PRESS RELEASE

BOSTON – Dec. 13, 2010 - Core Security Technologies, the market’s leading provider of IT security test and measurement software solutions, today announced the official release of CORE INSIGHT Enterprise. Following a successful beta program, which included more than a dozen Fortune 500 firms and top-level U.S. government agencies, the launch realizes Core Security’s vision of enabling customers to continuously identify and prove real-world exposures to critical assets across the entire organization through automated testing of network systems, web applications, and users in one completely integrated solution.

With CORE INSIGHT, customers gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations. The solution employs groundbreaking technology that proactively replicates the steps attackers would take to breach valuable information assets. Unlike other solutions, CORE INSIGHT Enterprise starts with customers identifying which systems and data they want most to protect. INSIGHT then automatically calculates paths of attack and then begins to exploit multiple layers of defense until the security of critical assets is either confirmed or breached. Assessment results are delivered via a dashboard and reports that present metrics regarding the efficacy of security controls in terms relevant to the business.

CORE INSIGHT Enterprise provides IT security leaders with an automated and continuous view of IT security risk for the very first time, enabling them to …

provide definitive answers about IT security risks, measuring precisely if their most critical assets are exposed to breaches;

save time and increase security team efficiency by reducing security data volume and identifying exposures that matter;

determine the best use of resources, extending the value of current investments in people and technology; and,

reduce security exposures, minimizing the threat surface through testing and answering the question, “Are we more secure than we were yesterday?”

“Using CORE INSIGHT Enterprise to test across our IT infrastructure on a continual basis has given us an entirely new way of looking at whether or not our most critical IT systems and electronic data are protected from real-world attacks. Just as importantly, it tells us how well our existing defenses are functioning and what type of return we’re getting from our previous security investments,” said Larry Whiteside, CISO of the Visiting Nurses Service of New York. “INSIGHT Enterprise finally allows me to cut through the huge amounts of raw security data information and understand precisely where our actual strengths and weaknesses reside, helping to both guide decision making and measure our success.”

“CORE INSIGHT Enterprise changes how enterprises should view security. It makes security goal oriented by allowing security professionals to determine if their critical assets are vulnerable,” said Charles Kolodgy, research vice president for Security Products at IDC. “Its goal-based testing automation cuts through the vast amounts of security data coming from scanners and other security solutions, to directly identify exposure of data assets that the organization determines are most important. Additionally, CORE INSIGHT has unique capabilities to go beyond just technology security but to also determine the effectiveness of security policies and user compliance.”

CORE INSIGHT builds upon the expanding demand and established innovation of CORE IMPACT, the industry leading penetration testing software product, now in its 11th version. While IMPACT is the software application of choice among thousands of security testing professionals, CORE INSIGHT creates the opportunity to test and measure exposures in a comprehensive and realistic manner. In the recent SC Magazine article naming Core Security to its “Innovators Hall of Fame” for 2010, author Peter Stephenson clearly summarizes Core’s expanding product portfolio: “While CORE IMPACT Pro is a tool for penetrating systems, CORE INSIGHT Enterprise is a system for identifying risks.”

CORE INSIGHT Enterprise Use Cases According to Bob Walder, research director at Gartner, “Real-world security threats demand real-world security testing.” The INSIGHT Enterprise beta program consisted of industry leaders with a wide range of use cases for real-world security testing, including:

A top 20 global bank - striving to improve its wire fraud management programs by identifying possible insider threats with automated and continuous testing of its worldwide operations

A top 25 U.S. bank - seeking to improve its vulnerability management programs by identifying its most critical issues and verifying the effectiveness of its remediation initiatives

A leading U.S. retailer - planning to test hundreds of web sites and online applications as the final stage in its SDLC secure development program

A massive U.S. government installation - seeking to give its security team the power to distribute and delegate testing across its operations via an internal service provider model

A leading U.S. children’s hospital – looking to test their end users with phishing tests and replace several costly consulting engagements

How It Works CORE INSIGHT Enterprise empowers organizations with an entirely new method for continuously scoping the risks of real-world attacks to critical information assets. By traversing exploitable web application, network and client-side weaknesses throughout the enterprise, INSIGHT reveals paths of exposure to specific assets – providing clear, definitive metrics for efficiently validating security controls and addressing data breach threats.

With INSIGHT Enterprise, customers begin by defining which specific assets are important to their organizations, such as:

Systems for financial transactions, operations controls, or other mission-critical functions

Databases housing sensitive information such as financial data, customer or patient records

Data formats such as credit card numbers, social security numbers, or employee ID numbers

Utilizing a map of the IT environment, either discovered independently or imported via connectors, INSIGHT’s unique Automated Attack Planner algorithm leverages GPS-like capabilities to plot the courses an attacker would likely follow to access the critical assets. The solution’s Exploit Engine then employs real-world hacking and phishing techniques to prove security exposures along each likely path, revealing how chains of security weaknesses could expose assets labeled as mission-critical.

Using CORE INSIGHT Enterprise, organizations gain the ability to perform proactive security testing across their entire IT ecosystem without being forced to hire dedicated experts to carry out assessments or interpret results. Inside the enterprise, the solution enables IT security management to distribute and delegate testing responsibilities across individual business units and then feed results back to a centralized CSO dashboard and multiple reports. As a result, INSIGHT customers can independently gain definitive answers about business risks, get the resources they need to strengthen defenses, and track changes in their security posture over time.

“For almost 10 years our IMPACT Pro penetration testing solutions have redefined the manner in which organizations view the process of internal security assessments. With the introduction of INSIGHT Enterprise, we expect to dramatically change the way that people approach IT risk and security management both today and in the future,” said Mark Hatton, president and CEO of Core Security. “It’s no longer about risk avoidance; it’s about risk management. Core is uniquely positioned to help our customers manage the volumes of data they are getting from point security products to identify real, exploitable weaknesses, enabling them to proactively identify and address critical data breach threats.”

Hear Mark Hatton discuss how organizations achieve value from Core Security’s solutions.

About Core Security Technologies

Core Security Technologies enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and prove real-world exposures to their most critical assets. Our customers can gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations.

Core Security’s software solutions build on over a decade of trusted research and leading-edge threat expertise from the company’s Security Consulting Services, CoreLabs and Engineering groups. Core Security Technologies can be reached at +1 (617) 399-6980 or on the Web at: http://www.coresecurity.com.