Cybersecurity is one of the fastest growing and most quickly evolving markets. How is cybersecurity technology changing to stay ahead of highly organized criminals? What’s in store for the future of the market? I had the opportunity to talk with Zac Rosenbauer, vice president of technology at Precognitive, to discuss his perspectives.
Could you offer an overview of the cybersecurity landscape as you see it and explain some of the ways Precognitive is responding?
ZAC: The solutions and methodology used to prevent cybercrime is a constantly moving target. Unlike other markets, the cybersecurity and fraud prevention space has cybercriminals working to circumvent us at all times. By and large, fraudsters or hackers are not the stereotypical loners sitting in the basement committing theft in isolation. Most cybertheft is committed by organized fraud rings that are heavily invested in growing their operations.
Cybercriminal organizations continue to innovate and find ways to circumvent safeguard systems, so as criminals become more sophisticated, cybercrime prevention systems must also become more robust. Older cybersecurity systems generally had a single point of integration. You would get some data and make a decision from a limited set of information. This was the best we could do ten years ago; however, the modern world is more sophisticated and fraudsters do a much better job of faking information and circumventing these legacy systems. Because of this, cybersecurity companies like Precognitive are using behavioral analytics and behavioral biometrics as critical tools to become increasingly better at detecting and preventing illicit activity. Additionally, our machine learning solutions use thousands of datapoints to continue to get smarter and increase our ability to detect sophisticated attacks.
That said, our job is not only to prevent fraud but also to allow marketing initiatives to be as successful as possible. Creating fraudulent behavior false positives will reduce conversion opportunities for businesses, which is obviously not productive. Our goal is to detect fraudulent behavior in a highly active way while not creating false positives that reduce revenue opportunity or unproductive friction between the customer and their conversion activity.
Industry statistics show that about 1 percent of conversions (ecommerce orders) are fraudulent. However, I’ve seen some systems reject up to 5 percent of orders. Most customers who were rejected, will not call customer service—they will go to another vendor. Our solutions’ return on investment lies in reducing fraud rates while in tandem reducing the rejection rate, which can add an additional ROI outside of mitigating fraud losses.
How do behavioral analytics and behavioral biometrics offer protection from illicit activity?
ZAC: We address three general use cases—card-not-present fraud (buying something online), takeover prevention (protecting online accounts from fraudulent takeover), and account opening fraud (applying for a new loan, for example).
For account takeover prevention—cases where you type in your password to log on to an account—looking at biometrics data such as keystroke dynamics is a valuable insight. Most people know their password much better than a fraudster or a robot does, so real people’s data entry behavior looks quite different than a fraudulent entry.
Behavioral analytics could point out unusual behaviors like logging on at an atypical time and from a different country. Card-not-present data allows us to look at the customer’s typical shopping behavior, further zeroing in on whether the activity is likely to be fraudulent.
We also see customers’ entire user behavior and know what typical usage looks like. Whereas most customers browse before they buy, fraudsters aren’t going shopping. Fraudsters know what they want and continue to attack the identified brands until they move to another website or brand target.
We have come a long way from the old systems that were primarily rule-based. For example, a system might have been set up to let transactions less than $100 through, but criminals can quickly execute 500 transactions worth $99.99, so it was worth their time. Marrying disparate behavioral analytics and biometrics data is how we’re able to really reduce the false positive rate while catching fraudulent activity.
Cybercriminals are obviously evolving quickly. How do you stay ahead of them?
ZAC: Because we can see the entire user’s behavior journey, we can also see fraudster behavior; this allows us to more easily tie the pieces together and identify criminal activity. In addition, we spend time on dark web forums, exploring and learning as much as we can about what cybercriminals are up to.
We read new industry articles and white papers as well as interact with the industry at large to figure out what directions we need to pursue to improve our solutions. Although the cybersecurity industry is highly competitive, we are all fighting the same bad guy. A friendly competition exists between companies, and insights and information exchanges are common—at times, even collaborations.
Has cybersecurity become more difficult with the widespread use of mobile devices?
ZAC: In many ways, mobile devices are more secure than desktop or laptop computers because we can capture much more biometrics information. Facial recognition and fingerprints are obviously unique identifiers. We can capture data such as how the user is holding the phone and determine if the device is being held differently than usual; unusual behavior in this area could trigger additional security and user validation measures. Overall, behavioral information and biometrics information are significantly more difficult for criminals to duplicate.
How is the cybersecurity industry working together to increase security for everyone?
ZAC: New regulations are driving some standards or requirements. For example, the California Consumer Privacy Act (CCPA) goes into effect on January 1, 2020. This legislation is intended to increase the transparency of collected data and give consumers more control over their data.
I don’t usually believe that regulation stimulates innovation; however, this regulation is doing just that by forcing companies to find ways to protect their data and change how they do business.
Europe also has strong customer authentication (SCA) requirements, and a version of these regulations could come to the US soon. Essentially, SCA forces multi-factor authentication on most online transactions. This is quite interesting for us because we have all the data points required to support SCA, especially in regards to reducing user friction with the implementation of an MFA solution.
Cybersecurity is one of the fastest growing fields in the country, and the field has a huge shortage of talent. In general, companies don’t know how to deal with the various attack vectors that are popping up and cybercriminals are taking advantage of the fact that we’re moving most of our lives, at least our financial lives, online. We will continue to see constant innovation in the space and at Precognitive we will endeavor to continue pushing the industry to stay ahead of the cybercriminals and their efforts to innovate their way into a free pair of shoes.
Sphere Software (https://sphereinc.com) is the sponsor and organizer of TechDebates.org and also finds great value in these follow-up discussions with industry experts. Sphere is a technology consulting-and-solutions company. Everything we do is designed to accelerate your business, remove technical constraints, and eliminate staffing bottlenecks.
