And why *only* Persistence?
When you think about the ATT&CK chain, the natural choice is to work on Initial Access. It's better to prevent attackers from getting in, right?
Unfortunately, despite many vendors and companies working on preventing access, it still happens. The main reasons may be:
(1) The attack surface is very large. There are many applications (commercial, open source, and internally developed), each of which can have its own vulnerabilities. Finding the vulns and patching them is a challenge, and seems to become more so with the latest AI models' offensive capabilities.
(2) Humans are part of the attack surface. The latest Mandiant M-Trends reports that 85% of initial cloud infection vectors are: voice phishing, third-party compromise, stolen credentials, email phishing, and insider threat. Most of these are human, not technical, problems. Maybe (despite point 1) technical defenses are already the stronger part of the perimeter (exploit was only 6% of intrusions)?
Other parts of the chain (especially Privilege Escalation and Lateral Movement) are also of course important once an intruder is on the inside. But they suffer from the same two issues above.
Persistence mostly involves leveraging existing mechanisms for being part of the environment, whether at the system, identity, network or cloud layer. For example, adding malicious code as part of the system startup sequence.
We believe this presents an opportunity to focus on systems as they are designed, presenting a smaller attack surface than at the Initial Access stage.
If we focus on Persistence detection and do it well, we can reduce dwell time as we find and eject (purge?) attackers from the environment.
Why *only* Persistence? As a small startup, we need to stay focused and work where we can apply the most leverage to a real world problem. If we succeed at that, our customers will guide us to what they need next.