With many thanks to Taavi Must, CEO of RangeForce, Aviva Zacks of Safety Detectives got a deeper understanding of his company’s cloud-based simulator.

Safety Detectives: Can you tell me a little bit about your cybersecurity journey that brought you to RangeForce?

Taavi Must: My journey is a little different than that of most founders of cybersecurity startups. I’m not actually from cybersecurity, as I actually spent most of my time on the IT side, not on the cybersecurity side, of the technology companies. We started in Oracle and BMC Corporation and then we built up here in the Baltics integration companies. We have technologies like Cisco, VMware, and BMC.

One of the projects we had was to build a cyber range for external defense forces, which was later used by the largest NATO international cybersecurity exercises. And that was, for me, a turning point to cybersecurity.

We learned how to build a cyber range and that was a great experience, but it wasn’t really the most important one. The most important thing was what we saw during those large-scale cybersecurity exercises, which was that even the top NATO teams had trouble on the first tier because it was a red team/blue team type of exercise. They had to defend their infrastructure, and there are not too many places in the world where we can really learn how to defend. It’s much easier to find out how to hack things.

For us, it was an “a-ha” moment that we need to take that experience of the true cyber range and make it scalable. After that, we started to build our platform, making sure that we build the platform where IT professionals and security operations teams can go in and learn how to defend against real attacks. So that was the start of the RangeForce, and I’ve been in cybersecurity ever since.

SD: Can you tell me about your company’s platform and the different services that you offer?

TM: We help cybersecurity professionals and operations people train and learn defense skills in real networks against real attacks while using their real tools like Splunk and Recorded Future. The idea is that they can log into the cloud-based simulator pretty much the same way pilots log into their flight simulators and learn how to behave during a crisis. If you want to make the right decision during a crisis, you have to make sure that you have a foundation. For that, we have a skills platform where you can learn specific defense skills like how to defend against SQL injection.

This platform has two parts: a battle where you can put your skills to the test, and the other part where you can develop and make sure that all the skill gaps are filled, and they work together to make sure that you’ve got the skills and the practice.

SD: What kinds of companies use your services?

TM: When we started, we had the assumption that our service is mostly for Fortune 500, maybe Fortune 2,000 customers, and mostly for the financial sector, but now we’ve seen that this is not true at all. We have a very diverse customer base, from very small companies like startups to some of the largest companies in the world. We’ve got companies almost from all industries: media, banking, government, retail, and others.

SD: How does your company stay ahead of the competition?

TM: We start with hands-on, defensive skills, and then decide if we need to fill in critical gaps. We are still reinventing online hands-on cyberlearning like how to engage people and how to provide them with real tools like Recorded Future, Splunk, Carbon Black, and others. That gives a unique experience for the SOC teams.

SD: Where do you think cybersecurity is headed in the future?

TM: For me, because I’m looking through the lens of the human aspect of the cyber landscape, I think cooperation is getting more and more important. We’ve seen now over the past few months that supply chain attacks are getting more and more important, for example. We’re getting so interconnected in every possible way, but how much can we really control our partner’s supply chain? It’s not an easy task at all.

I think we need to make sure that we don’t take cybersecurity as a company problem but more a problem of the ecosystem. We need to encourage our suppliers and partners to make sure that their people are trained very well, that they understand the risks, and that we can tackle all those problems together. I don’t believe that there is any single technology that can help us. I think it’s more about making sure that people who build systems understand what cybersecurity is and how to avoid those problems before they start to build. And also, from the other side of the spectrum, that we have strong defenders that can fix those problems when they do happen.