XM Cyber and IQUW: Focusing Effort Where it Matters Most

TL;DR

IQUW, a specialty re-insurer managing 15+ lines of business, found that traditional vulnerability management tools couldn't prioritize real risk. XM Cyber cut remediation costs by 70%, identified an exposure on a client-facing asset within six weeks that no other tool had caught, and freed up IT staff to focus on revenue-generating digital transformation work.

The Challenge

As Group CISO of luxury re-insurer IQUW, industry veteran Stephen Owens knows it’s impossible to fix all issues that could put a business at risk. Together with his expert security team, they employ a risk-based approach to fixing what matters most, and understanding where to concentrate remediation efforts.

They used traditional approaches to Vulnerability Management, but all failed to provide the prioritization they needed to focus resources. “I’ve got a lot of experience in vulnerability management in different programs and it’s very old fashioned. It strangles a business and IT to go to the old ways of 30, 60, 90 days. It’s not the correct way for the business and handling their risks,” says Owens.

The Solution

Owens heard about XM Cyber hiking across the African desert. “I discovered XM Cyber in my wilderness period, had some demos and realized it’s a great asset and capability to have in your armory. So as I landed at IQUW, I knew XM Cyber was going to help me focus where to spend our efforts. As soon as possible, I reached out and it really has landed well for us and helps us focus on the teams’ particular efforts,” says Owens.

The decision to implement XM Cyber came after extensive market research and consultation with industry peers. The selection process included a successful proof of concept that demonstrated immediate value, particularly in identifying previously undiscovered exposures in client-facing assets.

“Six weeks in, there was a moment on one of our client-facing assets. We found an exposure where other security tools hadn’t discovered it and XM Cyber had.”

Stephen Owens, Group Chief Information Security Officer, IQUW

“Six weeks in, there was a moment on one of our client-facing assets. We found an exposure where other security tools hadn’t discovered it and XM Cyber had.” This experience helped solidify their decision and they deployed the platform across their ecosystem. The implementation was notably smooth, with fast adoption facilitated by alignment with existing security concepts and strong API integration capabilities.

Benefits & Outcomes

Quantifiable Risk Reduction

XM Cyber has helped Owens and his team significantly reduce costs. "It's probably saved over 70% of a classical IT remediation program. There are monetary terms from a salary perspective, but the hidden benefits are it's freeing up those individuals if we're going through a digital transformation to focus on other business processes, which generate a higher revenue." He continues:

"So on the face of it, you're saving approximately 70% of cost. But in actual fact, there's a larger business benefit. You're enabling other team members to do other business-focused activities as well. So there are some big benefits from a cost saving perspective and revenue generation perspective."

Stephen Owens, Group Chief Information Security Officer, IQUW

Lowered Risk Appetite

Additionally Owens says, "it lowers risk with choke points, where multiple attack paths come together – And if you nip that bud in, it makes it very difficult to perpetuate that attack down the chain. So, really it does lower that risk appetite for us. XM Cyber helps us on the metrics and to define that resistance." This is because addressing choke points enables teams to cut off multiple pathways to damaging attack paths at once.

Better Demonstration of ROI

The company faces ongoing challenges in quantifying security investments and optimizing resources during digital transformation. They've addressed these challenges through a structured approach to risk management, using tools like the FAIR framework and XM Cyber's capabilities to provide concrete metrics for security investment decisions. This approach has enabled them to better demonstrate ROI for security initiatives and make more informed decisions about resource allocation.

Looking forward, they continue to balance security requirements with business efficiency while managing a diverse IT infrastructure. The implementation of XM Cyber has positioned them well to address these challenges, particularly through its industry-first capability to correlate external attacks with internal vulnerabilities. The strong product roadmap and vision suggest continued advancement in security capabilities, maintaining their competitive advantage in the security solution space.

Key Takeaways

• XM Cyber cut remediation costs by roughly 70%, and the IT staff freed up by that efficiency shift moved to revenue-generating digital transformation projects. 
• Six weeks into deployment, the platform found an exposure on a client-facing asset that no other security tool had detected - the moment that sealed the decision to go live. 
• The remediation advice comes with two or three options per issue and goes straight to IT without a security engineer needing to translate it. 
• Choke point analysis lets the team shut down multiple attack paths with a single fix, which measurably lowers the organization's risk. 
• Stephen Owens, Group CISO, recommends XM Cyber to fellow CISOs: "Once you see the problems, you can't unsee them. That's very powerful."