Bishop Fox

The segmentation testing was the most important part. We had clues that something might be off. And when Bishop Fox came in, they confirmed that and uncovered even more that we didn’t expect. It was a wake-up call

Our solutions were quite legacy in terms of architecture and tech, so we’ve had to revamp our processes: design, development, and hosting to put security at the forefront. Our customers care about security, and that shift has helped us stay competitive

Our environment is so large and complex that it’s impossible for any one person to fully map it out. That’s why we suspected there could be misconfigurations or gaps that had gone unnoticed

The difference was the depth. Bishop Fox didn’t just run a scanner. They explained how the issue was discovered, why it mattered, and what we needed to do. That saved us time and gave us confidence that we were addressing the right things

The report went straight to our infrastructure team, and they started remediation immediately. That kind of clarity doesn’t happen often. It made my job easier and helped us respond faster

Bishop Fox helped us challenge assumptions we’d relied on for years. It opened the door for us to rethink how we build and secure these environments

It’s very important for us to ensure we serve our customers in the most secure way and to protect ourselves from any malicious hackers

We found Bishop Fox to be prompt and more responsive than other providers we have worked with

We would definitely recommend Bishop Fox to other Google partners because they are very responsive and responsible. The pen test is very good, and the process is streamlined. We received solid actions to take after the assessment

You can buy all the security tools in the world, but that alone doesn’t mean you’re secure. The real question is whether your controls hold up when they’re actually tested. That’s what this engagement gave us—the opportunity to validate our defenses under real-world conditions

The proof is really in the pudding. We felt like we were in a strong place from a security perspective, but bringing in an experienced third party to validate that independently is what really matters

When you look at the top tier of red team and penetration testing firms, Bishop Fox is consistently in that conversation. I’ve seen the quality of their work firsthand throughout my career, so when I joined Laurel, the decision to work with them was an easy one

I believe you practice how you play. Having a firm with the depth of experience and expertise that Bishop Fox brings spend weeks testing our organization through phishing simulations, text messages, emails, and other social engineering tactics—and seeing employees consistently report suspicious activity rather than engage with it—is a real testament to Laurel’s security culture and the security awareness program we’ve built here

It’s one thing to talk about security; it’s another to speak about it confidently and back it up. When customers send security questionnaires, we’re able to respond quickly with clear, confident answers because we know the controls, processes, and safeguards are truly in place

We didn't just lift and shift. We reinvented LastPass by modernizing our technology, elevating our security posture, and rebuilding a culture grounded in real accountability. Throughout this transformation, we've upheld commitments we've made to customers and, through our partnership with Bishop Fox, validated that our protections can withstand threats against a modern cloud architecture

Designing the architecture was only the first step. We needed to see how it would perform under real conditions, knowing the identity and privilege boundaries we defined would shape our risk posture long term

We didn’t go to market looking for the cheapest option just to check a box. For something this important, quality and credibility mattered

There’s a difference between believing your architecture is sound and watching it hold under pressure. That process gave us confidence and clarity on where to keep strengthening

It was important for us to differentiate ourselves by providing the numerical benefit of micro-segmentation to organizations. In almost every high-profile breach, the ease of lateral movement has contributed to the devastation. Micro-segmentation as a security capability has been in the back of CISOs’ minds for 5 or 6 years, but now it’s a must-have control

While theoretically we could have done this testing in house, it was important for objectivity that we reach out to established red team experts to build a transparent testing methodology, ensure that it was sound, and advise us honestly throughout to learn exactly how and where Illumio provides value

Lack of segmentation could be written up as an issue on 90% of the tests we do – we commonly see organizations with networks comparable to the control test here. Organizations know this is a problem, but attempting to implement segmentation at scale can be daunting on your own

One of the key takeaways from this report is that as the size of a protected estate increases, the attacker’s job gets measurably more difficult, even as the granularity of micro-segmentation policy is kept constant

In some ways, these use cases represented best case scenarios for attackers – a finite environment with microsegmentation as the known security control and no alarms to avoid setting off. However, as the attack surface expanded, we were forced to change tactics to give us a chance to get to the crown jewels in a reasonable amount of time, even with those benefits

Bishop Fox is a group of security professionals who are experts in their field. They brought a number of different disciplines to the project, people who understood all aspects of what we were working with

Throughout this project, it was clear that we were all working towards the same goal – a secure product

The Bishop Fox assessment really helped us evolve our security processes. We grew quickly from a small organization, quadrupling over a year, and the guidance we received from Bishop Fox helped us prioritize certain areas and quickly get a phased security enhancement plan in place. This assessment was a great step forward in evolving our program to scale to our needs for the coming year

We are a cloud-only company. Nearly everything is in the cloud. That positions us in a unique situation – there are some Google requirements that are difficult or almost impossible to comply with in this particular environment. Bishop Fox was flexible and understanding about this situation and helped us find a way to ensure the security of our users and environment without burdening our employees

Aspire was very eager to fix the issues we found and learn about ways that they could improve going forward. This showed us that they really care about building security into future features and updates – and not just passing the assessment

We’re working toward our evolutionary security goals and continuing to level up our security program. Working with Bishop Fox helped us get that vision in place

Bishop Fox's [Cosmos] service scales significantly better than other options in the market. [Cosmos] gives me more relevant, meaningful, and actionable information and I'm not waiting for the output of a pen test before I can act

We knew we needed something beyond just another scanning solution. [Cosmos] offered us attack surface discovery. The service showed us about the things we weren't even aware of. We didn't have to provide a list of IP addresses to scan; to the contrary, they discovered our attack surface for us and began scanning immediately

The Bishop Fox team became an extension of our team. The day-to-day processes were managed as if our [Cosmos] partners had become part of our team – they'd go through issues and discuss how to handle what they'd discovered. It was a refreshing change from the norm. They focused on solutions and worked with us as a true partner

Overall, we've been really pleased not just with the continuous testing of [Cosmos], but the incredibly high caliber of talent from the team. The team thinks creatively and follows any threads for things that don't look quite right. As a result, they uncover many risks that other teams and technologies would have missed

Bishop Fox's reputation in the industry is exceptional. This project was uniquely challenging as it did not fit the typical profile and scope of an application pen-test. Despite the challenges, Bishop Fox was extremely professional and produced great results

At Sonos, the hardware is a key component to the overall security posture. So having a partner that is comfortable with hardware-based penetration tests was very important to us. I’ve worked with a number of different vendors, but when it came time to figure out who to use for Sonos, I ultimately knew Bishop Fox was the best fit for us

Having Bishop Fox on site for a couple of weeks is different than how we’ve worked with other companies. And I think it was a lot more effective. It gave us the opportunity to talk through things, and if they found something they were excited about, we were right there to engage with them

I think the level of enthusiasm that they brought in general was really great to see. It was clear that they all enjoyed what they were doing. It was a challenge and they wanted to see if they could find problems and break into the product. And that’s exactly what you’re looking for in a good pen tester

The most serious vulnerability they found (which by the way none of the other companies who’d reviewed the product ever found) was a relatively easy thing for us to fix. The rest of the findings were medium or low- level findings, but they added ammunition to the sum of our efforts internally to prioritize addressing some of these concerns

Sonos was super open. Their team was really interested and fully engaged, and could not do enough to help us. They were absolutely invested in it. It was obvious that it permeated through the culture of development and everything else

The level of depth of professionalism that the Bishop Fox team brought to the project allowed us to establish a strong relationship. It reinforces that Bishop Fox is the right fit; the right set of folks to make sure that the rest of our ecosystem is well designed and architected

Bishop Fox's work gave us confidence that we had hardened our system against real-world attacks. The team was responsive and efficient, and their findings were clear and actionable. They worked around our development schedule, making the entire process smooth and valuable

Our product is designed to understand what users are working on across different platforms and provide intelligent writing assistance without compromising security. Since we're serving sales professionals, recruiters, students, and others working with sensitive information, security had to be at the foundation of everything we built

The handoff meeting was particularly valuable. Our engineers got to talk directly with Bishop Fox's technical team about the issues they found. This direct communication helped us understand and fix the problems quickly

Bishop Fox took the time to understand our architecture and target users. They weren't just checking boxes, they were thinking about our specific context and what would actually matter to us

Pen testing identity and access management for Kubernetes is a pretty novel approach. Many pen testing companies are still just doing traditional web app pen testing and calling it done for Kubernetes, not considering other avenues of attack. We'd rather do advanced testing in a more controlled manner with people we trust than be on the defensive