Rapid increase in security tools causing alert fatigue and burn out
On average, enterprises maintain 19 different security tools, with only 22% of such tools serving as vital to primary security objectives, a ReliaQuest survey reveals.
The report, which surveyed 400 IT and security decision makers at companies with more than 1,000 employees, also unveiled a lack of meaningful ROI metrics when reporting on security progress, as well as disparate opinions on objectives, tool effectiveness and security awareness amongst the organization between executives and operations on security teams.
Most security tools are not being utilized to their full potential
47% of existing IT security tools are used daily. 85% of security decision makers believe they are adding technologies faster than they can productively use them, with 71% admitting most existing tools are underutilized.
Security actually suffers as a result of uncontrolled tool sprawl
71% of security decision makers believe the increasing amount of time they spend managing tools inhibits their ability to effectively defend against threats.
Teams need better integration and automation of disparate tools, as well as better visibility across tools to help them operationalize proactive security programs.
Security execs and operations teams misaligned on program objectives
Security leaders view investment and direction differently than those charged with execution. Executives at the CISO and Vice President levels have their eye on strategic business goals and ROI, while security directors and their staff, on the other hand, are typically faced with putting out fires, spending a growing amount of time managing tools, and manually piecing together data from across these tools to identify threats.
Generally, 57% believe they deactivated a tool due to a better option. However, 52% of top security executives said the tool was not providing proper return on investment, compared to only 20% of security operations professionals. Additionally, 35% of executives felt the reason for replacement was due to lack of in-house expertise, compared to 13% of the operations team.
Lack of meaningful ROI metrics is hindering security progress
Most enterprises struggle to measure ROI for security tools, the survey found. Respondents most often measure their investments using these three metrics: the number of critical vulnerabilities identified (52%), tool functionality (49%), and the percentage increase in visibility (48%).
Only 29% of respondents said they measure the level of visibility contributed by tools across the environment, and only 33% look at how fast they can detect and respond to threats. Additionally, 63% of security operational managers don’t think the board understands the value of new security technologies, versus only 41% of upper management.
According to Aaron Sherrill, Senior Analyst at 451 Research, part of S&P Market Intelligence, “As enterprises add more security tools to their arsenal, they are finding that it is becoming increasingly challenging to integrate those disparate tools into their operational processes and find information across the different data silos within those tools. The problem is only becoming worse as enterprises continue to expand IT ecosystems across multiple environments and rapidly adopt new, emerging technologies.
“Additionally, too often, security leaders report on metrics that are largely qualitative, focusing on discrete technical aspects of the cybersecurity program, or delivering data points with no context. To be meaningful, C-level leaders need measurements in terms that are easy to understand and relatable at the business level.”
“Security is not a game of chance, but one of strategy. Each year, the number of security tools drastically increases, causing alert fatigue and security team burn out,” said Brian Murphy, CEO of ReliaQuest. “But there is light at the end of the tunnel. Enterprises must adopt a focused, strategic approach to security, rooted in vendor-agnostic tool integration.”
Murphy added: “With Open XDR, organizations can now gain visibility into relevant security data, regardless of where it resides. Traditional approaches to XDR use just a subset of security data belonging to one provider or a limited few.
“Open XDR provides comprehensive visibility, rich investigations, as well as access to data and actions, allowing organizations to gain all the insights needed to align on key metrics including those that matter to the board, as well as security management and operations teams in the trenches. This alignment is a game changer for organizations.”