and securely. Cobalt’s Professional Services offer your business results-driven benefits, fully guided by skilled security professionals. Interested in learning more? Send us an email at professional_services@cobalt.io.

<a href="mailto:professional_services@cobalt.io" target="_blank">![Content Image - CTA [blog assets]](//images.contentful.com/9snkwzlabuv8/4cGgT1pPTyMYjaZ7DPSPBI/ac16bf91b62fdb15d279812808d5d280/Content_Image_-_CTA_-blog_assets-.png)</a>

Strengthen Your Security Posture with Cobalt’s Professional Services

Analysts at 451 Research are lauded for their data-driven, global insights. For anyone who isn’t familiar with this leading research and advisory organization: the team of analysts engages with IT industry leaders to share key market findings and trends that can be pivotal for technology and service advisors.

Recently, 451 did a deep dive on Cobalt — our business model, differentiators, and value prop — along with a SWOT analysis. Here’s what analyst Aaron Sherrill had to say: 

Organizations are discovering the ways traditional penetration testing engagements aren’t measuring up to a modernized approach. __Traditional pentesting provides only a point-in-time snapshot of an enterprise’s risks, weaknesses, and vulnerabilities, and often fails to:__

- Deliver the outcomes needed for rapid development cycles
- Provide interaction with testers during or after testing 
- Maximize retesting capabilities to ensure issues have been fully remediated
- Give the insights needed for a data-driven security program

With that in mind, these shortcomings of traditional pentesting are becoming ever more critical. 451 Research’s recent *Voice of the Enterprise: DevOps, Organizational Dynamics* survey collected data that suggests a growing percentage of organizations are accelerating or newly introducing initiatives to add security to DevOps workflows. Because of this acceleration of adding security to DevOps, the time is here for traditional pentesting to evolve.

## Introducing: The Cobalt Platform

Cobalt’s Pentest as a Service (PtaaS) platform aims to modernize the traditional penetration testing model by delivering programmatic, on-demand, manual penetration testing services for web, mobile, and desktop applications, APIs, internal and external networks. In as quick as 24 hours, Cobalt can begin penetration testing and delivering the people and process innovation required to drive better security.

> “Organizations of every size and industry are seeking to improve their cybersecurity posture; however, access to frequent security testing has been beyond the scope of expertise and resources of most organizations. Cobalt’s flexible, tailored and integrated approach to on-demand, programmatic security testing is designed to meet the needs of both rigorous testing approaches and organizations that are just beginning their security testing initiatives.”

Interested in learning more about how Cobalt’s modernized Pentest as a Service (PtaaS) platform can provide value to your business security? Read more in the full [Market Insight Report](https://demo.cobalt.io/hubfs/451%20Research%20Cobalt%20Report.pdf). 

<a href= "https://demo.cobalt.io/hubfs/451%20Research%20Cobalt%20Report.pdf "> ![451 Research](//images.contentful.com/9snkwzlabuv8/4zGktLiTp70lkOb7tcN60G/44f6a2850536546dbcbd202efa0c9a03/Content_Image_-_CTA_-blog_assets-.png) </a>

*Source: 451 Research, Coverage Initiation: Cobalt aims to  modernize traditional penetration testing with its pentest-as-a-service model, June 2021, All Rights Reserved*

451 Research Takes a Close Look at Cobalt in Latest Report

Good security takes an entire ecosystem of teams, even communities, to ensure that valuable data stays safe. In the words of Jay Paz, Cobalt’s Senior Director of Delivery: “Cybersecurity is an outcome of the behaviors, interactions, decisions, and actions of many different people. Everyone is all in this together.” 

That’s why we’re launching a series of blog posts that highlight the work and commitment of Cobalt’s partners, who work alongside us to strengthen cybersecurity around the world. 

Our January feature is dedicated to <a href="https://allianz-f200.de/" target="_blank">Allianz F200</a>, who focus on defending organizations against cyber risk with a variety of cyber insurance options. We sat down with their director John Ismailoglu to learn more about their work. 

## Tell us more about yourself and Allianz F200.

I’m John, a Director at Allianz F200. I’ve been in insurance for about 16 years now consulting businesses on their risks and exposures to implement tailored insurance programs to protect them. 

More widely, Allianz F200 is one of Germany’s leading agencies representing Allianz — the insurance and asset management company. We offer a broad range of personal and corporate insurance services. This ranges from everything like cyber, property, life and health insurance, to assistance services, to credit insurance and global business!

## What’s the biggest security problem you’re aiming to solve? And how?

From the security side of things, it’s all about supporting businesses to get the right protection when they are handling sensitive data.

Cyber insurance helps in a variety of different ways. One way is if there's any sort of first-party loss where there's a cyber incident. When a company has a financial loss due to that, the insurance can help recuperate those costs. 

As companies grow and new organizations are founded, the risk only increases — more and more companies handle sensitive data every single day. Allianz F200 sits right with them to implement the right coverage that protects them in case anything goes wrong.

## Tell us about the value you bring to your customers. How do they describe you?

It has to be about top empathetic customer service and taking that consultative approach. We really work with our clients to understand exactly the level of risk they face, and the consequence of holding that risk. From there we can really guide them to what levels of insurance products they might want to consider to protect their business. 

It all has to come down to having a real understanding of the businesses and how they work — for instance, startups work and move so differently to your Fortune 100s (or 500s) of the world and we make sure we can support that and act as a guide. 

## How do Allianz F200 and Cobalt click together? What do you think the security community will find most valuable about our partnership?

For me, pentesting and cyber insurance are just another piece of the security puzzle, right? Pentesting is proactive protection, and what we do at Allianz F200 is the reactive measure in case something goes wrong. 

## What’s on the horizon for you — any previews you can give into what lies ahead for Allianz F200, or where you think the industry as a whole is going?

Insurance is a legacy industry that has not changed much, that is, until recently. With the growth of insurtech, the industry has experienced disruptions — especially on the digital front. Insurers will put more emphasis on this whether it is through their own efforts or through collaborative partnerships like <a href="https://www.allianz.com/en/press/news/financials/stakes_investments/211109_Allianz-x-and-clark-seal-deal-on-finanzen-group.html" target="_blank">the Allianz X, CLARK and finanzen Group partnership</a> which formed one of the largest insurtechs.

## We always sneak a fun question at the end: If Allianz F200 had a mascot, what would it be?

An elephant. Specifically a mother elephant because they are very protective of their young and will do whatever it takes to rescue them from harm. This is the same mindset we have when it comes to our clients. We do whatever it takes to make sure they are protected.

Hear John discuss proactive security in our upcoming webinar, <a href="https://webinar.cobalt.io/benefits-of-a-proactive-cyber-security-program-webinar?utm_campaign=Allianz%20F200%20Partner%20Webinar%20-%20January&utm_source=Cobalt%20Blog&utm_medium=Allianz%20F200%20Partner%20Spotlight&utm_term=Allianz%20F200%20Partner%20Spotlight" target="_blank">"Early & Often: The Benefits of Continuous Pentesting & Cyber Security Programs." </a>

<a href="https://webinar.cobalt.io/benefits-of-a-proactive-cyber-security-program-webinar?utm_campaign=Allianz%20F200%20Partner%20Webinar%20-%20January&utm_source=Cobalt%20Blog&utm_medium=Allianz%20F200%20Partner%20Spotlight&utm_term=Allianz%20F200%20Partner%20Spotlight" target="_blank"> ![Early & Often: The Benefits of Continuous Pentesting & Cyber Security Programs](//images.ctfassets.net/9snkwzlabuv8/Oplurio7VUXYmEbbWbb4H/edaa06d6e6e6c99e39c74b4f8f0af2c7/Social_Speakers_Linkedin_1200x628.png) </a>

Partner Spotlight: Allianz F200


It’s official: users love us! G2 named Cobalt the only leader in the [Grid® Report for Penetration Testing](https://www.g2.com/reports/fa74d7f2-ca51-4b21-91f6-c61df3f5edc5/preview) Winter Report. Cobalt’s Pentest as a Service (PtaaS) platform is modernizing traditional pentesting using an exclusive community of pentesters, real-time insights, detailed findings, and more to remediate risk quickly and innovate securely. 

Cobalt didn’t stop at just qualifying for the G2 Penetration Testing software category. With our Pentest as a Service platform, we were also named "Best Meets Requirements", a category that reflects customer responses in the following areas:

- Ability to simulate cyberattacks on computer systems or applications
- Gather findings on potential known vulnerabilities
- Analyze exploits and report on the test outcomes

Providing authentic, real-time peer advice, G2 is the world’s largest tech marketplace where businesses can discover, review, and manage the technology and software they need. The company shares unfiltered, unbiased, 100% validated reviews from live users, so businesses looking at new technology have an inside look into their next business-critical purchase. 

With 1,000,000 reviews and 5M+ visitors reviewing software to help businesses around the world make the best buying decisions, G2’s 2022 awards are indicative of Cobalt’s commitment to our customers. Cobalt's Pentest as a Service platform delivers actionable results that empower agile teams to pinpoint, track, and remediate software vulnerabilities. Hundreds of organizations benefit from our data-driven, high-quality pentest findings, quick remediation, and an increase in ROI and we place a premium on customer satisfaction – every day we must continue to earn their endorsement.

__Users Love Us__ 100% of people [reported](https://www.g2.com/reports/fa74d7f2-ca51-4b21-91f6-c61df3f5edc5/preview?tab=satisfaction) that Cobalt’s PtaaS product is going in the right direction, and we are used most often by computer software professionals. See what else Cobalt users are saying:

![G2 Winter Report](//images.ctfassets.net/9snkwzlabuv8/mmwD04mOSZP1JnXpOBdEN/77efebe36b9be123ae1e89825668768d/Banners_-blog_assets-__1_.png)

> “Cobalt leads the way in PtaaS” 
> "Superb service, delivered in the way my agile web development company needs and for a great price”
> "Best pentest as a service out there"

To read more about our ratings and what reviewers think of [Cobalt’s PtaaS platform](https://cobalt.io/get-started), visit the [full reviews](https://www.g2.com/products/cobalt-io-cobalt/reviews). 


Cobalt Recognized as Only "Leader" in G2's Penetration Testing Grid

Jacob Fox

Pentesting requires companies to do more than simply receive a report at the end of the test. 

The true value derived from a pentest is through the remediation of discovered vulnerabilities. Without taking action from your pentest results, there’s a missed opportunity to capture the full value from pentesting. It’s vital for standard pentest results interpretation to include a remediation plan.

With a proper remediation plan in place, companies benefit two-fold while utilizing a Pentest as a Service (PtaaS) platform. The first benefit comes from the collaborative nature of the platform, which empowers developers and security testers to connect directly for knowledge sharing. 

Furthermore, a proper remediation plan prioritizes a faster vulnerability fix time. Thus, creating a smaller window for attackers to exploit vulnerabilities.

With this in mind, let’s take a closer look at the end goal of a pentest and how companies best use pentest reports and results to improve their security posture.

## What is the End Result of a Pentest?
When starting anything, it’s important to keep the end goal in mind. This helps define the necessary steps to reach the goal, while also minimizing distractions that could jeopardize success. Stephen Covey encapsulates this message best by saying:

> “Begin with the End in Mind means to begin each day, task, or project with a clear vision of your desired direction and destination, and then continue by flexing your proactive muscles to make things happen.” - Stephen Covey 
<a href="https://www.franklincovey.com/habit-2/" target="_blank">Source</a>

Thinking about the end goal of a pentest, companies should prioritize their plan to utilize insights discovered during the test to guide [remediation](https://cobalt.io/blog/pentest-as-a-service-benefits-developers) plans. With this, developers will be delighted with the option to communicate directly with security testers to clarify vulnerabilities discovered and ensure they’re properly remediated.

To this point, let’s take a closer look at what’s included in the pentest report and how businesses can best utilize this information to process their pentest results.

## Pentest Report
At Cobalt, we offer customers a variety of different reports to cater to different stakeholders: auditors, customers, management, and more. Further, customers can [customize their pentest reports](https://cobalt.io/blog/cobalt-platform-deep-dive-customize-your-pentest-reports-per-your-needs) to include more specific information. 

After an executive summary, the pentest report will include a scope of work and methodology statement highlighting the process undertaken during the test. Next, for each vulnerability identified, the pentest report will include two important categories to assist with the remediation prioritization process: [vulnerability risk and criticality](https://cobalt.io/blog/adding-clarity-in-the-murky-world-of-vulnerability-risk). 

Lastly, and most importantly, the report will identify post-test remediation tasks such as retesting — which on Cobalt’s PtaaS platform comes complimentary after every pentest.

Through the pentest report, companies will be empowered to better understand where their security risks occur. With this understanding, the benefits created are two-fold to complete the pentest process with the actual end results.

Let’s take a closer look to understand what benefits pentest results offer companies.

## Pentest Results to Improve a Security Program
After you’ve received the pentest report, it’s time to process the results. This will include identifying granular details that should be included in each of the custom reports you need for various stakeholders. 

The pentest results will fuel the remediation prioritization process. Remember, it’s more important to remediate vulnerabilities found during the pentest rather than simply receive the report by itself. Pentest remediation shouldn’t be overlooked. 

To this point,companies using a PtaaS platform will be able to [connect developers directly with the security testers](https://cobalt.io/blog/pentest-as-a-service-benefits-developers) to clarify discovered vulnerabilities and apply a proper fix for remediation. This benefits companies with a more secure remediation process. It also helps encourage security teams to learn more about security vulnerabilities and thus, apply these fixes in their day to day work going forward.

The report should be used as a foundational guide for remediation. Companies that get the most value from pentesting will prioritize remediation and benefit from the final value proposition from a successful pentest.

Finally, companies will also gain an improved security posture through the remediation process. This is often the largest value proposition for companies proactively approaching security with pentesting, as it decreases the window of time an attacker can exploit the vulnerabilities. 

In closing, remember that the real value of a pentest is not to check complete in a compliance box, but to improve the security posture of your digital assets. To this point, companies should plan to prioritize remediation of identified vulnerabilities after their pentest. 

Thankfully, when pentesting through Cobalt’s [PtaaS platform](https://cobalt.io/platform) companies can enjoy complimentary retesting of their assets after remediation. This value add helps ensure businesses have properly remediated their identified vulnerabilities and helps bridge the gap between security and engineering departments.

Generating Actionable Pentest Results with PtaaS

Data security is a high priority across industries. This includes the education sector where confidential files and personal information is stored by school systems and trusted by a vast amount of students, families, and staff to be kept secure. Just as schools value informing students and facilitating learning about topics such as math and history, staying in the know about the topic of cybersecurity plays an important role in maintaining integrity as cyber threats continue to escalate. 

![Screen Shot ](//images.ctfassets.net/9snkwzlabuv8/7h1n8k11U21alnEmWhzzjw/eff740868db712e2af29ebe857a5658a/Screen_Shot_2021-12-20_at_10.18.53_AM.png)

Image from [Cyber Attacks on Schools in 2020 Were Record Breaking: Report](https://www.governing.com/security/cyber-attacks-on-schools-in-2020-were-record-breaking-report.html)

As you can see, cyberattacks on schools are on the rise and are projected to continue to trend in this direction. “IT leaders must first recognize that for the foreseeable future, the complexity of software and systems will only multiply. Adding to the struggle is the volume and variety of these tools, as they shift from managing some operating systems, apps and devices to having to manage so much more. Moreover, many schools lack the bandwidth and resources to be properly prepared for a cyber security incident.” ([Cyber security threats to schools and how to protect against them](https://www.verizon.com/business/resources/articles/s/cyber-security-threats-to-schools-and-how-to-prevent-them/))

It’s important for educational institutions to ask themselves questions such as: What information is safe to share online? What do you do if an attack or a data breach occurs? Is your staff trained on best practices for detecting and reporting suspicious activity? What security plan can you set in place for the future?

## Top 5 cybersecurity Risks for Schools

### 1. Phishing
Phishing attackers falsify legitimate-looking emails in an attempt to compromise personal information through an email open or click. __What can you do to prevent falling victim to a phishing scam?__ Stay away from suspicious-looking emails from unknown senders, and avoid clicking on links that can lead to accidentally sharing passwords, credit card information, phone numbers, and more. Installing an anti-phishing toolbar and using anti-phishing software are additional security controls to help avoid attacks.

### 2. Distributed Denial-of-Service (DDoS)
DDoS takes advantage of vulnerabilities and weaknesses in devices by manipulating and turning devices into bots and forcing them to send multiple requests at the same time to a network or server's IP address. When so many simultaneous requests occur, the network/server will crash and be unable to deliver its basic functions. When a server is unable to respond, this can result in students not being able to access resources, upload assignments, etc. Elevating security settings, planning ahead to avoid exploitations, and implementing a DoS protection service are all ways to avoid the severity of a DDoS attack.

### 3. Data Breaches
Sharing personal information online creates a variety of risks. Schools, in particular, run the risk of releasing confidential information in an unanticipated data breach. Data breaches occur when information is compromised and stolen from a system without authorization. Keeping security software up to date, fully securing computers, and safeguarding data helps to prevent these types of unwarranted attacks. Other security controls include encryption, firewalls, and vulnerability monitoring & management. 

### 4. Ransomware
Ransomware is a type of malicious software used by cybercriminals to encrypt files on devices and deny access to the rightful owner, leading to an ultimatum of a “ransom” payment to retrieve access. Ransomware can lead to severe data and/or financial loss for institutions. With a recent increase in schools reporting ransomware incidents, it’s important to have policies in place to prevent ransomware attacks. Further developing a cybersecurity maturity model helps to alleviate some risks associated with ransomware.

### 5. IoT Vulnerabilities  
IoT (Internet of Things) devices transmit data wirelessly through a network. These devices include security cameras, laptops, desktops, and tablets, many of which are typically found in classrooms and widely used by schools to enhance learning in the increasingly digital world. Making sure to update software frequently and implement end-to-end encryption is key to preventing attackers from exploiting IoT vulnerabilities and compromising sensitive information. IoT and device testing helps companies secure physical equipment and avoid the costs associated with cyber attacks.

![K-12 Cyber Types ](//images.ctfassets.net/9snkwzlabuv8/6iJo6qCLGmlweGeDVypAJD/716bd3a4dd7dc84caaee6425711ac531/Screen_Shot_2021-12-10_at_1.04.26_PM.png)

Image from [The State of K-12 Cybersecurity 2020 Year in Review](https://k12cybersecure.com/wp-content/uploads/2021/03/StateofK12Cybersecurity-2020.pdf)

There are various types of cyber incidents that can pose risks for schools. Sound cybersecurity habits such as continuous pentesting, [implementing security scanners](https://cobalt.io/blog/pentesting-vs-dast), regularly updating software, and promoting security awareness and education are all ways to protect against different types of potential cyber attacks. It’s essential to create a space in educational institutions where teachers and staff, as well as students, are informed about the importance of cybersecurity. 

As Caroline Wong, Cobalt’s Chief Strategy Officer, said in [Kids Are Curious About Cybersecurity — Let's Teach Them](https://www.forbes.com/sites/forbestechcouncil/2020/07/09/kids-are-curious-about-cybersecurity---lets-teach-them/?sh=4a172e045a0f): “Kids are often smarter and far more observant than we give them credit for. They may notice and think about cybersecurity issues that would never cross our minds. Create space for them to voice their own worries about the internet and cybersecurity. You might be surprised by what they know.”

Parents, teachers, and students have all had to navigate the risks of cybercrime with both in-person and online learning. Focusing on lessons to draw from previous years is key to planning ahead to maintain a safe and secure learning environment. 

Partnering with a Pentest as a Service (PtaaS) platform makes securing data easy — [get started with Cobalt today](https://cobalt.io/get-started) to mature your security program through a scalable, data-driven approach to pentesting with real-time insights and a plan for remediation.


Types of Security Risks that Threaten Schools

Looking for the next great gift to give a special computer wizard in your life? We’ve got you covered!

Purchasing a gift during the holiday season to thank family, friends, or colleagues is a wonderful way to show gratitude. Plus, as the holiday season goes into full swing, gift giving is top of mind. 

With this in mind, let’s take a look at top holiday gifts for software engineers.

## 1. <a href="https://www.amazon.com/TerraCycle-Circuit-Board-Coasters-set/dp/B0045EJT5E/ref=sr_1_2" target="_blank">Circuit Board Coasters</a>
![Circuit Board Coasters](//images.ctfassets.net/9snkwzlabuv8/67UpYb1A693A90kx4k2IVg/87ef610a82571d7e1e03485053d0d063/circuit_board_coasters_amazon.jpg)
The circuit board coasters fit a small budget while still being a fun gift. Starting at only $12.99, this gift is the perfect stocking stuffer for any programmer or coder in your life. Manufactured from actual circuit boards, this gift offers a neat recycling angle. 

## 2. <a href="https://www.coursera.org/courses?query=coding" target="_blank">Gift Course</a>
Oftentimes, continued education is a critical component to a software engineer’s professional development. Giving the gift of continued education is a powerful way to show your appreciation. 

Be sure to get a little insider knowledge about which course in particular the recipient would be interested in. Or better yet, go for a platform that accepts gift cards for a wide variety of different courses.

## 3. <a href="https://www.amazon.com/Personalized-Customized-Stainless-Insulated-iProductsUS/dp/B084DGSPCQ/ref=sr_1_4_sspa" target="_blank">Personalized Tumblers</a>
Everyone appreciates a good travel mug, especially in the age of remote work. Grabbing a personalized tumbler as a gift for a programmer makes perfect sense. The great thing about a tumbler is it keeps drinks hot or cold — allowing for use throughout the year despite changes to the weather.

Take it a step further by adding a custom message! We recommend something appreciative such as “World’s Favorite Engineer” or something relatable to the gift recipient.

## 4. <a href="https://www.amazon.com/Massager-Shiatsu-Electric-Shoulder-Kneading/dp/B08DCDN22T/ref=sr_1_5" target="_blank">Neck Massager</a>
With programmers spending much of their time looking at a computer screen, neck pain can be a real … well, pain. While standing desks help alleviate this, nothing is better than a neck massage. A neck massager is a wonderful choice for anyone looking to show their appreciation to a tech worker.

Starting at $50, this gift requires a slightly larger budget than other items on the list. That said, it’s certainly something that would be appreciated by coders, who spend most of their work days looking at a computer screen.

## 5. <a href="https://www.amazon.com/Front-end-Languages-Developers-Programmers-Engineers/dp/B09C1DFPNC/ref=sr_1_5" target="_blank">Coder Stickers</a>
![Coder Sticker Pack](//images.ctfassets.net/9snkwzlabuv8/1RF3FN8AxMzLlxN0661h5s/38f884151c4a1a5ebb09128fd784b5a5/coder_stickers_amazon.jpg)
When selecting a simple gift for coders, turn to coding stickers! We all know how much tech workers enjoy showing off their interests, hobbies, and even employers through laptop stickers. 

This makes stickers a fun and inexpensive gift! It’s a great way for your favorite coder to show off their laptop with a little extra swagger.

## 6. <a href="https://www.amazon.com/Freenove-Raspberry-Processing-Tutorials-Components/dp/B06W54L7B5/ref=sr_1_1_sspa" target="_blank">Raspberry Pi Kit</a>

Coming in as a higher price point item, the Freenove Ultimate Starter Kit for Raspberry Pi is sure to delight any developer. This $50 inclusive set of hardware empowers engineers to build interesting hardware applications. 

A Raspberry Pi offers an incredibly <a href="https://www.seeedstudio.com/blog/2019/09/29/top-20-best-raspberry-pi-4-projects-that-you-must-try-now/" target="_blank">diverse set of projects</a> that can be built using their hardware inputs. These range from home security systems to a virtual jukebox, and even a robot! All and all, this gift should bring joy to any engineer who enjoys tinkering with technology.

## 7. <a href="https://www.amazon.com/Sony-WH-1000XM4-Canceling-Headphones-Phone-Call/dp/B08MVGF24M/ref=sr_1_3" target="_blank">Noise Canceling Headphones</a>

Another item with a higher price point is the noise canceling headphones from Sony. Although expensive at $250, these headphones will surely bring a smile to any coder or programmer.

The ability to focus is a prized trait in the modern age which is packed full of distractions. Noise canceling headphones can help developers during meetings, among many <a href="https://theworldofplay.com/blogs/play-stories/top-advantages-of-noise-cancellation-tech" target="_blank">other benefits</a> on a more personal level. Despite the price, this really is a perfect gift for coders.

## 8. <a href="https://www.amazon.com/3dRose-Programmer-Talented-Programming-mp_185015_1/dp/B00KTM0FMC" target="_blank">Best Programmer Ever Mouse Pad</a>

![Best Programmer Ever mousepad](//images.ctfassets.net/9snkwzlabuv8/5PRqQCYl1H9TmDWz30rAAO/6b4bcc4182997f5a91e590903fd91608/best_programmer_ever_mousepad.jpg)

Looking to keep it simple this holiday season? Take advantage of the Best Programmer Ever mouse pad! This is a wonderful gift for programmers while ensuring nearly anyone would be able to put this gift to good use. Plus, with the price point of only $16, it won’t break the bank.

## 9. <a href="https://www.amazon.com/INIU-Portable-20000mAh-High-speed-Flashlight/dp/B07YPY31FL/ref=sr_1_9?keywords=portable+charger&qid=1638985642&sr=8-9" target="_blank">Portable Charger</a>

In the world of remote work, a portable charger has become more of a game changer than ever before. As employees around the world find themselves traveling more frequently, remaining connected to work messages calls for a charged battery.

Some encapsulate the power of remote work such as former Twitter CEO Jack Dorsey, who for years has <a href="https://www.cnbc.com/2018/10/18/why-twitter-ceo-jack-dorsey-works-on-an-iphone-not-a-laptop.html" target="_blank">run two public companies exclusively via his smartphone</a>. This feat certainly couldn’t be done without access to a good charger.

## 10. <a href="https://www.amazon.com/Blocking-Glasses-Strain-Blocker-Computer/dp/B07TB878L7/ref=sr_1_1_sspa" target="_blank">Blue Light Glasses</a>

Last and perhaps most exciting, bring a gift that offers style and health benefits! Blue light glasses decrease exposure of blue light to our eyes which can be especially useful for programmers who spend much of their work life looking at a computer screen. 

Manufacturers of blue light glasses <a href="https://www.medicalnewstoday.com/articles/do-blue-light-glasses-work#purpose" target="_blank">claim</a> these can help reduce headaches, eye strain, and improve melatonin production despite looking at a screen. All of which would certainly be appreciated by a software engineer.

In closing, don’t forget to join the [12 Days of PtaaS](https://event.cobalt.io/12-days-of-ptaas) for a chance to win some fun giveaways. Maybe one of these giveaways will work well for a gift in and of itself!

Top Holiday Gifts for Programmers, Coders, and Engineers

‘Tis the season to be jolly — and not to be recovering from a security breach. Compliance for Christmas is the gift that keeps on giving to continually address security threats. If your company stores, processes, or transmits cardholder data, the Payment Card Industry Data Security Standard (PCI DSS) is likely already on your radar. 

![Payment Card Industry Security Standards](//images.ctfassets.net/9snkwzlabuv8/6YhWNZpMi0jGiNux8x5cx/4bf9631544cd267bdf7548261b6e3a7c/Screen_Shot_2021-12-07_at_3.19.00_PM.png)

Image from [PCI Security Standards Council](https://www.pcisecuritystandards.org/pci_security/maintaining_payment_security)

Payment Card Industry (PCI) compliance is an integral part of organizations where it’s necessary to stay up to date on the latest security standards and practices to ensure card payments remain protected. Having a pentest performed within the cardholder data environment (CDE) is an effective way of reviewing current security structure status to expose critical vulnerabilities. 

## What is a PCI pentest?
A PCI DSS pentest is a cybersecurity assessment examining the technical and operational components of a system that collects payment and cardholder data to ensure that they meet the PCI compliance standards.

PCI applies to organizations of all types that are responsible for processing card payments, such as:

- Merchants
- Processors
- Acquirers
- Issuers
- Service providers

It’s relevant to also understand what level of compliance fits the varying needs of individual businesses.

__Level 1:__ Businesses that process 6 million+ card transactions each year; 
__Level 2:__ 1 to 6 million transactions/yr 
__Level 3:__ 20,000 to 1 million transactions/yr
__Level 4:__ Fewer than 20,000 transactions/yr

Meeting PCI compliance standards, no matter which level your organization fits into, reinforces a commitment to customers and protecting their sensitive data. Here are a few standards set by the [PCI Security Standards Council](https://www.pcisecuritystandards.org/) to keep in mind:

- Use strong passwords and change default passwords on hardware and software
- Increase employee awareness about security and protecting cardholder data
- Use password protection and encryption
- Cover the entire cardholder data environment (CDE)
- Include both network-layer and application-layer attacks

## How does pentesting speed up PCI compliance?
Integrating pentesting into PCI compliance helps propel organizations forward and up to speed. A PCI DSS compliance pentest is comprised of scoping, discovery, evaluation, reporting, and retesting end to end from pentesters who put confidentiality, integrity, and availability of data at the forefront.

“PCI DSS Requirement 11.3.4 requires penetration testing to validate that segmentation controls and methods are operational, effective, and isolate all out-of-scope systems from systems in the CDE. Therefore, a robust approach to penetration testing is recommended to satisfy this requirement by actively attempting to identify routes and paths from networks outside the CDE into the CDE.” ([Penetration Test Guidance Special Interest Group PCI Security Standards Council](https://www.pcisecuritystandards.org/documents/Penetration_Testing_Guidance_March_2015.pdf))

Cobalt provides pentests that follow PCI Security Standards Council requirements with qualified pentesters, robust methodologies, and reporting guidelines. Further, Cobalt helps organizations scale pentesting from compliance to a continuous program that provides valuable insights into their security posture. 

“When we first went with Cobalt it was purely for PCI requirements but we were looking to scale our program and pentest on a more continuous basis. Cobalt gave us the ability to pentest on a frequent basis with minimum effort from our teams. Saving us time and providing us quality results on a consistent basis.” - Tushar Chandgothia, VP of Information Security and Risk Management at KUBRA

For more information on PCI pentesting and compliance, [contact Cobalt today](https://cobalt.io/contact-us). And, don’t forget to sign up for a chance to be selected for a prize throughout [the 12 days of PtaaS](https://event.cobalt.io/12-days-of-ptaas)!


Compliance for Christmas: How Pentesting Speeds up PCI Compliance

Today, [Cobalt](https://cobalt.io/), is proud to announce the winners of the first annual Partner of the Year awards, including Tugboat Logic, ECTACOM GmbH, and Drata. Each organization is being honored for their exceptional partner relationships, strategic focus on security, and dedication to fulfilling customers’ pentesting needs amid a year of much uncertainty and increased cyber threats. 

Since officially launching the Cobalt Partner Program in March 2021, partner-generated revenue has grown by 200% while the number of signed referral and seller partners has soared at 500% growth. Each winner has shown incredible commitment to meeting the industry’s evolving business needs, and we’re thrilled to support the continuous value being brought to the market.  Winning categories and partners include: 

The winner of __Partner of the Year, Global__, is [Tugboat Logic by OneTrust](https://tugboatlogic.com/). The Partner of the Year category acknowledges outstanding partnership working with Cobalt and going above and beyond to drive mutually beneficial marketing campaigns. Tugboat Logic was created to help businesses of all sizes better understand their own security and compliance methods. Their Security Assurance Platform uses the power of AI to automate the system of creating and managing InfoSec programs. Cobalt’s Pentest as a Service (PtaaS) platform has helped Tugboat Logic customers solidify their security posture by automating their pentesting needs, leading to their platform becoming more secure than ever. Tugboat Logic has built-in deep integration utilizing Cobalt’s open API, released earlier this year, to better integrate PtaaS within Tugboat Logic’s suite.  

The winner of __Partner of the Year, EMEA__, is [ECTACOM GmbH](https://www.ectacom.com/en), which helps partners and their customers discover the right cybersecurity and IT solutions for their business. This award, similar to the one above, acknowledges outstanding partnership working with Cobalt in the EMEA region. Ectacom distributes among the best cyber security and access management solutions in Central Europe. Included in their repertoire of security platforms is Cobalt, where modern and secure pentesting is available to more companies across the EMEA market. Ectacom distributes the most suitable cyber security and access management solutions in Central Europe. 

The winner for __Rising Star__ is [Drata](https://drata.com/). Drata is a startup experiencing a meteoric rise and Cobalt is proud to call one of our partners. The Rising Star award, as the name implies, acknowledges our top performing partner that started working with Cobalt this calendar year. Recently becoming a unicorn, Drata has grown substantially in a very short amount of time. They help their customers put security on autopilot by automating compliance while still being able to focus on building the business itself. Companies are able to streamline SOC 2, ISO 27001, and HIPAA compliance, all without having to think twice about it. Cobalt helps Drata customers secure their businesses through precise and secure pentesting, while staying highly compliant.

“We are amazed by the growth and overall momentum that our partners, from startups to highly established organizations, have achieved throughout 2021,” says Lauren Gimmillaro, Head of Channel at Cobalt. “Tugboat Logic, Ectacom, and Drata are prime examples of what it means to be a Cobalt partner, driving the benefits of Pentest as a Service (PtaaS) to more organizations and tech stacks worldwide. We are very excited to support this initiative through the continued growth of our own internal channel team across the U.S. and EMEA regions and look forward to what next year has to bring.” 

__About the Partner Program:__
The Cobalt Partner Program was initiated in March 2021 with the goal of creating and growing strategic relationships with security-focused companies to ensure the long-term success of our collective ecosystem of customers. There are currently two partner options, Referral and Reseller, with different tiers within each category to best suit the needs of our partner’s business. As part of the program’s benefits, partners are given referral fees, discounts, guest blog posts on Cobalt’s website, custom co-branded documentation, joint marketing opportunities, and more. 

To learn more about [Cobalt’s Pentest as a Service (PtaaS) platform](https://cobalt.io/), and how to become a partner yourself, please visit [https://cobalt.io/partners](https://cobalt.io/partners). 
