Vumetric

BACKGROUND

Please describe your company and position.

I am the Director of a software company

Describe what your company does in a single sentence.

Our company is a leader in banking, accounting, and business software, SaaS solutions, and cloud computing. We also offer a wide range of specialized consulting services covering strategic advising, IT management and infrastructure, payment solutions, custom development, and full integration of our own and of our partners’ ERP solutions

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Vumetric Cybersecurity to accomplish?

• Penetration testing of a web application

SOLUTION

How did you find Vumetric Cybersecurity?

Referral

Why did you select Vumetric Cybersecurity over others?

• High ratings
• Close to my geographic location
• Pricing fit our budget
• Referred to me

How many teammates from Vumetric Cybersecurity were assigned to this project?

2-5 Employees

Describe the scope of work in detail. Please include a summary of key deliverables.

The project was for Vumetric to do an analysis of our web application's attack surface, and perform automated and manual penetration testing, from the perspective of both anonymous attacker and a malicious authenticated user. 

The key deliverables were: 

• Detailled report of the findings, sorted by criticality level, detailed description and recommendations to address each finding; 
• Conference call to present the report, explain and discuss the findings and proposed solutions; 
• Re-test of the findings rated major and critical, avec we implemented the fix.

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

The project gave us a better insight on the security posture of our application, and the feedback from the security professionals involved in the project was useful to find the best solution to address the findings.

Describe their project management. Did they deliver items on time? How did they respond to your needs?

All projects stages were delivered on-time; they were able to accommodate our schedule to work around product deployment schedules.

What was your primary form of communication with Vumetric Cybersecurity?

• Virtual Meeting
• Email or Messaging App

What did you find most impressive or unique about this company?

They had friendly staff and realistic and down-to-earth recommendations. The scoping work done at the start of the project was instrumental in deciding where to prioritize the pentesters time and efforts to get the best cost-effectiveness.

Are there any areas for improvement or something Vumetric Cybersecurity could have done differently?

none that I can think of

BACKGROUND

Please describe your company and position.

I am an executive at a manufacturing company

Describe what your company does in a single sentence.

We are a complete water solutions company focused on providing best-in-class technologies and services to its customers.

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Vumetric Cybersecurity to accomplish?

• Firewall and websites security audit
• Compliance to cybersecurity requirements
• Improve our cybersecurity

SOLUTION

How did you find Vumetric Cybersecurity?

• Referral

Why did you select Vumetric Cybersecurity over others?

• High ratings
• Referred to me
• Specialists - Knowledge

How many teammates from Vumetric Cybersecurity were assigned to this project?

2-5 Employees

Describe the scope of work in detail. Please include a summary of key deliverables.

We retained Vumetric to perform a penetration test of their external network. The tests were performed in a production environment. A penetration test was conducted to identify and verify the presence of security weaknesses and vulnerabilities within the targeted systems and components.

A report was produced to reflect the findings of this project and help our organization improve the security status of our different target systems and components against threats and risks. The goal is to minimize risk and reach a level of security that meets our expectations, thus ensuring the confidentiality, integrity, and availability of our information assets.

For each of the security vulnerabilities identified, Vumetric presented the technical details, the level of risk as well as the list of recommendations and appropriate mitigation strategies. The penetration testing methodology used in this project is based on the industry’s best practices and is continually updated to reflect the changing nature of IT as well as the latest attack methods employed by hackers.

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

DETAILED REPORT - EXTERNAL PENETRATION TEST

Describe their project management. Did they deliver items on time? How did they respond to your needs?

On time, on budget with high level of professionalism. They delivered the project as expected.

What was your primary form of communication with Vumetric Cybersecurity?

• Email or Messaging App

What did you find most impressive or unique about this company?

They know what we wanted and were able to conduct the pen-test, produce a professional report and bring accurate and relevant advices.

Are there any areas for improvement or something Vumetric Cybersecurity could have done differently?

None that I can think of.

BACKGROUND

Introduce your business and what you do there.

I’m an executive at Focus, a B2B distributor of office furniture. 

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with Vumetric Cybersecurity?

We hired Vumetric Cybersecurity to do a 360 audit of our technology and a penetration test. 

SOLUTION

What was the scope of their involvement?

Vumetric Cybersecurity has done phishing and other tests on our platforms to ensure we’re secure. After the tests, they report their assessments and give us recommendations. The other tests they’ve done include network testing, general security testing, and website testing. Moreover, the team has set up our KnowBe4 platform for cybersecurity training and compliance documentation.

What is the team composition?

We work with 5–6 people from Vumetric Cybersecurity. Our main point of contact is Stephanie (Customer Experience Coordinator). 

How did you come to work with Vumetric Cybersecurity?

Vumetric Cybersecurity was a referral from someone I knew who was using them. I checked out their website and saw everything they’d done, and I asked them for a call. 

How much have you invested with them?

We’ve invested around $75,000. 

What is the status of this engagement?

Our engagement started in September 2022, and we work with them every quarter.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement? 

We like the in-depth knowledge of Vumetric Cybersecurity’s resources. Our network and website are definitely more secure now. 

How did Vumetric Cybersecurity perform from a project management standpoint?

All deadlines are agreed upon between our teams, and we’re always on track with the timelines we put in place. Vumetric Cybersecurity has a platform where we can interact with the team. We can enter our questions into the platform and receive partial reports and recommendations. At the end of every test, we get an entire report generated by the platform. It has plenty of terrific information available to us. We also use Teams and have access to monday.com. 

What did you find most impressive about them?

I’m impressed with their knowledge and their platform because everything is there. It’s easy to get the reports they produce because they’re all on the platform. 

Are there any areas they could improve?

No, there aren’t any. I wouldn’t do anything differently since everything’s going well. 

Do you have any advice for potential customers?

Use Vumetric Cybersecurity’s platform to a great extent. 

BACKGROUND

Please describe your company and position.

I am the IT Director of company

Describe what your company does in a single sentence.

We collaborate with all to eliminate food insecurity and advocate for solutions to end poverty.

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Vumetric Cybersecurity to accomplish?

• Cybersecurity risk assessment

SOLUTION

How did you find Vumetric Cybersecurity?

Online Search

Why did you select Vumetric Cybersecurity over others?

• Close to my geographic location
• Great culture fit
• Great scoping call with Vumetric compared to other security firms

How many teammates from Vumetric Cybersecurity were assigned to this project?

2-5 Employees

Describe the scope of work in detail. Please include a summary of key deliverables.

The assessment focussed on identifying vulnerabilities and potential security weaknesses in externally accessible systems and the organization's internal IT systems and network infrastructure. Key areas of assessment include:

• External Network Perimeter: Assess security controls, including firewalls, IDS/IPS, and VPNs.
• File Servers and Domain Controllers: Assess access controls, permissions, and configurations.
• Cardholder Data Environment (CDE): Assess the security of systems and networks that process cardholder data to ensure compliance with PCIDSS requirements.
• Network Devices: Assess configurations and authentication mechanisms of routers, switches, firewalls, and wireless access points.
• Authentication Mechanisms: Evaluate authentication protocols, test for credential relaying and password spraying.
• Network Services and Applications: Examine network services and filesharing services for vulnerabilities.
• Network Shares and Data Storage: Assess permissions, access controls, encryption, and exposure of sensitive information.
• Legacy Systems and Outdated Software: Identify systems missing critical security updates or with known vulnerabilities.
• Endpoint Security: Evaluate security configurations, patch management, antivirus, and malware protection.
• Internal Network Segmentation: Assess network segmentation and potential bypasses for lateral movement.

Deliverables

The Vumetric team delivered a comprehensive report summarizing the findings and recommendations from the security assessment, with consideration given to PCI-DSS compliance requirements. The report included an executive summary, a prioritized list of identified vulnerabilities, and suggested mitigation measures, along with an assessment of the network infrastructure’s alignment with PCI-DSS standards.

They also offered a report presentation to clarify findings and address any client questions. This reporting very thorough and easy to understand and action the findings to allow our team to remediate.

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

• Regular touch points to ensure progress
• Technical support during testing phases to ensure proper configuration
• Multiple sessions to review findings along with excellent report highlighting findings and remediation details.

Describe their project management. Did they deliver items on time? How did they respond to your needs?

Vumetric kicked off engagment with meeting to review timeline of activities and deliverables. They were very receptive to aligning timing of some of their scanning activities to another of our projects to ensure best data was collected. All of the Vumetric team were very responsive via phone or email when questions arose and we had issues during data collection immediately corrected, All of the deliverables were delivered on time.

What was your primary form of communication with Vumetric Cybersecurity?

• Virtual Meeting
• Email or Messaging App

What did you find most impressive or unique about this company?

We reviewed 7 firms for our security risk assessment and they really took the time to understand our business and align the engagement to our needs. They also work closely with our IT Director to ensure they aligned engagement timing to our expectations.

Are there any areas for improvement or something Vumetric Cybersecurity could have done differently?

In the future, we will likely work closely with them following the engagement to request support and their professional advice on tools or best practices beyond the engagement scope to plan for budgeting and next steps.

BACKGROUND

Please describe your company and your position there.

Promoting retirees’ financial security, health and well-being, our company is the largest national advocacy organization representing active and retired members of the federal public service, Canadian Armed Forces, Royal Canadian Mounted Police (RCMP) and retired federally appointed judges, as well as their partners and survivors. I am the IT Systems Administrator

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Vumetric Cybersecurity?

We were seeking an external cybersecurity audit and penetration testing within our platforms and to get a report on current status and a roadmap for moving forward.

SOLUTION

How did you select this vendor and what were the deciding factors?

We used an RFP process with a weighted system for responses. Vumetric won over the other proposals that we received. The main deciding factors were: not-for-profit experience, cost and quality of the proposal.

Describe the project in detail and walk through the stages of the project.

Vumetric performed 3 phases of their penetration testing and cyber security audit. Phase 1 was the external penetration test. Phase 2 was the cybersecurity audit, comprised of both discovering of our environment and reviewing findings. Phase 3 is the Phishing Test.

How many resources from the vendor's team worked with you, and what were their positions?

We had:

• a project manager
• 2 penetration testers
• a customer experience coordinator

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

Their penetration tests discovered a surprising issue that we were able to address immediately and provided an excellent report on rated issues: Critical, High, moderate and low.

How effective was the workflow between your team and theirs?

Vumetric reps were very responsive and quickly answered any questions.

What did you find most impressive or unique about this company?

Their professionalism and quick response times were impressive from the start of the project. The report that was provided was very well written and prepared us to action items.

Are there any areas for improvement or something they could have done differently?

I wouldn't change a thing.

BACKGROUND

Please describe your company and your position there.

I'm the VP of Technology for a company providing safety solutions for lone or at-risk workers.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Vumetric Cybersecurity?

We wanted a pen test done as part of our information security program.

SOLUTION

How did you select this vendor and what were the deciding factors?

We were connected to this company via a federal government program.

Describe the project in detail and walk through the stages of the project.

The project started with an initial kickoff meeting where we scoped the work. It ended up being a simple black-box pen test of our main domains. After that Vumetric went away and did the testing over the course of a week or two and provided the results shortly after that. The end report was clearly written and I did not have any questions and needed no clarifications with regards to the findings.

How many resources from the vendor's team worked with you, and what were their positions?

Two resources, one was a manager of a security team and one was an analyst who did the pen-test and compiled the results.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

The final report found a few vulnerabilities which we did not realize existed, which is success for us.

How effective was the workflow between your team and theirs?

It was kept simple, no unneeded meetings. One to kick off the project and then a couple emails back and forth to gather info and deliver results. Worked very well.

What did you find most impressive or unique about this company?

We liked how they kept the project and process simple.

Are there any areas for improvement or something they could have done differently?

At this point, I have no feedback for improvements to their process.

BACKGROUND

Please describe your company and your position there.

Manager of IT Operations, performing audit compliance and security Best Practices for a law firm.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Vumetric Cybersecurity?

Fulfilling security requirements and correcting areas of concern or weakness.

SOLUTION

How did you select this vendor and what were the deciding factors?

Discussed with VuMetric and number of their associates the scope, the process. How reporting would be handled, including remediation and retesting.

Describe the project in detail and walk through the stages of the project.

Our firm had a need to have an external penetration test performed. I vetted three different options and selected VuMetric. My selection was based on the clarity of the scoped work and how we would handle communications, along with proving to be a solid partner for annualized work. The process to select VuMetric took about 60 days or less. Once the project was started, our account rep, had me scheduled with their project manager quickly and the work began. Results were provided quickly, we stayed in communication while the reported issues where remediated. Once remediation occurred our retesting happened in the same fashion as the initial pen testing.

How many resources from the vendor's team worked with you, and what were their positions?

We worked with three different members: Sam - Account Representative Alex - Project Management Bruno - Engineer

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

Our success in remediating all described issues allowed for us to fulfill external firm assessment requirements.

How effective was the workflow between your team and theirs?

They delivered what was asked, a report of all found issues, internally myself and my team worked to remediate the issues, retesting was requested until all items were successfully remediated.

What did you find most impressive or unique about this company?

The forth coming nature of everyone there. There were questions I had about other products or certifications for assessments and the level of attention and information helped me immensely.

Are there any areas for improvement or something they could have done differently?

Not that I experienced.

BACKGROUND

Please describe your company and your position there.

I’m the General Manager of an architecture and planning practice of 100 people in Toronto Canada.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Vumetric Cybersecurity?

External and internal penetration testing

SOLUTION

How did you select this vendor and what were the deciding factors?

We asked three companies to quote - one was recommended by our MSP and the other two we found online. Factors we were looking for were price, reputation and fit in terms of what it would be like to work with them. We preferred a Canadian company but were open to foreign firms too. Vumetric’s reviewes were excellent, price was competitive and they had the best interview.

Describe the project in detail and walk through the stages of the project.

They did external and internal penetration testing and supplied a thorough report, which they then walked us through. When we needed an extract of the report to send to a partner regarding one area of remediation, they provided it at no extra charge. Very smooth process and I feel very confident in the report they produced.

How many resources from the vendor's team worked with you, and what were their positions?

We had contact with three or four people - some technical and some more sales oriented but they all had been very well-trained, professional, and confident. - but not cocky !

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

We undertook this as a recommendation from our MSP following a serous cyber hacking near-miss that took our network down for two days. Vumetric gave us an objective measure of our security and showed us where we were vulnerable. They made the process very smooth.

How effective was the workflow between your team and theirs?

They were very responsive and organized, strong communicators.

What did you find most impressive or unique about this company?

They really impressed us as specialist in their field - we hope we come across as well when we go out into the world to sell our own services!

Are there any areas for improvement or something they could have done differently?

No

BACKGROUND

Please describe your company and your position there.

Ai-RGUS is Artificial Intelligence software to verify that security cameras are operating optimally and alerts you automatically otherwise. It verifies the camera view as well as connectivity and recording availability. I am the CEO and Chief Scientist.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Vumetric Cybersecurity?

Our service is cloud based and for certain installations it also requires a custom developed software component to be installed on the client's computer system.

The scope of the project was a standard penetration test on our cloud infrastructure and then to validate our assertions about the cybersecurity of the custom software piece (i.e., it only uses HTTPS, does not cause inbound traffic, and does not attempt to subvert internal access mechanisms by creating a VPN tunnel)

SOLUTION

How did you select this vendor and what were the deciding factors?

Searched online. They demonstrated a clear understanding of the scope of the project and their initial proposal was immediately relevant. Their expertise and the work they proposed to do was clearly stated.

We compared their quote & statement of work against several other companies but the price with Vumetric was much better than the others.

Describe the project in detail and walk through the stages of the project.

Vumetric tested all parts of our cloud infrastructure and of the custom tool and provided us with updates as they said they would. They notified us of a critical vulnerability so we can immediately work on fixing it. They then provided a full report of their findings. The report was clearly written, with clear documentation of the problem and with clear explanations for how and why these items should be addressed.

After giving us some time to remediate the issues they found they retested. Initially they said they would only retest critical and high vulnerabilities but graciously agreed to also retest our fixes to medium and low-security issues. We received a final report stating their scope of work and their findings which we can share with potential customers and to fulfill our contract obligations with existing customers

How many resources from the vendor's team worked with you, and what were their positions?

A senior tester, two junior testers, a salesperson, and a secretary

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

We received a detailed report about the items to remediate, a report showing that we remediated those issues and a letter that we are a certified "pen-test" solution.

How effective was the workflow between your team and theirs?

Very effective. We were able to fix and identify all issues and receive confirmations instantaneously.

What did you find most impressive or unique about this company?

Ability to perform high quality work at a much better price than others in this market.

Are there any areas for improvement or something they could have done differently?

The purpose of the reports and how they would be used was not entirely clear which led to some confusion. Also, their idea and our idea of an "executive report" was quite a bit different but we communicated about this and got the explanations we needed and came to agreement about the final deliverables.