Enterprise Strategy Group | Getting to the bigger truth.™

ESG SHOWCASEWhat Security Pros Want for Threat
Detection and Response
Date: October 2022 Author: Jon Oltsik, Senior Principal Analyst and Fellow

ABSTRACT: Security operations are challenging and getting harder all the time, but when security pros seek help fromthe security technology industry, they often get confusing messages and false promises. ESG research reveals what SOC
teams want in a threat detection and response platform. Vendors like Stellar Cyber provide solutions that truly alignwith these requirements.

Organizations Face an Assortment of Security Operations Challenges
Security operations are vital for protecting critical assets, detecting/responding to threats, and managing cyber-risks. Yet,
security operations don’t come easily. According to recently published ESG research, many organizations face a multitude
of common security operations challenges, such as (see Figure 1): 1• Constant firefighting. Just over one-third of security professionals admit that their security operations team spends

most of its time addressing emergencies, leaving little time for strategy or process improvement. This type of constantfirefighting cannot scale, while a high-stress work environment tends to burn out the SOC team. Nothing good cancome of this situation.
• An expanding attack surface. One-third of security pros say that their security operations team is challenged to

manage and monitor security across a growing attack surface. This is a real problem—previous ESG research reveals
that 67% of organizations claim that their attack surface has grown over the past few years, driven by third-party IT
connections, the need to support remote workers, cloud-native application deployment, and SaaS implementation. 2For security operations, a growing attack surface means more assets, vulnerabilities, alerts, and work. Thus, theinability to monitor and manage a growing attack surface increases cyber-risk.
• Operationalizing threat intelligence. This involves using raw threat information for blocking indicators of compromise(IoCs), uncovering gaps in security defenses, monitoring adversary behavior, and aligning threat feeds with the MITRE
ATT&CK framework. Regrettably, operationalizing threat intelligence requires advanced skills, formal workflows, andtechnology integration. Many security teams lack the appropriate budgets, staff, and skills to accomplish these goals.
• Too many manual processes. Security operations often depend upon individual skills or tribal knowledge rather thanformal automated processes. Manual processes don’t scale, however, limiting the speed and scale of the SOC.

12Source: ESG Complete Survey Results, SOC Modernization and the Role of XDR, September 2022.
Source: ESG Research Report, Security Hygiene and Posture Management, January 2022.

This ESG Showcase was commissioned by Stellar Cyber and is distributed under license from TechTarget, Inc.
© 2022 TechTarget, Inc. All Rights Reserved.

Showcase: What Security Pros Want for Threat Detection and Response2• Too many tools. ESG research indicates that 54% of organizations use 26 or more tools for security operations. 3 This

creates operational overhead and complexity, demanding that SOC personnel pivot from tool to tool to get their jobs
done.
• Too many alerts. SOC teams often describe things like “alert storms” and “alert fatigue” because of the growing

volume of security alerts. Hamstrung by manual processes and too many tools, SOC teams simply cannot keep up
with alert volume, leading to uncomfortable tradeoffs between investigating or ignoring suspicious or anomalousbehaviors.

Figure 1. Top Ten Security Operations Challenges
Which of the following would you say are your organization’s current, primary security
operations challenges? (Percent of respondents, N=376, three responses accepted)
The cybersecurity team at my organization spends most of its
time addressing high priority/emergency issues and not enoughtime on strategy and process improvement

34%

Monitoring security across a growing and changing attack surface

33%

Operationalizing cyber-threat intelligence

24%

My organization is actively moving workloads to the public cloud,and we don’t have the appropriate level of security oversight inthis area

24%

My organization’s security analytics and operations are anchoredby manual processes that hinder our ability to keep up

23%

We use too many disconnected point tools for security analytics
and operations, making it difficult to piece together a holistic
strategy

21%

Keeping up with the volume of security alerts

21%

Investigating security incidents is taking longer

18%

Determining which incidents to prioritize

17%

Detecting/responding to security incidents in a timely manner

17%
Source: ESG, a division of TechTarget, Inc.

Security Pros Need Technology Solutions, Not Industry Hyperbole
Facing numerous challenges, CISOs need help from their security technology vendors, but many claim that the industry
responds to their needs with soundbites and spin. In fact, new research from ESG and ISSA indicates that 73% of security
3Source: ESG Complete Survey Results, SOC Modernization and the Role of XDR, September 2022.
© 2022 TechTarget, Inc. All Rights Reserved.

Showcase: What Security Pros Want for Threat Detection and Response

3professionals agree that security vendors tend to engage in too much hype and not enough substance. 4 This is certainly
true regarding security operations, with its abundance of acronyms (i.e., EDR, NDR, SIEM, SOAR, UEBA, XDR, etc.), conflicting
product definitions, and inflated efficacy claims. Security professionals often tell ESG that they know their current security
strategies are inadequate, but they don’t know what actions they should prioritize to break this ineffective cycle.
While industry hyperbole and confusion persist, security professionals have strong opinions about what is most important
for threat detection and response technologies (see Figure 2). 5 They want platforms that deliver:• A complete solution for threat prevention, detection, and response. In other words, they want solutions that canintegrate with security controls, update prevention rules, and reinforce defenses in addition to monitoring anddetection.
• Security monitoring across the entire attack surface (aka Lateral Movement). Sophisticated cyber-attacks canprogress across endpoints, networks, data centers, cloud-based workloads, and SaaS applications. Rather than lookat each domain individually, SOC teams want solutions that can monitor behavior, protect assets, and detectsuspicious/malicious activities across all components of hybrid IT.
• Central management. To ease operations, SOC teams want one place from which to monitor security status, triage

alerts, escalate investigations, and take remediation actions. This includes support for junior and senior analysts withcustom dashboards supported by role-based access controls.
• Security analytics for more timely and accurate threat detection. Security operations tools should provide layers ofdefense by providing static detection rules, behavior-based heuristics, and advanced analytics using nested machinelearning algorithms. The goal? Weed out pedestrian threats while providing accurate analytics for more sophisticatedlow-and-slow attacks that follow a cyber kill chain pattern.
• Integration with threat intelligence. SOC teams want to utilize threat intelligence for activities like alert enrichment,

security investigations, threat hunting, and operationalizing the MITRE ATT&CK framework.

45Source: ESG Complete Survey Results, ESG/ISSA Cybersecurity Process and Technology Survey, June 2022.
Ibid.
© 2022 TechTarget, Inc. All Rights Reserved.

Showcase: What Security Pros Want for Threat Detection and Response

4Figure 2. Top 5 Most Important Attributes for Threat Detection and Response Platforms
Which of the following would you consider the most important attributes of acybersecurity “platform” for threat detection and response? (Percent of respondents,N=280, three responses accepted)
Provides threat prevention, detection, and response
capabilities

43%

Coverage across the entire attack surface (i.e., endpoints,networks, and cloud infrastructure)

42%

Central management and reporting across all products
and services

35%

Security analytics (i.e., collective analysis of product datausing correlation rules, heuristics, machine learningalgorithms, etc.)
Includes integration with threat intelligence for threat
detection and remediation purposes

30%
26%
Source: ESG, a division of TechTarget, Inc.

How Stellar Cyber Aligns with these Requirements
While the threat detection and response solution attributes illustrated in Figure 2 are most important, it’s also worth notingthat SOC teams have no appetite for “ripping and replacing” existing security technologies and starting from scratch. They
want to implement new technologies that unify existing tools, provide incremental benefits for security efficacy andoperational efficiency, and help them achieve the attributes listed above.
What’s needed to build such a SOC solution? An open security operations and analytics platform architecture (SOAPA) that
can integrate existing tools while adding incremental functionality. Stellar Cyber can help here with its Open XDR. Stellar
Cyber aligns well with the threat detection and response priorities described above, as its technology can:
• Protect the attack surface. Stellar Cyber comes with out-of-the-box integrations with market leading EDRs, cloudinfrastructure monitoring, SaaS applications, identity services, and email security products. Working with third-party
tools, Stellar Cyber’s platform can protect the entire attack surface. Stellar Cyber also comes with native NDR fordetecting lateral movement and suspicious/malicious network connections.
• Centralize management and reporting. Stellar Cyber provides central management, enabling SOC teams to conduct

operations tasks through a single console. This can help with analyst training and overall SOC productivity.
• Add advanced analytics models. Stellar Cyber can integrate with data sources, creating a normalized and enriched

data model for AI modeling. Stellar Cyber's AI engine generates contextualized, correlated alerts and outputs forsecurity teams, providing depth and a holistic view for triage, investigations, and remediation decisions.
• Offer response capability. Stellar Cyber integrates with security, IT, and productivity tools to allow security analysts toautomatically or manually address cyber-attacks with immediate actions, such as blocking offenders at the firewall,containing a host, or disabling a user or an account in the same platform.
© 2022 TechTarget, Inc. All Rights Reserved.

Showcase: What Security Pros Want for Threat Detection and Response

5• Integrate with other threat Intelligence technologies. Stellar Cyber’s platform integrates with various threat

intelligence technologies and allows customers to bring their own threat intelligence tools. The threat intelligence iscentrally managed and automatically applied to the telemetry collected to detect known threats.
Stellar Cyber can provide the technology underpinning for SOC modernization with its next-generation SIEM and NDR anda “bring your own EDR” model that adds XDR integration and analytics capabilities on top of leading EDR tools. To workwith existing security and IT technologies, Stellar Cyber interoperates with the market-leading IT and security tools, collects
telemetry, creates analytics models, and generates response actions directly through tools and controls. In aggregate,
Stellar Cyber can unify currently disjointed security tools and data sources to visualize; correlate through AI; andautomatically detect, investigate, and respond to all attack activities—exactly the type of functionality that security
professionals are looking for.

The Bigger Truth
SOC teams need help modernizing security operations in areas like integrating technologies, automating processes, andcreating advanced analytics for threat detection. When security pros reach out to security technology vendors, they hearconflicting messages leading to confusion and project delays.
ESG sought to cut through this confusion by asking security professionals what they need from a threat detection andresponse platform. The results paint a picture of clarity: Security pros need solutions that provide threat prevention,detection and response, coverage across the entire attack surface, and central management/reporting. Furthermore, SOC
teams want platforms that provide incremental value on top of their existing security technology stack.
Stellar Cyber may not be a household name, but it does align well with these requirements. In this way, Stellar Cyber
provides a pragmatic threat detection and response solution rather than more confusion and hyperbole.

All product names, logos, brands, and trademarks are the property of their respective owners. Information contained in this publication has been obtained by sources
TechTarget, Inc. considers to be reliable but is not warranted by TechTarget, Inc. This publication may contain opinions of TechTarget, Inc., which are subject to change. Thispublication may include forecasts, projections, and other predictive statements that represent TechTarget, Inc.’s assumptions and expectations in light of currently available
information. These forecasts are based on industry trends and involve variables and uncertainties. Consequently, TechTarget, Inc. makes no warranty as to the accuracy ofspecific forecasts, projections or predictive statements contained herein.
This publication is copyrighted by TechTarget, Inc. Any reproduction or redistribution of this publication, in whole or in part, whether in hard-copy format, electronically, orotherwise to persons not authorized to receive it, without the express consent of TechTarget, Inc., is in violation of U.S. copyright law and will be subject to an action for civil
damages and, if applicable, criminal prosecution. Should you have any questions, please contact Client Relations at cr@esg-global.com.

Enterprise Strategy Group is an integrated technology analysis, research, and strategy firm that provides
market intelligence, actionable insight, and go-to-market content services to the global IT community.
www.esg-global.com

contact@esg-global.com© 2022 TechTarget, Inc. All Rights Reserved.

508.482.0188