Aegis / Blackridge Investments - HIPAA Compliance Review

Perfect, yeah, that's really the main focus for us today. Um, so just to set the stage a little — Warren, do you want to give everyone a quick overview of where Blackridge is at from a compliance standpoint before we jump in?

Sure, yeah, happy to. So, uh, as you know we're primarily a financial services firm, right, but we have a subsidiary — Blackridge Health Finance — that handles healthcare lending and some benefits administration, and that arm of the business has to be fully HIPAA compliant. We went through an internal audit last quarter and honestly, the reporting piece was just... it was painful. A lot of manual work, a lot of spreadsheets, and our auditors were not happy.

-1Warren describes the internal audit's reporting as painful, with manual work and unhappy auditors. · compliance reporting

Yeah, that's such a common story and it's — honestly it's one of the exact things that the new Comply v2 release was built to address. Julia, I'm curious, from your perspective on the analyst side, where were the biggest friction points in that audit process?

So, um, the biggest thing for me was just the evidence gathering. Like I was spending, I don't know, probably two full weeks before the audit just pulling logs from different systems, trying to reconcile timestamps, making sure our access control documentation was current. It was... yeah, it was a lot of manual effort that felt like it shouldn't have to be manual.

-1Julia says she spent about two weeks pulling logs and reconciling timestamps for the audit. · compliance reporting

Two weeks — yeah, that's significant. And that's two weeks of your time that's not going toward actual security work.

Exactly, exactly. And we had a near-miss on a deadline last time because of it, so Warren kind of lit a fire under us to find a better solution.

-1Julia mentions a near-miss on an audit deadline that prompted the search for a better solution. · compliance reporting

Right, and that's — that's kind of what led us back to this conversation with Aegis. We've been running Protect and Identity for about, what, eight months now? And those have been really solid. So when Lisa mentioned that the Comply module had a major update, it felt like the right time to take a closer look.

+1Warren says Protect and Identity have been really solid over eight months. · service reliability

Yeah, exactly, and honestly Warren your timing could not be better. So Aegis Comply v2 went generally available on April 7th — just a couple weeks ago — and the headline feature for a customer in your situation is really the on-demand compliance reporting. So instead of that two-week evidence gathering scramble, you can generate a full HIPAA report... basically whenever you need it. On demand.

Great question. So there's an initial configuration pass — you're mapping your environment, defining your scope, connecting your data sources — and that typically takes, uh, Maria correct me if I'm off, but somewhere in the range of a few days to maybe a week depending on environment complexity?

Yeah, that's right. For a environment like yours where you already have Aegis Identity and Protect running, honestly it could be even faster because we're already pulling a lot of the relevant signals. The IAM data, the access logs, the backup records — a lot of that is already flowing into the platform. So once Comply is scoped and configured, generating a HIPAA report is... yeah, it's essentially a few clicks.

Okay, that's — that's actually really compelling. Because right now it's like, we have all this data in various places and it's just not... connected in any meaningful way for audit purposes.

+1Julia calls on-demand reporting compelling because audit data is currently unconnected. · compliance reporting

That's exactly the problem Comply v2 was designed to solve. And you mentioned HIPAA but I do want to flag — the multi-framework support is a big part of this release too. So you get SOC 2, PCI DSS, ISO 27001 all in the same platform. Given that you're in financial services, I'd imagine PCI DSS is also on your radar.

Oh yeah, absolutely. We have a separate compliance cycle for PCI and right now that's managed by a completely different team using completely different tools, so the idea of consolidating that is... yeah, Warren, that's something we've talked about.

We have, yeah. I mean, the consolidation story is attractive from a cost standpoint and also just from an operational standpoint. Having one pane of glass for compliance across frameworks — that's something our board has actually been asking about.

+1Warren says consolidating compliance frameworks is attractive and the board has been asking about it. · compliance reporting

Exactly, yeah. So, um, I do want to just mention one thing — and Maria, jump in here — but we did have a period of instability on the Detect side back in March, some of you may have been aware of that. We were very upfront about it. That was a six-hour window where event processing had an issue. That's been fully resolved with redundant nodes and a circuit breaker pattern, and I want to be transparent that we took that very seriously.

Yeah, we did see the incident notification. Appreciate that you were proactive about communicating it. Honestly, the transparency there actually... it increased my confidence in Aegis a little, weirdly enough. Like you didn't try to hide it.

+2Warren says Aegis's transparency about the incident increased his confidence. · support experience

That means a lot to hear, Warren, really. And just to be clear, Comply v2 — the reporting infrastructure — runs on a completely separate pipeline from the Detect event processing, so that incident has no bearing on the compliance reporting capabilities.

Um, yeah, one thing — what does the scheduling look like? Can we set up automated recurring reports or is it purely on-demand?

Both, actually. You can do on-demand whenever you need a fresh snapshot, but you can also configure scheduled reports — monthly, quarterly, whatever cadence makes sense for your audit cycles. And they get delivered to whatever stakeholders you define, so Warren could get an executive summary automatically without Julia having to manually generate and send it.

Oh that's a nice feature. Yeah, I currently send Warren a monthly compliance status email that takes me like an hour to put together. That's... I could see that going away.

+1Julia says the scheduled report feature could eliminate her hour-long monthly compliance email. · compliance reporting

I'll take it! Um, one more question — and this is maybe a bigger one — what does the integration look like with our existing SIEM? We're running LogVault.

LogVault is fully supported, yeah. We have a native connector — it's not a custom integration, it's out of the box. So Comply can pull relevant log data from LogVault as part of the evidence collection, which again reduces the manual work significantly.

Okay, that's a big one for us. We were a little worried we'd have to do some heavy lifting on the integration side but that's — that's reassuring.

+1Julia calls the native LogVault integration a big one and reassuring. · product capability

So from a next steps standpoint — and I want to make sure we're leaving this call with something concrete — I'd love to propose that we put together a scoped proof of concept specifically for the HIPAA reporting against your Blackridge Health Finance environment. We can have our implementation team map out the configuration, give you a realistic timeline, and then do a demo with your actual data architecture. Does that sound like a reasonable path forward?

Yeah, I think that makes a lot of sense. Warren, what do you think?

I think so, yeah. I'd want our legal and compliance team looped in before we go too far down the path, but a scoped POC sounds like the right way to validate the approach. Lisa, can you get us a proposed timeline for that?

Absolutely, I'll have something over to you by end of week. And I'll include a contact from our implementation team so Julia can connect directly with them on the technical environment questions. Maria, anything else you want to cover before we close out?

Just one thing — I'll send over the v2 release notes and a sample HIPAA report PDF after this call so Julia and the team can review it offline. And Warren, I'll include some customer case studies from other regulated industries — not exactly financial services but close enough that they should resonate.

Really appreciate your time Warren, Julia. We're excited about this one and I think Comply v2 is going to make a real difference for your team. We'll be in touch by Friday with the POC proposal. Have a great rest of your week everyone.