Customer Case Tozetta x McMain: In Control of Information Security
Read in this article how Tozetta supports its partner McMain in continuously exposing vulnerabilities within their systems.
As a software company with 40 years of experience, McMain knows better than anyone how important digital security is. But how do you make sure you're truly in control? How do you know at any given moment whether there are vulnerabilities in your software — especially in a fast-growing organization? McMain faced this challenge and found the solution in a collaboration with Tozetta. In this customer case, discover how continuous scanning and on-demand pentesting (Hacking as a Service) support McMain!
Can you tell us something about McMain?
At McMain, we help businesses take the step toward digital maintenance management. We do this by building maintenance software and helping businesses implement it. Our personal attention and eye for process make us unique. McMain is a family business and has been around for 40 years.
Can you tell us something about your role at McMain?
In my role as Technical Manager, I'm responsible for IT and Development at McMain. An important part of that is shaping a vision and strategy for information security.
What challenges did you have in the field of cyber security?
At McMain, we've been building software for 40 years, and security has always played a major role in that. Since 2023, we've been ISO 27001 and ISO 9001 certified. This motivated us to establish a clear vision and policy around information security. We discovered that we couldn't always say, at any given moment, whether known vulnerabilities existed in our software or infrastructure — despite our efforts around secure coding and previously implemented measures. Our software was changing too fast for that, and we're also a fast-growing organization.
We appreciate the short lines of communication, flexibility, and clear reporting in the Tozetta Reports application!
Thomas, Technical Manager at McMain
How did Tozetta & Hacking as a Service help with this?
Tozetta helped us implement daily vulnerability scans using Guardian360, and with Hacking as a Service, we can have on-demand pentests carried out after an important release of our software — in addition to a thorough annual pentest.
What's the advantage of continuous scanning compared to (pen)testing just once a year?
An annual pentest is only a snapshot in time. Now I can show at any moment whether — and which — vulnerabilities exist, and act on them. Every version we release is automatically tested for known vulnerabilities, and if we want, one of Tozetta's hackers can pentest again. That gives me the feeling that we're in control, and we're better positioned against cyber threats.