Empowering Minds to Secure the Future
Basudev Raut, Head of Security Research and Validation at SecureIQLab, Kathmandu.
Cybersecurity is 10% technology and 90% people. I bridge that gap by turning complex security concepts into actionable knowledge for everyone.
Basudev Raut
- Head of Security Research & Validation
- SecureIQLab
- Kathmandu, Nepal
I lead security research and validation at SecureIQLab, an independent third-party lab. We test security products against a published methodology and report measured results. The output is written for the people who act on it: IT operations, and the CISOs and CIOs approving the spend.
Before that I spent seven years at Logpoint, now Guardsix. I built and ran its security research function, which published the Emerging Threats series: malware analysis shipped with the corresponding detection rules and mitigation guidance. I then moved into product management as director.
I have also taught cyber threat intelligence and information security at Islington College Kathmandu.
Based in Kathmandu, Nepal.
- Background
- 12+ years in security
How I got here
Cybersecurity is 10% technology and 90% people. Most of my career has been spent on the interface between the two.
The titles have said research, product and lecturer. The work has been largely organisational: hiring analysts, setting research priorities against threat relevance, and converting malware analysis into detection content and guidance an operations team can execute.
Manager
ESC Pvt Ltd
System administration on e-GP Nepal, information system audits for A class commercial banks, and the nepal.gov.np project under the Government Enterprise Architecture.
Head of Security Research
Logpoint
Built and ran the function behind the Emerging Threats series: malware analysis published with corresponding detection rules and mitigation guidance.
Director, Product Management
Logpoint
Lecturer, Cyber Threat Intelligence and Infosec
Islington College Kathmandu
Taught threat intelligence and information security to students entering the field.
Head of Security Research and Validation
SecureIQLab
Testing security products against a published methodology and reporting measured results rather than vendor claims.
How I work
My job is the bridge between them.
Day to day the work is less hands-on malware analysis than building the teams that do it, and converting their output into something the downstream consumer can execute: an operations team on shift, a CISO approving spend, a student choosing what to learn. Analysis that cannot be actioned is incomplete.
The technical work is real. What those teams published is in The Lab, under their authors’ names. It remains the smaller portion of the role.
Claims are not evidence
Security products are sold on claims; detection rules are written on assumptions. Both are testable. The measurable value sits in the delta between specified behaviour and observed behaviour under a test case designed to break it, and telemetry is where that delta surfaces first.
The operator is the point
Technology is the tool; an analyst runs it against a queue of several hundred alerts per shift. A control that does not fit the operator workflow gets bypassed. That is a design defect, not a discipline problem. Culture is a capability you build.
Go looking
Waiting on an alert means depending on a detection someone wrote in advance. Hunt, emulate adversary technique, and feed the results back into detection content. Offensive knowledge is an input to defensive engineering, not a separate speciality.
People
Every organisation that calls its staff the weakest link has already decided not to invest in them. That is a budget decision presented as an observation.
The controls are usually deployed. A control gets disabled because it blocked legitimate work, an alert goes unread because the queue exceeds shift capacity, or a process assumes user behaviour with no incentive behind it. None of that is remediated by procuring another product, which is inconvenient, because another product is what the industry is set up to sell.