Texture Side Right Grey 01

Security Validation Technology

Counter the evolving threats to government networks and infrastructure

Start validating cybersecurity effectiveness with evidence-based data, realize ROI from your cybersecurity strategy, and measure against cybersecurity KPI's.

Mandiant Security Validation

Introduction to Security Validation

Meet your new end-to-end cybersecurity strategy and validation process

Mandiant Security Validation instruments IT environments at scale to test the effectiveness of network, endpoint, email and cloud controls. Continuously execute tests and analyze results to proactively alert on drift from a known-good baseline and validate control configuration. The end result is you are now equipped with evidence demonstrating if an environment's controls are actually delivering the desired business outcomes.

How Security Validation Technology Works

1-white

Consultation

Schedule a meeting with a technical advisor and account consultant to learn more about your unique needs.

2-white

Evaluation

We will formulate an ideal combination of the main platform, additional modules, and actors.

3-white

License & Implementation

Licensing Mandiant Security Validation is straightfroward and your director is available within weeks.

The Director

Your primary interface to validate all aspects of your platform

The director can be thought of as the "central brain" of Mandiant Security Validation. The director is available as a SaaS platform (our cloud or yours), or as an on-premises solution in both virtual appliance and installable software formats.

Mandiant Security Validation
Mandiant Security Validation

Integrations

250+ Integrations with industry-leading technologies

The Director seamlessly integrates with an organization's defensive stack across network, endpoint, email and cloud controls. These integrations enable the director to continuously validate how effective controls are and where they are misconfigured.

Actors

Replicate realistic attacks across a range of type and sophistication

Mandiant Security Validation actors perform tests in the production IT environment to validate and assess controls effectiveness. Actors come in four primary control types to ensure test safety and provide a granular, in-depth understanding of defense posture.

Mandiant Security Validation
Network Controls

Network Controls

Network controls inspect network traffic and act as both the source and destination of a test, sending traffic between each other to see how the network control responds.

Email Controls

Email Controls

Email controls counter phishing, emails containing malware, and data leaving the production IT environment. Tests include Microsoft Exchange, Office 365, and others.

Endpoint Controls

Endpoint Controls

Endpoint actors execute tests within a user context to measure access to resources, attempt privilege escalation, exfiltrate data, and other behaviors across the kill chain.

Cloud Controls

Cloud Controls

Cloud actors test commonly deployed AWS and Azure controls. Virtual host and API options are available, depending on cloud platform and services being tested.

Mandiant Security Validation

Effectiveness Validation Process (EVP)

Validate that your controls are working properly against threats as configured with detection, alert, miss, and prevention rates in real time

As the Director instructs Actors to run tests, it continuously validates by querying the controls in the environment to determine what they are seeing, which are blocking, what detection events are generated, and if those events are properly formatted and make it through the network maze to their destination. Once at their destination - likely a SIEM, log management platform, or analytics engine - the Director validates that the events are properly timestamped, correctly parsed, and if the correlation rules and threat models defined actually generate an alert.

Dashboards & Reports

Rest safely with an accurate understanding of your overall cybersecurity posture

The Director analyzes the results of the tests run in the environment and provides reports designed to enable customers to measure and validate where their effectiveness is today, manage the dynamic environment and evolving threat landscape on a daily basis, and show improvement over time with real, evidence-based data.

Mandiant Security Validation
Advanced Modules

Additional components applied with Mandiant Security Validation for enhanced security posture and special use cases.

Threat Actor Assurance Module (TAAM)

Combine the latest threat intelligence from our partners with Mandiant Security Validation to automatically test defenses against ever-evolving threat actor behaviors, visualize results, and enable your business to achieve optimum protection.

Advanced Environmental Drift Analysis (AEDA)

Advanced Environmental Drift Analysis (AEDA)

AEDA performs automated and continuous analysis of this Effectiveness Validation Process (EVP) compared to the known-good baseline across a customer's business zones. AEDA constantly analyzes the environment for drift and proactively bringing it to your attention before it is too late.

Protected Theater

Protected Theater

Protected Theater is not required for testing endpoint controls, but it offers the ability to safely perform potentially dangerous and destructive tests on customers' endpoint defenses with real malware to determine what threats their endpoint controls will and will not block.

Cloud Theater

Cloud Theater

Cloud Theater is a Mandiant-hosted external actor that can be used for ingress and egress tests like malware download, C2 traffic and data exfiltration. Some organizations choose to host their own external Actors, while others use a mix of Cloud Theater and their own hosted Actors.

Frequently Asked Questions

Have a question that hasn't been answered here? Get in touch with us today.
Does Mandiant Security Instrumentation Platform require integrations to work?

No. Mandiant SIP does not require integrations to work. It can run tests and provide basic results without them. However, integrations are essential to providing evidence of the effectiveness of cybersecurity controls. Most organizations are leveraging as little as 25% of the prevention functionality of their controls due to misconfiguration, weak out-of-the-box configurations and environmental drift. Mandiant SIP's integrations enable it to provide the customer a prescriptive set of steps to quickly optimize those controls. Without this level of visibility, it is impossible to clearly understand the results of tests.

Platforms that simply provide a list of attacks that are "blocked or not" do not provide the complete picture an organization needs to make decisions and, worse, encourage a path forward based on inaccurate assumptions.

Are integrations complicated to install and configure?

No. Mandiant SIP leverages the control’s native APIs for the integration, making it quick and easy to set up. Integrations are provided “out of the box” with the Director, so there is nothing to install. Typically, all that is required for configuration is a valid, read-only user account and password from the control.

What types of controls does Mandiant SIP test?

Mandiant SIP can validate the effectiveness of network, endpoint, email and cloud controls. Common network controls tested include next-gen firewalls (NGFW) and traditional firewalls (FW), intrusion detection systems (IDS), intrusion prevention systems (IPS), malware sandboxes, web application firewalls (WAF), proxies and data loss prevention (DLP) systems. Common endpoint controls tested include tools like anti-virus (AV), host-based intrusion prevention systems (HIPS), software firewalls, and detection and response tools (EDR). Beyond traditional endpoint controls, Mandiant SIP can also be leveraged to validate user and group policies, as well as Active Directory Group Policy (GPO) and even identify and access management (IAM) solutions.

Does Mandiant SIP test endpoint controls?

Yes. Verodin can test controls on Windows, Mac and Linux endpoints. Tests can be run in the context of a user leveraging the host’s command line interface or even tools like Powershell on Windows systems.

Does Mandiant SIP have a rest API?

Yes. The Director is effectively an API server that the web UI is built off of. Mandiant has a fully documented REST API and is committed to making 100% of SIP’s functionality available, accessible and executable from the REST API.

Does my team need to be "mature" to get value from Mandiant SIP?

No. Mandiant's customers range from mid-market organizations with a security team of 2-3 employees and a technical CISO all the way up to the largest Financial Services and Oil & Gas companies in the world. SIP is both powerful and extremely easy to use. For less mature organizations, Mandiant SIP provides a platform to maturity. SIP enables their defenders to be more offensive and helps guide them along the path of ultimately providing the evidence needed to know their cybersecurity controls are effective.

Is Mandiant SIP a Breach and Attack Simulation (BAS) tool?

The Breach and Attack Simulation (BAS) “category” has a pretty loose collection of vendors that don’t fall into more traditional categories and, in some situations, are not even competitive. This is not unusual for early markets and, over time, will likely break into at least three more distinct categories: companies focused on providing the business evidence of controls effectiveness, companies providing an attack simulation tool for the purpose of essentially becoming "vulnerability scanning 2.0", and companies specifically focused on advanced threats and realism of using those advanced threats for high-skill training.

Mandiant provides the ability to quantify if cybersecurity controls are effective and properly offsetting the business’ risk as intended. To do this, we focus on validating that controls are correctly configured, identifying where controls can be optimized, quantifying control gaps and overlap, and then continuously validating the environment against a known-good baseline in order to detect and quickly remediate environmental drift.

Strengthen Your Security Team

Whitepaper

Automate Testing Against MITRE ATT&CK

By automating MITRE ATT&CK emulations, your team is freed from labor intensive, manual testing. Begin generating results within hours of initial implementation by leveraging our security content library and mapping tools.

Faster Implementation

Faster Implementation

Begin generating results within hours by leveraging our security content library and mapping tools.

Save Time & Money

Save Time & Money

Free your team from labor intensive, manual testing by automating MITRE ATT&CK.

Identify Gaps Sooner

Identify Gaps Sooner

Easy to understand dashboards provide visualized data over time against your known baseline.

More Accurate Results

More Accurate Results

Our robust library of attacks across all 12 threat vectors fully represent the attack lifecycle.

Increase Confidence

Increase Confidence

Continuously validate your defense coverage by safely executing attack behaviors.

Best in Class

Best in Class

While most companies focus on basic subset coverage, we provide full depth of the adversary landscape.

Texture Side Right Grey 03

Advanced Module

Threat Actor Assurance Module (TAAM)

Add TAAM today to make the latest threat intelligence actionable. Integrates with leading threat intelligence providers and allows for highly detailed threat actor testing within MITRE ATT&CK framework.

Automate Integration

Automate Integration

Information is automatically retrieved and collected from third party threat intel integrations, with consolidated actor

MITRE ATT&CK Ready

MITRE ATT&CK Ready

Tactics, techniques, and procedures are mapped to the MITRE ATT&CK framework.

Perform Tests

Perform Tests

Security defenses are tested with the same behaviors used by your adversaries.

Present Results

Present Results

Gain an accurate understanding of which threat actor groups could compromise your organization.

Strengthen Your Security Team

Featured resources for Leadership & Board

Starting security validation from scratch?

Chances are you're ignoring valuable security data that can be gathered via instrumentation.
Future-proof your security posture today.