Immunity Earned: Winning the Pen Test with Segmentation

Summary

B. Riley Financial passed its external penetration test with no critical or high findings for the first time after deploying Zero Networks microsegmentation, ending years of the same recurring findings. CISO Aaron Goodwin explains that blocking lateral movement and closing administrative access gave his team a protection layer that takes pressure off the patch cycle, so they can test patches properly instead of rushing them, and lets them mitigate vulnerabilities quickly, sometimes before a patch exists. He also shares how he explains lateral movement to executives, what the first month and a half of adoption looked like, and why he sees segmentation as the answer for unpatched IoT devices and printers.

Key takeaways

• After deploying Zero Networks, B. Riley’s external pen test came back with no critical or high findings, breaking a cycle of recurring findings year after year.
• With roughly 130 new vulnerabilities disclosed every day, patching alone can’t break the attack cycle. Microsegmentation adds a protection layer so teams can test patches before applying them.
• When the Outlook SMB vulnerability had no fix yet, a single rule blocking Outlook from using SMB to the internet mitigated it across segmented assets.
• Goodwin chose microsegmentation mainly to stop lateral movement, which appears in most attacks and lets attackers escalate access, steal data, and deploy ransomware.
• Adoption took about a month to a month and a half of learning and testing; executive and IT buy-in grew once teams saw how important blocking administrative access was.
• For skeptical CISOs, the ROI includes clean pen test reports for the board, less stress and burnout for the team, and protection for unpatched IoT devices and printers.

This webinar was recorded in 2025.

Why was passing a pen test such a milestone for B. Riley?

Nicholas DiCola, VP of Customers, Zero Networks: Hey, everybody. I’m Nicholas DiCola, VP of Customers and security Jedi here at Zero Networks, and today I’m joined by a special guest. I’ll let Aaron introduce himself. Go ahead, Aaron.

Aaron Goodwin, CISO, B. Riley Financial: Good morning, Nick. My name is Aaron Goodwin. I’m the CISO for B. Riley Financial. It’s a pleasure to be here.

Nicholas DiCola: It’s awesome to have you. You’ve been a Zero Networks customer for a few years now, right?

Aaron Goodwin: Since 2022, I believe.

Nicholas DiCola: Awesome. One of my favorite memories from when we first started working with you is when you said, “I just passed the pen test.” Why was that so shocking to you?

Aaron Goodwin: There’s a lot that goes into that comment. There were a lot of years of penetration testing with similar results. There was always a critical. There was always a high. There were always multiples, and you just couldn’t stop them from recurring. No matter what we did, sometimes the same things would show up again. We thought we had them fixed, and then we’d find out a year later, because these tests are usually run once a year, that we still had the issue. I remember the first time I got the report from the external testers and there were no highs and no criticals. Man, it was a great feeling. It makes you feel a little better. It tells you you’re doing a good job, your team is doing a great job, and you’re making the right decisions with your partners.

Nicholas DiCola: It’s funny, I use that story a lot with customers, and I twist it a bit, so hopefully you’ll give me a little freedom there. I like to say you told me, “I can actually retire now. I finally achieved the CISO dream of a green pen test in my environment.” That’s the goal of what we try to help with, and something people can learn from.

How does microsegmentation ease the patching cycle?

Nicholas DiCola: How do you think about the constant churn of patching and chasing exposures, and how does it affect your strategy and your team’s day-to-day life?

Aaron Goodwin: Today, roughly 130 vulnerabilities are found every day. Not every one affects every organization, depending on the environment, but we see at least two or three a month that affect our particular environment, and those we have to chase down and investigate further. Of course, vendors release patches, and we stay on top of that. But it’s always a grueling patch cycle. You’re trying to stay as up to date as possible, but you still need time to test those patches with different groups, systems, and operating systems.

Aaron Goodwin: Patching will only go so far. Vulnerabilities exist, they’re found every day, and new patches are constantly released. So what can we do to break the attack cycle? Even if you have the patch installed, there’s going to be another problem attackers could potentially exploit. That’s where we’ve had to focus. The grueling patch cycle churned through so many hours and burned people out. Now we’re able to reorganize our patching process, do more testing, make sure user acceptance is taken into account and things work properly for the dev teams, server teams, and so on, and move forward from there, with another layer protecting us. That’s always the ultimate goal.

Nicholas DiCola: So if I rephrase that, it makes your team’s life a little easier, because now an asset is microsegmented and doesn’t have as many open ports. Maybe that patch isn’t as urgent, and you can delay it a little, or run it through more testing instead of rushing it out the door. Is that fair?

Aaron Goodwin: You’re right, Nick. That’s exactly what I was getting at. Having microsegmentation in place has given us a precautionary protection layer, so we can delay applying some of these patches. Microsoft tends to release a patch that breaks things, and then you’re stuck in that cycle. This gives us plenty of time to test, make sure everything works, and then apply the patch, while still having the protection layer we need.

How can microsegmentation mitigate a vulnerability before a patch exists?

Nicholas DiCola: I remember another good one we worked on together. Speaking of Microsoft vulnerabilities, and not to point fingers, but let’s point some fingers: the Outlook vulnerability with SMB a few years ago. We created a rule with you to block SMB out to the internet. That was a really good quick fix, because your assets were microsegmented, so you could say, “The Outlook.exe process should never use SMB to the internet,” and that vulnerability was closed down for your environment. I thought it was a great example of microsegmentation as a quick solve, versus running around trying to patch everything. What do you think?

Aaron Goodwin: “Quick solve” is a really good term for it. There was no fix out for it yet. We knew there was a vulnerability, and we wanted protection in place. I remember calling you and saying, “Dude, we’ve got to figure this out and see if we can do something.” We were able to come up with a solution really quickly and put it in place. And that’s not the only time we’ve done that. There are other situations where there’s no remedy, and we say, “Let’s find a way to block it from going across the network or the internet.” It’s been a way to go beyond what we’ve done on the external firewall side and stop a threat before it ever leaves the environment. I think that’s a really big win. It saves us time waiting for patches, because we can quickly stop these services from exposing vulnerable situations.

Why did B. Riley choose microsegmentation?

Nicholas DiCola: I’m sure your leadership asks, “What’s your plan to solve this?” With a quick solve, you can say, “We’ve got it mitigated until an actual patch is released.” When you were first looking at microsegmentation, what were your motivations?

Aaron Goodwin: There were a few, but the biggest thing I wanted to achieve was stopping lateral movement inside the environment. No matter what we’d done in the past through threat hunting and similar work, there was always a point of lateral movement available to an attacker or a pen tester, and I really wanted to stop that. I wanted to put up, for lack of a better term, a firewall to protect those services and features from being abused and potentially causing data loss, a breach, or whatever else.

Aaron Goodwin: There continue to be a lot of benefits from these products that I didn’t realize in the beginning. And outside the corporate world, I’ve always thought home users would benefit from something like this, because our home routers are compromised straight out of the box from the manufacturer. So I still see an evolution coming that could benefit the entire world, not just corporations.

How do you explain lateral movement to executives and the board?

Nicholas DiCola: You mentioned lateral movement prevention. That’s a pretty technical term, so I’ll challenge you a bit. How would you explain it to a CIO, CFO, or board that doesn’t understand what lateral movement prevention means to the business?

Aaron Goodwin: I usually explain lateral movement as the ability to abuse a particular service or feature within our native tools or systems to gain higher levels of access in our environment. That essentially makes attackers trusted users in the environment, so they can expose our data and use it for extortion or ransomware campaigns. These services and features sit natively in our environment, and a lot of people don’t know they’re there. That’s exactly why we need to learn how to stop lateral movement, because the majority of attacks we see today involve some sort of lateral movement in the attack sequence, which lets attackers gain greater access or a stronger hold on the environment.

Aaron Goodwin: That costs companies billions of dollars to remediate, keeps cyber insurance costs skyrocketing, and is causing insurers to drop clients. Some companies just don’t know how to handle these struggles, and their executive teams need to be aware of them so they can empower the people in charge of security and IT to take control and put these protections in place.

How did microsegmentation affect the security team?

Nicholas DiCola: And it’s not if, it’s when an attack occurs. We see that quite a bit. There was a very sad article yesterday about a 158-year-old company that was compromised because of a simple password. The attackers moved laterally, ransomed the whole company, and it just couldn’t recover. Lateral movement is definitely how attackers are winning, and stopping it is the way to stop them. Once you implemented microsegmentation in your environment, how did it affect your team, in good or bad ways?

Aaron Goodwin: Initially, we had to get used to it. It’s a new type of process, and it’s something the networking, server, and endpoint teams weren’t really familiar with. We had to learn the ins and outs of how it was going to work, and it uses tools built into the operating systems, like the host firewalls we’ve always had. Not just us, but IT teams in general, have always struggled to manage the rules in those engines to stop certain things. It was very hard to manage.

Aaron Goodwin: So it took some time, I’d say a month to a month and a half, to figure out how we were dealing with it, test things, and make sure everything was working properly. At that point, you become very reassured that it knows what it’s doing. We keep an eye on it, because some rules can go dormant over time due to patches or other changes, so that’s something we’re constantly aware of and have become better attuned to.

Aaron Goodwin: Blocking access to administrative features was the biggest thing. As soon as people realized how important that was to protecting the overall environment, we got a lot more buy-in from the executives and the IT teams, and we were able to ramp up protection across the entire environment with a single tool. That’s hard to do with any single tool. We usually need multiple tools doing similar things, so when you’re able to get that much power out of one tool, it’s a big deal.

What’s the ROI of microsegmentation for a skeptical CISO?

Nicholas DiCola: It’s funny: by human nature, people don’t like change. My favorite saying is, “Be comfortable being uncomfortable,” because that challenges you to learn and keep growing. But by nature, we like comfort, routine, and doing the same thing. When you introduce new capabilities into the environment, whether it’s a Zero Networks product or anything else, it’s always a challenge for teams to adopt. But once they understand that it’s really raising their security posture, people tend to adopt fairly quickly. Yes, it adds a step for admin actions, like MFA, but it really helps stop attackers. If you were sitting down with another CISO or peer who’s skeptical about microsegmentation, what would you tell them about the ROI or business impact?

Aaron Goodwin: I tend to think about it in terms of life events. I would tell a CISO that, as technology leaders who fight these battles against attackers every day, our lives tend to be very stressful. We don’t spend quality time with our families the way we want to, and we’re not getting the sleep we need. Those are some quick wins microsegmentation has brought to my team, my life, and our IT departments.

Aaron Goodwin: But what it comes down to is: do you want to keep showing the same results from the same testing cycle every year? Do you want to keep going back to the board and saying, “We had another critical and high finding this time, in fact, multiple,” or, “We were just attacked, and they’re inside our environment”? Having those repetitive conversations causes more stress. CISOs worry about the security of their jobs, their company, and their customers’ data. It’s time to take control and put something in place that’s effective and helps them regain some peace of mind. We keep going down this path of nipping and tucking the areas that may be vulnerable, but how do we actually stop it? That really comes down to microsegmentation.

Aaron Goodwin: IoT devices are another example. We’re flooded with smart devices, like TVs, that run their own operating systems and are very rarely patched. Microsoft releases patches every month, but you don’t see Samsung releasing a patch for its TV operating system every month. So how do we protect those devices and segment them away from the environment so they don’t become an attack point? They’re an easy path to a breach. Printers are the same. Printer security is something people have always struggled with, and printers can be a quick attack vector for a rogue employee, or for someone walking by whose Wi-Fi access allows internal access. Being able to put a protection layer in between is a real positive, forward-thinking approach.

Nicholas DiCola: I hope Samsung and Panasonic don’t hear this webinar, or they might start a business line just to manage TVs in businesses. But it’s a real problem. We’re bringing consumer electronics into secure business environments, and they don’t meet the same standards for enterprise patching, management, and configuration. That brings a lot of risk, which is exactly why segmentation solves it. Aaron, I really appreciate you taking the time with us, and I hope this is valuable for everyone listening. If you don’t follow Aaron on LinkedIn, I highly suggest you do. He lives out in Wyoming and posts amazing pictures of the area and the animals he comes across on his hikes. Keep sharing those, Aaron.

Aaron Goodwin: For sure. Thank you for the time. I really appreciate it, and I hope this helps somebody else.

Nicholas DiCola: Awesome. Thank you.