With his 20 years of experience in the IT industry Yavor Y. Zlatev has had the opportunity to participate in different projects abroad because he has been living outside of Bulgaria for more 15 years. The main projects are related to building and maintaining client IT environments in known technological fields, important to every company which works with data (Linux, Microsoft, computer networks, cybersecurity, databases). Yavor also has plenty of experience in the software fields – Software Developomemt&DevOps (DevOps is a methodology for software development which combines software development (Dev) and IT operations (Ops) in order to improve the quality, reliability and speed of providing the software to the end client).
In the last ten years Yavor Y. Zlatev has actively worked on the development of Advanced Vision IT Ltd. The main idea is to provide a “full lifecycle” to the IT and business services required by a company. His company offers a full set of services – from software development to cloud integration, cybersecurity and IT management. Yavor has plenty of experience in industries like fintech, betting and gaming industry, cybersecurity, electronic trade, telecommunications and cloud industry.
What are the latest trends in the cybersecurity field from the point of view of providing such services?
The cybersecurity field is one of the fastest growing ones in the last several years, and the same applies to the cloud services. The market is really dynamic. Many new cybersecurity startup companies have appeared in this sector while at the same time there are many existing players which are upgrading the types of cybersecurity services that they offer. There are also some which leave the market because they can’t provide a competitive service. The field is really very dynamic. A large portion of these startup companies are financed by Venture Capital companies and the latest events in the USA, related to the problems faced by a bank financing the technological companies, are a new variable in the equation for this industry. In my opinion the most adaptive and innovative players on the market will be the ones to survive.
From the point of view of the service – a large portion of the vendors started to work with companies like Advanced Vision IT Ltd, which stands out as a Managed security service provider (MSSP). Companies of this type provide people, processes and technologies as a package on a monthly base. A stack of technologies for cyber defence is being offered, which include vulnerability management systems, EDR/XDR, Firewalls, Cloud Posture Management Platforms, SIEM (Security Information and Event management System) & SOAR (Security Orchestration, Automation and Response), etc. The most important thing is to achieve a synchronisation between people and processes combined with the right technology for the specific industry or business. This type of consulting companies are certified by the specific software vendor and are prepared to provide a quality service. This vendor-centric approach by the consulting companies towards the vendors allows the MSSPs to deliver a customer-centric approach to the end customers and ensures a maximum level of defence because the client receives not only just software, but also a certified team which understands the business needs of the client and a proven complying process.
The MSSP security operations centres have high availability so they can provide services 24 hours a day, 7 days a week, which are intended to decrease the number of operative security employees which have to be hired, trained and retained by the company to maintain an acceptable position security-wise. Currently many automated systems are used to inform or automatically solve the problems which occur.
When using monthly Cybersecurity subscriptions (SECaaS) the client can usually vary on a monthly base with the number of software licences they need for IT security. The licences are granted by the servicing company, not held by the end user. They are received in a “package” – the people, the process and the technology which complete the full cycle of the service. Next month the needs of the client may be different – for example, fewer working servers or workstations, and the payment varies according to the needs. This trend is becoming stronger in the last three-four years and this market is definitely growing extremely quickly and is accordingly adaptive and flexible. In the current economic situation and considering the constantly rising regulations on the business purchasing a package of services from such a provider is the most advantageous solution. The model of work is consumption based and may vary from month to month.
What makes the cybersecurity companies competitive?
Some large cybersecurity companies try to provide a package of services which cover all needs of the client. The goal is for the client to not require another vendor to be included in its IT environment or to provide as many services as possible. Some companies with larger portfolios believe that they can provide practically everything necessary but in most cases this is just marketing and it is not completely realistic. The reality is a bit different. Each company in the sector usually specialises in a specific service and this is where its strength lies. This is why we also combine the best from the vendors we believe in and which have proven market experience. We create a Cybersecurity stack of technologies where the client can choose based on their budget. We will discuss with the client their business risk and technology risk and will offer them a combination of solutions, in most cases on a monthly basis. The client will receive a certified team which will ensure the security of their Cloud or physical environment, Online business applications, process and technology, which will be paid on a monthly basis. Cybersecurity vendors which rely on a partnership with integrators (МSSP) like Advanced Vision IT Ltd, create opportunities for their clients to receive a much better service and added value. Usually such companies also manage the IT environment of the clients and adapt the Cybersecurity solutions in the best possible way according to the specific needs of the client. The symbiosis between a Vendor and MSSP/MSP is the most effective solution on the market.
To what extent is the cybersecurity solution provided based on the business risk?
The cybersecurity solutions are chosen based on the business risks which are defined by the client. This is a first and main condition. The difficulty comes from determining how the technology and business risks correlate. This leads to problems with translating into business language the need for a specific technology or a process and the consequences of the lack of such from a technological point of view. The goal of every business is to generate profit with the fewest expenses. But these expenses for cybersecurity are nowadays one of the mandatory elements. The easiest thing to do is to add the minimal list of technologies which need to be owned by every company, like Password Vault Platforms, EDR/XDR, Firewalls, Vulnerability Assessment and Patch Management. But the key element which is lacking for almost every element is the Process and especially the People.
The belief that the cybersecurity services are something very expensive, which the business cannot afford, is wrong. For every business there are the right solutions – according to the business risks, the needs, and respectively the budget too. For example, for a retail business purchasing a SIEM/SOAR technology may be too much, but for a Bank/Fintech business this may be a mandatory purchase.
For a smaller business security automation is not the most important thing. It is more important to have platforms which manage vulnerabilities, antivirus (EDR/XDR platforms), platforms for storing passwords, etc. But the most important condition in the successful process remains the People. They are the ones who create the process and manage and choose the technology. There are technologies which may be used by small and medium businesses and they are reasonably affordable. When they are combined with a high quality provider of such services, the company receives 3 in 1 – People, Processes and Technologies, and in most cases it can change the packages on a monthly basis.
What types of businesses most often turn to you?
There is an increase in the demand for this type of service, but it is still hard to find good enough specialists. Small and medium businesses have a hard time organising such teams which are intended to execute the whole cybersecurity process – something quite different from the traditional IT support. In most cases this type of business even believes that it cannot afford it and does not look for this type of services, which is a major mistake. It needs to have at its disposal the processes, people and tools which should work together to allow maximum speed and effectiveness so the cybersecurity event gets noticed in time. The planning of such a department is an expensive process for the large companies too. Some sectors, like the banking industry and the Fintech industry, are conservative and prefer to use their own teams. They allow external providers more rarely, but this still happens when the providing company is certified and has an excellent working team with the required business recommendations. The hard part is not only finding people with IT/Cybersecurity skills, but also in managing such teams, i.e. finding the right management team. Very often a hybrid model of work is chosen, where the management and responsibility for the Cybersecurity department are fully taken by the client, but all other processes are outsourced to consulting companies. This way the business gains access to high quality specialists and maintains control over the final decisions. Production, Factories, Entertainment, Betting§Gaming, Fintech, Banks, Government, Retail. These are the industries which see the need for cybersecurity solutions and especially for suitable services.
The cybersecurity issues aren’t related only to theft of sensitive information. These are issues which sometimes lead to the termination of some companies. Losses can be not just reputational, but also financial. This is why it is important for every company with online presence to pay special attention and seek consultants to evaluate the technology risk and thus also the business risk.
