How MODO validated Strike’s results and began moving toward a continuous model

MODO put Strike's new Continuous Hybrid Validation platform to the test with a real Threat Emulation and compared its results with three additional methods: manual testing, its own AI process, and an AWS service.

The comparison had one key difference: some of these methods had additional information about the environment and the repository. Even so, Strike reached the same findings starting from much less context.

The experience led MODO to evaluate a change of model: moving from mostly on-demand security testing toward a more continuous validation strategy.

About MODO

MODO works with security processes that combine different forms of validation, including manual testing, AI, and third-party services.

In this context, Strike's evolution toward a Continuous Hybrid Validation platform represented an opportunity to test a new way of running and managing security assessments.

Industry

Financial services

Product

Digital wallet that connects bank accounts and cards to pay, transfer money, and manage different payment methods from a single app.

Context and challenges

MODO worked mainly with an on-demand model, in which assessments were triggered based on the needs of specific features or applications. When adopting Strike's new platform, the team wanted to test its capabilities in a real scenario and contrast the results with other methods it already used internally.

The comparison made it possible to evaluate not only what each method found, but also how far each one could go with the information available.

Working with Strike

[1] A guided experience from the start

Strike took a leap in its model: it moved from project-based security assessments to a Continuous Hybrid Validation platform. In it, AI agents and Strike's team of certified ethical hackers continuously test every asset, and every critical finding is validated before it reaches the client.

The platform integrates attack surface mapping, the execution of Threat Emulation, that is, simulated attacks that replicate real techniques, and remediation prioritization and tracking.

For clients who were already working with Strike, like MODO, this change meant migrating to the new platform.

MODO described this transition as a simple and natural process, also mentioning that onboarding was easy for the team.

They also highlighted that the new experience offers a more guided setup for Threat Emulations, with menus, questions, and a step-by-step flow that makes it easier to define what to evaluate and how to run the exercise.

"The loading, the questions, the step by step to set things up, it was pretty cool and more guided than the previous platform."
Cristian Barquet, Offensive Security Lead at MODO

This new experience also preserves something important for MODO: human control over the process, making it possible to decide when to run an assessment and what the platform is expected to do.

"The human in the loop, as we call it at MODO, the process of deciding when to run and what you want the platform to do. That's great."
Cristian Barquet, Offensive Security Lead at MODO

[2] Same results, with much less context

To test Strike's results, MODO compared a Threat Emulation with three additional methods: manual testing, its own AI process, and an AWS service.

The comparison was not carried out under the same conditions. MODO's internal AI process had additional information about the environment: it could understand what was in runtime and where the repository was. The team itself described this process as closer to a white box approach, with much more information available.

"Our AI process has what we call the MODO context: it understands what's in runtime, it understands where the repository is. It's a bit more of a cheat, let's say, because it's more white box, it has much more information."
Cristian Barquet, Offensive Security Lead at MODO

Despite that difference, all four methods reached the same findings.

For MODO, the result was especially relevant because Strike managed to reach those findings without having the same level of context about the environment and the repository. The assessment also made it possible to observe how the engine behaved against the environment's defenses, identifying elements such as Cloudflare and WAF and adapting its strategy to avoid triggering unnecessary alerts.

The exercise started on the development environment and then made it possible to validate the results in production. Finally, MODO used Strike's report to share the results with its teams, while its own results were kept as backup for internal control.

[3] From on-demand to a continuous strategy

The experience with Strike also opened up a broader conversation about how MODO manages its security assessments. Today, the team works mainly on-demand, based on the needs that arise around features and applications.

The goal is to move toward a more cyclical and continuous model, in which assessments become part of a recurring process.

"MODO's idea is to eliminate on-demand and move to that continuous stage."
Cristian Barquet, Offensive Security Lead at MODO

In this evolution, Live Asset Radar's ability to identify and track assets also emerges as a piece aligned with the strategy MODO seeks to build.

‍

An experience MODO already recommends

The experience with Strike didn't just lead MODO to evaluate a new way of working. It also generated a direct recommendation of the platform. The team had already started sharing its experience with the new platform within its industry. For MODO, the experience combined a more guided setup, autonomy to run assessments, and the ability to obtain relevant results even when other methods had additional information about the environment.

‍