Hyperproof
Creating a Better Governance, Risk and Compliance Strategy

Organizations seeking to achieve their operational goals are constantly under pressure due to the ever-changing complexity of the business environment. As a result Governance, Risk, and Compliance (GRC) is one of the essential elements that an organization must implement to overcome these challenges and meet both strategic objectives and the needs of its stakeholders. The practical implementation of GRC is able to do this, by reducing the harmful effects of organizational silos and redundancy through integrated and unified methods, which in turn help organizations reduce risks, and improve control, security, and compliance. However, most organizations don’t see the interrelation between GRC and their impact on business operations.

Hyperproof, a cloud-based software solution provider, is able to highlight that value and offers GRC as a unified solution to businesses to streamline their compliance operations. In addition, the Hyperproof solution is a cloud-based software that standardizes the compliance process, facilitates compliance programs andfills in the organization’s gaps in knowledge in preparing for audits and solving common goals and replication issues required for IT audits. In an exclusive interview with CIO Applications, Hyperproof’s founder and CEO Craig Unger shares his thoughts on the Hyperproof solution and its benefits to customers.

What according to you are some of the biggest challenges existing in the space?
Doing compliance work is quite a manual and inefficient job. There’s a lot of copy-pasting, collecting spreadsheets, and inherent duplication in the information that you have to manage, especially when you are doing more than one audit a year, with very little reuse between them. It can’t even look at the organization and say that they must develop a compliance plan with board members, management, and other stakeholders. For instance, suppose you are collecting all the information in an electronic format. In that case, you will most likely convene a jury to produce an electronic format that will tell you about the analysis. Therefore, there is no consistency in predicting your overall position.

Furthermore, people in your organization may be suffering from audit fatigue, which means that every time you conduct an audit, you would end up asking them for the same information, or maybe a slightly updated version of it. This is a tax for them because there is no modern approach.

Could you elaborate on the various products that Hyperproof offers to the market?
We have a pretty unique vision. We decided to develop a business application that supports clients effectively.

What do I mean by that? Look at what has simplified business applications in the past—an associated methodology is implemented by a specific set of entities or schemas, various entities, and data that they store, combined with what I would call a set of persistent workflows. Nothing is preventing us from doing the same thing in compliance; it just hasn’t been done before. So Hyperproof is the first system that takes this particular methodology. We call it ComOps, short for compliance operations. It is an approach and methodology that starts with the type of data you have and privileges that you grant to different participants in different areas of the organization, and most importantly, the types of workflows these roles respond to based on this data. Evidence gathering, auditing, supplier management, or risk filling mechanisms, all of these are particular functional areas of Hyperproof.

Could you share a customer success story with our readers?
Our software simplifies and accelerates compliance work and audit processes. The main goal of our products is to reduce the complexity of compliance. One of our customers’ named ‘Clarifire’ encountered a compliance issue. The company provides workflow applications in the customer service industry. An increasing number of their prospects were asking for their compliance status before doing business with them. Richard Guerrero, CISSP, Clarifire’s Director of Risk and Compliance, joined the company in 2017 with the mission of optimizing and expanding risk management and compliance functions. His predecessor had managed their security compliance program in spreadsheets, which wasn’t a sustainable solution as the company’s compliance requirements continue to expand in support of business growth. Richard took a different approach and partnered with us. Clarifier was soon able to streamline audit preparation work around SOC 2 Type 2, TruSight and KY39, and ensure compliance with HIPAA and several state-specific data privacy regulations with our software. With Hyperproof’s Risk Register tool, customers can now centrally track all risks and compliance efforts. There was no need to use a separate device and the approach enabled customers to improve their operational efficiency and risk management.

What is the company’s roadmap for the near future? Is there any new functionality or future rollout that you are going to introduce?
Hyperproof has been advancing the product very quickly over the past 12 to 18 months in terms of business capability. Recently we entered the enterprise market space. One area where we focus most of our innovations is in collecting evidence and simplifying it. It also includes integrating artificial intelligence and machine learning approaches to evaluate evidence in a more automated manner; a kind of test framework that we started to develop. We are also developing more automation tools called ‘Hypersense,’ which helps you fetch telemetry, security, and user list data out of your services, whether they be in Azure, AWS, GitHub, or JIRA. Wherever it comes from, you can get sensitive data on your infrastructure and bring that in and map it to the correct controls as evidence to ensure the correct policies are being followed.

We have an initial set for automation within the product and we are starting to build that out for the next six to eight months down the line. From a market perspective, we will continue to expand our market footprint and continue to sell our products to larger enterprises. Most of our customers are from Europe, and so we are also planning to broaden our customers’ reach in that geography. We are also increasingly focusing on several industries where compliance is paramount. The demand for compliance is growing exponentially in the traditional sectors such as financial services, healthcare, and the government, and as a result the need for this type of tool and approach is increasing as well.