{"id":9045,"date":"2026-08-06T13:45:02","date_gmt":"2026-08-06T13:45:02","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=9045"},"modified":"2026-08-06T13:45:02","modified_gmt":"2026-08-06T13:45:02","slug":"how-a-global-investment-firm-reduced-security-surprises","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=9045","title":{"rendered":"How a global investment firm reduced security surprises"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Most security teams don\u2019t suffer from a lack of data. They suffer from a lack of certainty.<\/p>\n

Vulnerability scanners, annual penetration tests, and compliance assessments can generate thousands of findings. Yet they often fail to answer a simple question: Which risks actually matter?<\/p>\n

For a global investment firm operating across 18 locations, that question became increasingly important. A small security engineering team was responsible for securing a growing environment while balancing infrastructure projects, identity management, user support, and the countless responsibilities that come with protecting a modern enterprise.<\/p>\n

The team wasn\u2019t struggling to generate findings. They were struggling to understand which findings represented real risk, whether remediation efforts were working, and how to ensure leadership would never be surprised by an exposure that should have been discovered earlier.<\/p>\n

That journey led them from point-in-time testing to continuous validation.<\/p>\n

Outcomes at a glance<\/h3>\n

Reduced impacts from 251 to 0 in a same-scope internal penetration test (pentest)<\/p>\n

Reduced compromised credentials from 52 to 0<\/p>\n

Reduced compromised hosts from 67 to 0<\/p>\n

Reduced cracked Active Directory passwords from 40 to 0<\/p>\n

Expanded continuous validation across 18 locations using a phased rollout strategy<\/p>\n

Enabled a lean security team to continuously validate risk without significant operational overhead<\/p>\n

Impact<\/h3>\n

The team wasn\u2019t expecting perfection. Every environment contains weaknesses, and no experienced security practitioner assumes an internal pentest will come back clean.<\/p>\n

What surprised them was how effectively those weaknesses could be chained together once an attacker gained a foothold.<\/p>\n

One of the firm\u2019s early internal pentests identified 85 weaknesses. By itself, the number wouldn\u2019t have stood out to most security teams. The real concern wasn\u2019t the weaknesses themselves. It was what those weaknesses enabled.<\/p>\n

NodeZero\u00ae showed that those weaknesses could produce 251 impacts, including domain compromise, sensitive data exposure, ransomware exposure, host compromise, domain user compromise, and compromised credentials.\u00a0<\/p>\n

That distinction matters because attackers don\u2019t exploit weaknesses in isolation. They chain weaknesses, misconfigurations, and credentials together to achieve an objective. A low-priority finding on its own may appear manageable, but when combined with other weaknesses, it can become part of a pathway to something much more serious.<\/p>\n

src=”https:\/\/b2b-contenthub.com\/wp-content\/uploads\/2026\/08\/Figure1.png” alt=”figure 1″>Figure 1. An early internal pentest identified 85 weaknesses that led to 251 impacts, including domain compromise, ransomware exposure, sensitive data exposure, and host compromise.<\/em><\/p>\n

As the organization\u2019s senior security engineer explained: \u201cThat impact section in NodeZero is just pure evidence of what can happen in a real life scenario.\u201d<\/p>\n

The shift from theoretical risk to demonstrated impact changed how the team approached remediation, shifting the conversation from identifying weaknesses to understanding their potential business impact.<\/p>\n

Background<\/h3>\n

Like many organizations, this organization was already investing in security testing. The challenge wasn\u2019t finding another tool. It was finding an\u00a0approach that could scale across the business\u00a0<\/em>without creating additional work for a small security team already balancing infrastructure projects, identity management, user support, and countless other responsibilities.<\/p>\n

As the senior security engineer described: \u201cNodeZero is, let\u2019s say, 5% of my work. I\u2019m dealing with a million different things, a million different projects, a million different responsibilities.\u201d<\/p>\n

That reality made operational simplicity more than a convenience. It became a requirement.<\/p>\n

The team had experience with security testing platforms that required significant infrastructure and ongoing maintenance to keep running effectively. For a small team juggling competing priorities, that overhead mattered. NodeZero offered a different model. The platform was simple to deploy, easy to operate, and allowed the team to begin testing immediately without dedicating resources to managing complex hardware infrastructure.<\/p>\n

That ease of deployment became particularly important because the team wasn\u2019t interested in running a proof of concept. They wanted to build a sustainable program that could scale with the business.<\/p>\n

Click here<\/a> to continue reading about the obstacles the organization faced and how they mitigated them.<\/p>\n

The need to validate outcomes<\/h2>\n

The objective was never to eliminate every weakness. It was to eliminate uncertainty around the risks that mattered most.<\/p>\n

That\u2019s the difference between measuring activity and validating outcomes.<\/p>\n

Learn more about Horizon3.ai and NodeZero.<\/a><\/p>\n

\n<\/p><\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Most security teams don\u2019t suffer from a lack of data. They suffer from a lack of certainty. Vulnerability scanners, annual penetration tests, and compliance assessments can generate thousands of findings. Yet they often fail to answer a simple question: Which risks actually matter? For a global investment firm operating across 18 locations, that question became […]<\/p>\n","protected":false},"author":0,"featured_media":9046,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-9045","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9045"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9045"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9045\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/9046"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9045"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9045"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9045"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}