SecurityStudio

What do you like best?

I have reviewed over the past few years several NIST type assessment tools and just renewed Security Studio again. There are so many things that the S2 org tool does and does well. I love the deliverables! The deliverables are easy to create and are easy to present to other non-technical shareholders to get that “buy in” when we prioritize our goals for infosec. The industry comparison FISA score is genius and I base one of my departments KPI's off of improving that score month over month. I can easily measure our remediation investments against our improvement or risk. When I did security consulting over the years, I would present a report and the following year would find the same high priority issues with nothing accomplished. This tool seems to drive action. S2 continues to refine the tool and open to suggestions. The support are responsive and rock stars!

What do you dislike?

When i have found something in the software that could save me time over the years - i would email S2 the idea and either they were already planning it or would add in the next version. So with that being said, i don't have any dislikes.

What problems are you solving with the product? What benefits have you realized?

As i stated above, it does a great job of helping me prioritize, measure and present our organizations information security risks.