Published on: January 9, 2025
SafetyDetectives recently interviewed Ken Zalevsky, CEO and MedTech cybersecurity expert at Vigilant Ops. With a career dedicated to addressing the complex challenges of medical device cybersecurity, Ken has been at the forefront of innovation, driving advancements in software supply chain security through automation and proactive threat management. In this Q&A, he shares insights into his journey, the importance of Software Bills of Materials (SBOMs), and the growing risks in today’s cybersecurity landscape. Dive in to discover how Vigilant Ops is setting new standards for securing software ecosystems in heavily regulated industries.
Can you talk about your journey that led to you becoming the CEO at Vigilant Ops?
My journey to becoming the CEO of Vigilant Ops has been shaped by a lifelong passion for cybersecurity and a commitment to building solutions that not only address critical industry challenges but also deliver exceptional value to our customers. From the beginning of my career, I’ve been fascinated by the intersection of technology and security, and this passion has driven me to explore innovative ways to make a lasting impact on the field.
Before launching Vigilant Ops, I had the privilege of leading the medical device cybersecurity function at Bayer. In that role, I quickly came to understand the unique and complex challenges faced by the healthcare industry. Securing medical devices was often an uphill battle, hindered by a lack of automated tools and an over-reliance on manual processes. These limitations presented significant risks and inefficiencies, underscoring the urgent need for a better approach to managing cybersecurity in this critical domain.
As an experienced technologist, I couldn’t help but see an opportunity to solve this problem through automation. I realized that many of the repetitive, labor-intensive tasks involved in medical device cybersecurity, particularly those related to managing the software bill of materials (SBOM), could be streamlined and optimized with the right technology. Driven by this insight, I set out to build a platform that would revolutionize SBOM lifecycle management, making it more efficient, reliable, and scalable.
This vision led to the creation of Vigilant Ops—a company dedicated to automating the SBOM lifecycle and empowering organizations to proactively secure their software supply chains. At Vigilant Ops, we are committed to advancing the cybersecurity landscape and equipping our customers with the tools they need to stay ahead of emerging threats. It’s been an incredible journey so far, and I’m excited about the future as we continue to innovate and make a meaningful difference in the industry.
What are some of the flagship services that make Vigilant Ops standout in the industry?
What truly sets Vigilant Ops apart in the industry is our unique combination of deep technical expertise, an unwavering commitment to innovation, and a customer-first approach that drives everything we do. Our leadership team brings decades of experience in cybersecurity, with a particular focus on the most heavily regulated industry—healthcare. This specialized knowledge has allowed us to build a platform that not only meets the stringent demands of this sector but also sets the standard for others to follow.
One of our key differentiators is our passion for creating meaningful partnerships with our customers. We see ourselves as more than just a technology provider—we are a trusted partner dedicated to understanding our customers’ needs and helping them achieve their goals. Our team actively works to develop solutions that not only address immediate challenges but also anticipate future ones. This forward-thinking approach ensures that our customers are always ahead of the curve, equipped with tools that exceed their expectations and drive measurable value.
In regulated industries like healthcare, compliance is often a moving target, with shifting regulations and evolving standards creating a complex landscape to navigate. At Vigilant Ops, we don’t just react to these changes—we actively shape the conversation. Our team is deeply involved in key cybersecurity initiatives, including participation in working groups organized by CISA (Cybersecurity and Infrastructure Security Agency) and other global cybersecurity organizations. These collaborations ensure that we stay aligned with the latest developments in regulatory ecosystems, allowing us to provide our customers with solutions that are not only compliant but also proactive in addressing emerging threats.
At the end of the day, our goal is simple: give customers the tools, knowledge, and confidence they need to secure their environments and meet their compliance obligations. Vigilant Ops stands out not just for what we do, but for how we do it—with integrity, expertise, and a commitment to excellence that inspires confidence in our customers and partners alike.
SBOMs have become a buzzword in cybersecurity. For readers unfamiliar with the concept, how would you explain their importance in improving software security?
An SBOM, or Software Bill of Materials, is essentially a detailed list of all the software components—such as libraries, dependencies, and third-party code—that are included in a system, application, or device. Think of it as the equivalent of an ingredient label on food packaging. Just as you’d look at an ingredient label to understand what’s in your food—especially if you have dietary restrictions or allergies—an SBOM provides critical information about the components of a software product. It helps organizations understand what’s “under the hood” so they can better assess potential risks.
This transparency is critical because most modern software isn’t built from scratch. It often relies on open-source components, third-party libraries, and proprietary code, which can introduce vulnerabilities if they’re not properly tracked and managed. Without an SBOM, organizations are essentially flying blind, unaware of what software components they’re using and whether those components contain known vulnerabilities or licensing risks. This lack of visibility creates significant security blind spots, making it nearly impossible to protect against threats you don’t even know exist.
The importance of SBOMs becomes even clearer when you consider how quickly cyber threats are evolving. High-profile supply chain attacks, such as SolarWinds and Log4j, have demonstrated the devastating impact of vulnerabilities hidden deep within software. These incidents have underscored the need for organizations to not only understand the components of their software but also to quickly identify and address vulnerabilities before they can be exploited. An SBOM acts as a foundational tool for this process, enabling organizations to map out their software ecosystem and respond swiftly when new vulnerabilities are discovered.
Beyond improving security, SBOMs also play a vital role in compliance and risk management. Regulatory frameworks, such as the U.S. Executive Order on Improving the Nation’s Cybersecurity, now emphasize the importance of SBOMs for securing the software supply chain. For organizations operating in regulated industries—like healthcare, finance, or energy—providing an SBOM is quickly becoming a prerequisite for doing business. It demonstrates due diligence and a proactive approach to managing software security risks.
In short, SBOMs are much more than a buzzword—they are a critical tool for achieving transparency, improving software security, and mitigating risks in today’s increasingly complex software supply chains. By providing a clear understanding of the components that make up a software product, SBOMs empower organizations to take control of their cybersecurity posture and build trust with their customers and partners. The importance of SBOMs in safeguarding our digital infrastructure will only grow.
The importance of software supply chain security is growing rapidly. What are the biggest risks organizations face today, and why should they care about managing their software dependencies?
We live in an increasingly connected world, where the benefits of seamless communication, innovation, and efficiency often outweigh immediate concerns about security. However, as organizations continue to adopt new technologies and expand their digital ecosystems, the risks associated with software supply chain security have become more tangible and pressing than ever before. These risks are no longer hypothetical—they are real, immediate, and capable of causing significant disruption, financial loss, and reputational damage if left unaddressed.
At the heart of the challenge lies the complexity of modern software development. As mentioned in the answer to the previous question, organizations rarely build applications entirely from scratch; instead, they rely heavily on third-party libraries, open-source components, and software provided by external vendors. While this approach accelerates development and reduces costs, it also introduces hidden risks. Any vulnerability in one of these dependencies can serve as an entry point for attackers, enabling them to exploit the software supply chain and compromise systems far beyond their initial target.
One of the biggest risks organizations face today is the prevalence of supply chain attacks, where cybercriminals target weak links in the software development process. A single vulnerability in one component can cascade through the supply chain, affecting thousands—or even millions—of users downstream. Organizations that fail to manage their software dependencies risk being caught off guard by these vulnerabilities, often discovering them only after an attack has occurred.
Another significant risk is the lack of visibility and transparency into software dependencies. Without a clear understanding of the components that make up their software, organizations are essentially operating in the dark. This makes it difficult to identify and remediate vulnerabilities, track licensing compliance, or assess the potential impact of new threats. The complexity of software dependencies further exacerbates this issue, as organizations may unknowingly inherit vulnerabilities embedded deep within third-party libraries or open-source code.
Compounding this problem is the rapid pace of change in the cybersecurity landscape. New vulnerabilities are discovered daily, and attackers are becoming more sophisticated in their methods. Traditional security approaches—such as perimeter defenses or endpoint protection—are no longer sufficient to address the challenges of supply chain security. Organizations must adopt a more proactive approach to managing their software dependencies, focusing on continuous monitoring, automated vulnerability detection, and real-time risk assessment.
Software supply chain security is no longer optional—it’s a fundamental requirement for any organization that depends on technology to operate and grow. The time to act is now, before the next major supply chain attack makes headlines and underscores the cost of inaction.
What do you think are the most significant gaps organizations need to address to secure their supply chains effectively?
The most significant gaps organizations need to address to secure their supply chains effectively stem from a combination of insufficient visibility, lack of standardization, inadequate processes for maintaining and using critical data, and an overreliance on reactive approaches to cybersecurity. While SBOMs (Software Bill of Materials) have emerged as a powerful tool in the continuous battle against cyber threats, their potential is only fully realized when they are well-maintained, widely shared, and actively utilized to enable proactive threat management.
One of the biggest gaps is the lack of comprehensive adoption of SBOMs. While many organizations are beginning to recognize the importance of SBOMs as an essential component of software supply chain security, adoption is still uneven across industries. Many companies view SBOMs as a regulatory checkbox rather than a living, actionable resource. This mindset prevents organizations from leveraging SBOMs to their full potential, such as using them to detect vulnerabilities in real time or identify outdated or unsupported components before they become a liability.
Another critical gap is the failure to integrate SBOMs into existing security and development workflows. An SBOM is only as effective as the processes built around it. Organizations often struggle to operationalize SBOMs, either due to technical limitations, lack of training, or an absence of clear ownership. For example, without automated tools to track and update SBOMs throughout the software development lifecycle, they can quickly become outdated, rendering them ineffective. Similarly, many organizations lack integration between SBOM tools and vulnerability management platforms, which means the insights provided by SBOMs are not being used to drive actionable responses.
A reactive approach to cybersecurity also poses a significant gap. Many organizations focus their resources on responding to incidents rather than proactively preventing them. This is especially problematic in the context of supply chain security, where the time between a vulnerability being discovered and exploited can be incredibly short. To address this, organizations need to adopt a more proactive approach, leveraging tools like SBOMs to continuously monitor their software environments, identify potential risks, and take corrective action before vulnerabilities can be exploited.
Closing these gaps requires not just better tools but also better processes and a commitment to making security a priority at every level of the organization.
As cybersecurity threats continue to evolve, what challenges do you see organizations facing when trying to secure their software ecosystems?
As cybersecurity threats continue to evolve, organizations face a wide range of challenges when trying to secure their software ecosystems. One of the most pressing issues is the lack of visibility into the software components that make up their systems. Tools like Software Bills of Materials (SBOMs) can help provide this visibility, but adoption and operationalization remain inconsistent across industries.
Another major challenge is managing the software supply chain, which has become a prime target for cybercriminals. The complexity of today’s supply chains, involving numerous vendors and dependencies, makes it difficult for organizations to ensure that all links in the chain adhere to rigorous security practices.
Organizations are also grappling with the rapid pace of change in cybersecurity. New vulnerabilities and attack techniques emerge daily, and attackers are becoming increasingly sophisticated, often using automation and artificial intelligence to scale their operations.
Adding to these difficulties are regulatory changes and resource constraints. As regulations like the U.S. Executive Order on Improving the Nation’s Cybersecurity and the EU’s NIS2 Directive are raising the bar for supply chain security, organizations must dedicate significant resources to ensure compliance.
Legacy systems present yet another obstacle. Many organizations still rely on outdated software that was not designed to withstand modern cybersecurity threats. These systems often use unsupported libraries or insecure configurations, making them easy targets for attackers.
In summary, securing software ecosystems is a multifaceted and dynamic challenge. Organizations must address issues such as visibility, supply chain management, automation, fragmented tools, compliance, and skills shortages, all while staying ahead of rapidly evolving threats. Achieving this requires a proactive and integrated approach, combining technological solutions with a culture of security and continuous improvement. Those that prioritize these efforts will be better positioned to protect their assets, reputation, and customers in the future.