H2Cyber

BACKGROUND

Introduce your business and what you do there.

I’m an information security manager at GrecoRoberts, an aerospace engineering materials company.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with H2Cyber?

We needed help with cybersecurity maturity modeling certification to meet the US government's requirements. We were having difficulty understanding the wording and the desired outcome of some of the tasks, so we needed someone to ensure that we met our needs and complied with the 800-171 guidelines.

SOLUTION

What was the scope of their involvement?

H2Cyber has been doing cybersecurity for us; they’ve conducted penetration testing, provided a platform, and began reviewing all the artifacts we loaded against the platform. 

They started by looking at all of our external-facing IP addresses, did penetration testing, provided their results and findings, and then helped us understand the best ways of mitigating those aspects using modern technologies.

After that, they sat down with us and began looking through our policies and procedures, including CMC regulations, ISO 27000, and PCI compliance – it was a thorough review of our policies and procedures.

Once they conducted that review, they provided us with a platform where we could select which compliant certifying body we’re trying to post against. It then gives each of the major activity areas to upload the requirements, the policy against it, and the artifact showing that we’re following the guidelines. This will help when the auditors come in to see that the artifact is meeting the government’s requirements and procedures regarding cybersecurity and intellectual protection requirements and procedures.

They’re currently uploading new artifacts against each descriptor and balancing and ensuring they meet the intent. If they don’t, they point out the weakness to solve it. They’ve also agreed to give us a good hourly rate whenever the auditors come in to be in our offices and work with the auditors and us in case there are any questions.

What is the team composition?

We’ve been working with Paul (CEO) and two other supportive members of their team for penetration testing.

How did you come to work with H2Cyber?

We found them online through a list of companies. We received their quote, which was the best and most competitive, so we decided to go with them.

How much money have you invested in this partnership?

So far, we’ve spent around $30,000 with them.

What is the status of this engagement?

We started working together in April 2022, and the engagement is ongoing.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

They've been able to explain to us the government's requirements to help us get through the auditing process we're facing.

How did H2Cyber perform from a project management standpoint?

Project management is great; they stay within budget and deadlines and sometimes outpace us. They're always ready for the next step of the project. Regarding tools, we use scheduled meetings through Microsoft Teams and phone calls depending on what we're reviewing.

What did you find most impressive about them?

They're a personable and available team compared to other competitors. Their responsive and reliable team helps us interface easily with them.

Are there any areas they could improve?

I don't think there's anything they can improve on — they're very good.

Do you have any advice for potential customers?

Keep engaged with their staff and ask the questions that come up — they'll answer them for you right away.

BACKGROUND

Introduce your business and what you do there.

I’m the president of an investment bank called BA Securities.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with H2Cyber?

We reached out H2Cyber to help us comply with cybersecurity regulations. We’re regulated by FINRA and the SCC.

SOLUTION

What was the scope of their involvement?

H2Cyber helps us with our cybersecurity needs. They’ve taken a look at our system and other cybersecurity-related products to check if there’s anything that we can do to provide better cybersecurity throughout our organization. Their team has actually installed an Endpoint Detection and Response (EDR) software, which allows them to monitor our systems and prevent anyone from breaking in.

What is the team composition?

We work with Paul (Founder & CEO).

How did you come to work with H2Cyber?

It was through a recommendation.

How much have you invested with them?

We’ve spent about $5,000.

What is the status of this engagement?

We started working with them in April 2022, and our engagement is still ongoing.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

We work directly with Paul, who’s been awesome to work with. He’s able to walk us through the entire process, explaining everything that they’re doing in layman’s terms. He’s responsive as well.

How did H2Cyber perform from a project management standpoint?

They’ve been meeting our deadlines and staying within budget. For communication, we interact through phone calls and email.

What did you find most impressive about them?

We really enjoy working with Paul — he’s been doing a great job for us, and his knowledge of the industry is strong.

Are there any areas they could improve on?

I can’t think of anything.

Do you have any advice for potential customers?

Just tell them what you need, and Paul will guide you the entire way.

BACKGROUND

Introduce your business and what you do there.

I’m the chief information security officer for a financial organization.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with H2Cyber?

We needed an external company to do our business impact analysis.

SOLUTION

What was the scope of their involvement?

To start the project, we met with H2Cyber’s team to overview our company’s capabilities and solve our needs by doing a business impact assessment and an updated continuity operations plan. Their team has also interviewed our stakeholders to prepare the reports and documentation to complete our product.

What is the team composition?

We’ve just been working with Paul (Founder).

How did you come to work with H2Cyber?

I’ve worked with Paul on other projects before.

How much have you invested with them?

We’ve spent around $45,000 with them so far.

What is the status of this engagement?

We started working in September 2021, and the engagement is ongoing.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

They’ve been delivering everything that we need to on time, which required them to come to our facilities, work with people they hadn’t worked with before, and gather information to put it all together. I don’t have quantitative metrics of their involvement, but I couldn’t have asked for it to go better.

How did H2Cyber perform from a project management standpoint?

They’re fantastic in terms of project management. For communication, we use phone calls and emails.

What did you find most impressive about them? 

Their professionalism and the quality of their work are outstanding.

Are there any areas they could improve?

I don’t think there’s anything they can improve on. 

Any advice for potential customers?

They’re very experienced and well-versed in information security, so trust their work, and they’ll deliver a good job. I haven’t needed to micromanage them because they understand the work and do what needs to be done.

BACKGROUND

Please describe your company and your position there.

I am the founder and CEO of a consulting firm for independent broker dealers and RIAs. H2Cyber is my cyber expert who works with me to create cyber assessment programs for my clients and is involved in ongoing cybersecurity educational webinars and conference presentations.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire H2Cyber?

H2Cyber is IBDC's cybersecurity expert who provides educational program and consulting services to IBDC's independent broker dealer and RIA clients.

SOLUTION

How did you select this vendor and what were the deciding factors?

Paul Horn is not only one of the most knowledgeable experts in the area of cybersecurity, he is a talented educator and speaker. Paul and I have collaborated on several webinar and conference presentations and are working together on creating cybersecurity assessment programs for financial institutions.

Describe the project in detail and walk through the stages of the project.

Paul customized a cybersecurity assessment program for IBDC independent broker dealer clients and RIAs, which resulted in preferential cybersecurity insurance terms from a cybersecurity insurance carrier. Paul also created and presented detailed educational webinars for financial institutions instructing these companies on DOL, SEC, FINRA and various individual state requirements with respect to cybersecurity practices and protocols. Paul is not only an expert in creating a sound cybersecurity program for financial institutions, he is well versed in cybersecurity protocols established by the numerous regulatory agencies.

How many resources from the vendor's team worked with you, and what were their positions?

I worked with Paul Horn exclusively.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

With the collaborative effort of Paul Horn, a major cybersecurity insurance carrier was willing to reduce its premiums and deductibles based on the cybersecurity assessment that Paul offered to IBDC broker dealer and RIA clients.

How effective was the workflow between your team and theirs?

Paul Horn kept to a tight schedule and was extremely timely with his work product.

What did you find most impressive or unique about this company?

Paul Horn has demonstrated not only an expertise in the area of cybersecurity, but a deep understanding of the broker dealer and RIA industries and the unique cybersecurity challenges these businesses face. He is a talented speaker, clearly delivering vital information in understandable terms and offering sound risk management protocols to avoid a cyber breach. Paul is timely, professional and a pleasure to work with.

Are there any areas for improvement or something they could have done differently?

There are no areas that I can offer in which Paul may improve upon.

BACKGROUND

Please describe your company and your position there.

I'm the head of technology for a leading national financial services distribution firm in the life insurance, wealth management and corporate benefits markets.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire H2Cyber?

We needed a cybersecurity risk assessment from a knowledgeable third-party firm that had relevant experience in our industry, the applicable regulations, requirements and our business model. Based on the results of the initial assessment and recommendations, we engaged H2Cyber, Inc. for a broader project to define and implement a formal cybersecurity program for the company to include administrative, technical and governance controls.

SOLUTION

How did you select this vendor and what were the deciding factors?

We spoke with 3 different cybersecurity firms presenting themselves as experts in our industry. Our due diligence efforts made it clear that H2Cyber, Inc. had the previous direct experience with our industry, clearly understood the confluence and impact of cybersecurity regulations from FINRA, HIPAA, NY DFS and how those relate to standard frameworks, e.g. NIST, etc. as well as articulating the path to best applying those for our company.

Describe the project in detail and walk through the stages of the project.

H2 Cyber performed a thorough risk assessment. Following that they developed a recommended 36 month roadmap to remediate gaps. We engaged H2 Cyber, Inc. as a vCISO and began implementing the necessary policy updates, technical solutions and related governance framework. Now over halfway through the plan, our cybersecurity posture has improved markedly and we are on track.

How many resources from the vendor's team worked with you, and what were their positions?

We worked primarily with the lead consultant as our vCISO. H2Cyber, who also introduced us to a suite of vendors for solutions that were implemented for vulnerability management and remediation, security awareness, asset and vendor management, SOC 2 acceleration and certification.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

The Company's cybersecurity posture as measured by risk assessments increased over 46% in less than an 18 month period.

How effective was the workflow between your team and theirs?

Working with H2 Cyber was efficient and effective. We actually began the engagement in June 2020 (height of COVID) when all our staff was remote. Use of cloud solutions for collaboration, file sharing and more resulted in an effective and timely engagement. H2Cyber is responsive and delivers premium work product on time and within budget.

What did you find most impressive or unique about this company?

H2 Cyber's experience and skills to design and deploy a cybersecurity program with the right mix of policies, vendors and change management to deliver the results we obtained was most impressive.

Are there any areas for improvement or something they could have done differently?

We think for the role and services they were engaged to deliver, H2 Cyber did so in an excellent manner.

BACKGROUND

Please describe your company and your position there.

I work as a project engineer for Invernergy LLC. We help create sustainable energy sources.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire H2Cyber?

We were looking for help updating our internal systems. At the time, we were having trouble with hackers and just wanted to update everything. We chose this company based on their reviews.

SOLUTION

How did you select this vendor and what were the deciding factors?

I selected H2Cyber because they got good reviews and seemed reputable.

Describe the project in detail and walk through the stages of the project.

After the initial meetings, H2Cyber updated our systems to make them more secure. The main thing H2Cyber did was add high grade data encryption so no one could hack and steal anything.

How many resources from the vendor's team worked with you, and what were their positions?

We worked with three IT specialists.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

No one has hacked us since. H2Cyber succeeded in updating our systems to make them more secure.

How effective was the workflow between your team and theirs?

Extremely effective. We were also in communication, whether it be through email or phone 24/7.

What did you find most impressive or unique about this company?

The overall attentiveness to the project was impressive. They always stayed on task.

Are there any areas for improvement or something they could have done differently?

Their services could be a little cheaper.

BACKGROUND

Please describe your company and your position there.

CEO of Stableford Capital Invesment firm

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire H2Cyber?

I needed a complete accessment of where our firm was vuneralble.

SOLUTION

How did you select this vendor and what were the deciding factors?

We interviewed several and were convinced the H2 process complete and ongong

Describe the project in detail and walk through the stages of the project.

They performed a through security audit of you systems, identifying potential risks in our infrastructure. They used Metasploit to carry out penetration testing and Paros Proxy to scan for vulnerabilities. Upon completion they delivered a report on all risks and provided a list of secuity recommendations. The process is ongoing.

How many resources from the vendor's team worked with you, and what were their positions?

We had a project manager, 2 security analysts and a penetration tester.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

They were able to identify far more risks than our internal tests could, and their team is addressing those changes for us. Not only were they thorough, but they also took the time to teach us additional cybersecurity best practices.

How effective was the workflow between your team and theirs?

We are kept updated every step of the way

What did you find most impressive or unique about this company?

Throughness and patience

Are there any areas for improvement or something they could have done differently?

They are very willing and responsive to any concerns or industry requirments .

BACKGROUND

Please describe your company and your position there.

Financial Planning & Wealth Management Firm COO

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire H2Cyber?

Wanted 3rd party audit of our cyber security to protect our client's sensitive information.

SOLUTION

How did you select this vendor and what were the deciding factors?

Vetted through Lion Street connection

Describe the project in detail and walk through the stages of the project.

Full audit of our internal and external technology systems and processes. Discovery process with our team. Initial findings and recommendations. Then received final report with score and next steps to implement highest level of desired security appropriate for our firm.

How many resources from the vendor's team worked with you, and what were their positions?

Paul Horn, CEO

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

The audit revealed that we could increase our level of security on our mobile devices and our laptops when outside of office and worked with our IT firm to implement all the recommendations to heighten our level of security.

How effective was the workflow between your team and theirs?

They had excellent communication with prompt responses.

What did you find most impressive or unique about this company?

How thorough the process was and that it gave us peace of mind that we are doing things right to best protect the sensitive data of our clients.

Are there any areas for improvement or something they could have done differently?

No. Recommended adding an annual audit badge that companies can use to illustrate their desire to protect their client's sensitive data.

BACKGROUND

Please describe your company and your position there.

Managing partner

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire H2Cyber?

Cyber Security

SOLUTION

How did you select this vendor and what were the deciding factors?

Reference from strong source. IBDC RIAC.

Describe the project in detail and walk through the stages of the project.

Paul went through all our weak points for technology. We were able to patch those areas with tech to safeguard and monitor.

How many resources from the vendor's team worked with you, and what were their positions?

We worked exclusively with Paul.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

Feeling of security.

How effective was the workflow between your team and theirs?

Good.

What did you find most impressive or unique about this company?

Their background was impressive.

Are there any areas for improvement or something they could have done differently?

No.