The client, which is not named in the case study, has been an innovation leader in the access networking and media distribution market for 35 years, with more than 8 million products deployed in 75 countries. It helps communications service providers future-proof and evolve their networks in step with market demand. The company has 201 to 500 employees and a limited number of IT and security staff, and it needed a data-driven way to prioritize its security efforts and manage its cybersecurity spend.

The client needed to assess any third-party cyber risk it might be introducing to its service-provider customers through its processes or products. It also wanted to manage its cybersecurity spend more deliberately and set a global standard for security practices across the business. With a limited IT and security team, it had to prioritize its security efforts in a data-driven way.

In 2020 the company's Chief Information Officer approached Maxxsure to calculate the potential cyber risk to the enterprise and the cost of that risk. He needed a better way to decide which IT and security objectives to focus on quarter over quarter, and a means of presenting leadership with a data-backed financial impact assessment of each individual risk so the board could make informed decisions.

By his own account, the CIO was not aware of the full depth of the organization's risk before the engagement. At the time, a cyber breach was estimated to cost the company $3 million.

The client used the Maxxsure platform to assess its people, process and technology security practices across the various segments of its business. The assessment included a network vulnerability and penetration test. With that data entered into the platform, the client could see the existing risks across each business segment together with probable maximum loss (PML) estimates, the financial cost of an incident given its current state of resiliency.

Maxxsure presented the client with an initial M-Score of 378 and recommendations for hardening its risk resiliency. In response, the company formally established a Risk Management Program and began mapping and planning its priorities around the most financially impactful risks across its business segments. A Risk Roadmap gave the CIO a formalized set of objectives for maintaining and improving the risk posture, and a way to track progress against them.

The analytics also changed the conversation with leadership. Because Maxxsure quantified each risk in financial terms, the CIO could articulate the critical next steps, gain buy-in and, often, secure funding to reduce the company's risk exposure. Over the following two years the program introduced a number of security capabilities, including a real-time XDR solution, reduced physical network architecture, segregated data storage and backups, mandated VPN use for all remote users, and ongoing security awareness training with phish testing.

• M-Score improved 71%, from 378 in 2020 to 650 in 2022
• Probable maximum loss from a breach fell from an estimated $3 million to under $1 million
• 100% mastery of endpoints, with full visibility of internal network, physical and digital assets and public perimeter
• Critical and high vulnerability findings reduced to fewer than five, largely eliminated by a real-time XDR solution
• 172 domain and DNS entries eliminated; segregated backups and mandated VPN for all remote users
• 99% of employees completed security awareness training, reinforced with ongoing phish testing