John Prisco

2. John Prisco President and CEO Triumfant, Inc.

3. Customer Information Security Concerns • Our defenses are designed to defeat threats we have seen before. We have very little protection against new types of threats. • The time it takes for us to learn about and defend against a new threat is measured in days or weeks. • We are largely unaware of the changes occurring within our computing environment on a day-to-day basis.

4. Defenses are unable to adequately protect computers The Static Defense Shield Problem

5. What We Need: An Active, Adaptable Defense Sense Understand Inform Act • Dramatically increase the volume and flow of sensory input • Use machine intelligence to convert sensory input into knowledge • Provide flexible and powerful interfaces optimized for data navigation • Provide the ability to synthesize responses to address new threats on-the-fly

6. Sense DeepScan Don’t assume, collect everything • Continuously scans over 200,000 attributes • Registry keys - Files • Processes - Services • Open ports - Event Logs • - Performance counters - Security settings • Hardware attributes - Memory tables • 500 sensitive attributes scanned every 10 seconds

7. Understand Understand Data must be converted into knowledge • The Adaptive Reference Model • A detailed baseline model of what is normal • at a particular point in time • Compares subsequent snapshots and determines if changes have malicious intent. • Based on patented data mining algorithms Powerful Analytics ? • Known Good • Normal • Known Bad

8. Inform: Actionable View Into Your Environment Inform: An Actionable View Into Your Environment

9. Act Awareness Enables Precise Action • Automatically derives a custom-built remediation response on-the-fly • Surgically precise and unobtrusive • Removes malware and corrects collateral damage • All remediations are reversible Point Remediation

10. Triumfant Active Defense: On the Endpoint Patented algorithms that remove malware in minutes • Finds and removes malware that other defenses miss • Does not require signatures or any prior knowledge • Continuous monitoring of the detailed state of the computer provides situational awareness of the entire enterprise • Effective against APTs, polymorphics and sophisticated targeted attacks from determined adversaries

11. Parting Thought In the time it took me to deliver this speechmore than 4000 new malware threats were detected.