There are two key aspects to the M&A Assessment - visibility of the attack surface and identifying security vulnerabilities that create risk. The Asset Inventory product available through the M&A Assessment package surfaces and fingerprints assets that have a high likelihood of belonging to the target organization. Discovered domains are suggested as potential inventory-adds, and organizations can accept or reject as necessary. Once this is done, Asset Inventory alerts on high-risk activity like expired or expiring certificates, exposed IP, and open ports. The initial inventory takes 2-3 days to “fully bake” at program outset, though this is dramatically lower than competitive products as Asset Inventory takes an “outside-in” approach through a pre-indexation of the entire known internet.
Vulnerabilities surfaced in the pen test portion of the assessment are also viewable in real-time through the platform. However, customers may choose to wait until after Bugcrowd’s dedicated triage team performs their initial validation, categorization, and prioritization exercises which enrich available data while reducing noise.
The expert analysis and risk scoring provided by the M&A Assessment enables Bugcrowd customers to make faster and smarter go/no-go decisions during the M&A process.