Login
Velocity Goes Freemium

Velocity Goes Freemium

by | Mar 17, 2022 | Strategy

Background

Our company mission is to “Secure the Planet”.  This means that we aim to provide education and solutions that any company in the world can use to reduce cyber risk.  Our flagship product, Velocity, is a web application (SaaS product) which companies can use to evaluate their own cybersecurity posture as well as to evaluate cyber risks in all of their third-party vendors.  While we strive to have fair pricing and various levels that companies of any size can subscribe to, it’s clear that some organizations simply do not have funds budgeted to spend on cybersecurity or to try new products. We’re moving Velocity to a freemium model so any company can measure their baseline security posture for free.

Details

If we’re serious about securing the planet and providing solutions for all organizations regardless of size and budget, we needed to expand our offerings. From my many years working in the cybersecurity industry, both on the customer side and the consulting side, I know that many organizations do not evaluate their security posture at all.  Many of those that do, still measure their security posture using an inefficient, often inaccurate, spreadsheet approach. They list every cybersecurity measure that they should be doing in one column and then they state whether they are completing the task or not in another column.  It’s easy, but inefficient, painful to manage, difficult to track progress, and tough to update.  Velocity eliminates the need for spreadsheets to measure internal risk with these known frameworks. The free version of Velocity is an easy and economical tool for any company in the world to measure their cyber security posture.

What is included?

In the free version of Velocity, companies can evaluate their own security posture using any of several frameworks.  Additionally, companies receive access to dashboards that give critical insight into their security posture.  As an added benefit, companies  eliminate the use of inefficient spreadsheets to evaluate risk.  The frameworks that are included in the free version of Velocity are as follows:

  1. CISA Shields Up – To address increased risk due to Russia’s invasion of Ukraine, the Cybersecurity & Infrastructure Security Agency (CISA) released security guidance for organizations.  This free valuable guidance is built into Velocity. We will continue to update this significant resource on Velocity as the guidance updates and transforms.
  2. CMMC 2.0 Level 1 – In late 2021, the Department of Defense (DoD) released CMMC 2.0 which is designed to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI).  There are three levels within this model and most defense contractors will need to adhere to Level 1. Organizations can evaluate their compliance with Level 1 CMMC 2.0 for free within Velocity. The smaller subset of organizations that access more classified information can pay for a Velocity subscription to evaluate their compliance with the higher levels within this framework.  Our company pays to have certified CMMC staff.  For more information on CMMC, please review our latest article on the subject:  https://www.sternsecurity.com/blog/cmmc-2-0-program-update/
  3. CIS v8 Group 1 – The Center for Internet Security (CIS) has a well-known list of cybersecurity controls that are recommended for all organizations.  The latest version (v8 as of this writing) splits the security framework into three groups depending on the size and cybersecurity maturity of the organization.  The free version of Velocity includes the first group, Implementation Group 1.  Organizations looking to evaluate their maturity with Groups 2 and 3 can upgrade to a paid subscription within Velocity.  Our company pays an annual license fee to utilize this security framework.

How do we pay for this?

We have to pay for this somehow as we definitely cannot help secure the planet if we don’t have the funds to run our product.  While several frameworks (or parts of frameworks) are free, we have over 10 other major security and compliance frameworks that companies can pay a subscription for. We continue to add more frameworks.  We pay subscription fees which we pass on to companies who subscribe to additional features within Velocity.  Additionally, we charge companies to evaluate the security posture of their vendors.  While utilizing the free version, there is an easy path to upgrade to a paid subscription to utilize other frameworks or evaluate vendors.

How do I get my free account?

Go to https://www.velocitysec.com and create your free account today!

Conclusion

I’m incredibly excited to announce our freemium version of Velocity.  This is the result of months of hard work from an amazing team.  We are so proud of the result and what it can do for the world.  Now that Velocity is offering this freemium model, we see a clear path to making our motto “Secure the Planet” a reality.  Velocity is not going to solve every cybersecurity problem, but it does give organizations actionable items they can perform to reduce risk.  Now any company in the world can measure their baseline security for free on a beautiful web interface.

Sincerely,
Jon Sternstein, Founder

Third-Party Breach Threat – A Need for Vendor Risk Evaluation

Third-Party Breach Threat – A Need for Vendor Risk Evaluation

by | Sep 13, 2021 | Third-Party Risk Management

If the SolarWinds hack taught us anything, it’s that the security of a company’s infrastructure is dependent on the resilience of their vendors. A breached vendor is a trojan horse that bypasses normal defenses and accesses the trusted areas of the network. Threat actors have cunningly discovered that a trusted vendor is often the easier path to infiltrate their primary target. Some of the top cybersecurity technologies in 2021 focus on vendor risk evaluation.

Even if companies have internal security teams, evaluating vendor risk is a resource intensive process. Most organizations utilizing spreadsheets to create vendor questionnaires. After several back-and-forth emails and several weeks, the vendor completes the questionnaire. Next, begins an equally long process of internal deliberations to give the vendor a risk score. This process can take months for a single vendor. The current vendor security review process that most organizations perform is inefficient and varies in accuracy. Meanwhile, vendor breaches continue to skyrocket. In the healthcare industry, 21.1% of breaches were caused by vendors (business associates) from 2009 to December 31st of 2019. However, in 2020, breaches from vendors spiked to 39.7%!

Third party breaches in the healthcare industry from 2009 through 2019 (Source: HealthcareBreaches.com)

Vendor breaches in the healthcare industry greatly increased in 2020:

Third Party breaches in the healthcare industry in 2020 (Source: HealthcareBreaches.com)

A strong vendor risk evaluation solution is critical to combat these issues. A good vendor risk management product adds efficiencies, reduces cost, and increases security for organizations and vendors. These solutions automate much of the manual work and consolidate the vendor evaluations into a few places. Instead of every single customer performing their own evaluations, these solutions perform the work. These solutions can evaluate hundreds of vendors at once instead of the inefficient spreadsheet questionnaire evaluations and countless vendor security meetings that many organizations perform today. Internal vendor evaluations will become a process of the past and replaced by vendor risk management solutions.

Vendor security should be evaluated before the contract is signed. Vendors have incentive to strengthen security if their customers are grading them as part of the product evaluation and contract negotiation. If they want the business, they better have good security.

This field continues to grow rapidly as vendor breaches spike in frequency. Vendor risk management solutions will help combat this issue and shine the spotlight on third-party security. Without a doubt, this is one of the top cybersecurity segments in 2021. Proper vendor evaluation is needed to increase security and reduce risk.