Insight

  • Research Objectives

    • Assess how organizations approach security hygiene and posture management today.
    • Understand coverage gaps, why these gaps exist, and whether these gaps lead to security incidents.
    • Evaluate how organizations test the efficacy of their security controls and what this testing accomplishes.
    • Highlight what cybersecurity professionals believe their organizations should do to improve security hygiene and posture management.
    • (more…)
  • Cloud Data Protection Strategies at a Crossroads

    Research Objectives

    • Assess the state of cloud-based data protection and the as-a-service market (i.e., in cloud/to the cloud, BaaS, and DRaaS).
    • Explore end-user challenges and highlight requirements.
    • Establish the role of key decision makers and personas in the buying cycle.
    • Assess the use and impact of cloud technologies for data protection. (more…)
  • Research Objectives

    As more workers collaborate virtually, many organizations now depend on additional digital communication tools beyond email. New collaboration tools provide attackers the opportunity to engage with humans to evade automated controls, extending phishing, BEC, credential theft, and other socially engineered attacks beyond email. Advanced attacks leverage multiple attack vectors, requiring individual, core security controls to work together to detect and prevent advanced attacks. This extends beyond traditional security operations tools (e.g., SIEM, SOAR, EDR, and XDR) to core network, cloud, endpoint, and identity controls.

    As IT and security teams focus on risk-driven security strategies, consistency of policies and priorities across all enterprise communication channels becomes critical to strengthening security posture. More education is needed to motivate security architects to embrace this higher-level perspective. To gain further insight into these trends, TechTarget’s Enterprise Strategy Group (ESG) surveyed 490 IT and cybersecurity professionals at organizations in North America (US and Canada) and Western Europe (UK, France, and Germany) involved with securing enterprise communication and collaboration technology and processes.

    In terms of the risk and security of the many electronic communication and collaboration tools in use, this study sought to answer:

    • What types of communication and collaboration tools have organizations formally sanctioned for their employees’ use?
    • Approximately how many disparate communication and collaboration tools, including email, have organizations formally sanctioned for use?
    • Do organizations formally plan to consolidate one or more communication and collaboration tools into a common platform over the next 12 months? What is the primary driver for this consolidation of communication and collaboration tools?
    • How frequently do organizations estimate they face socially engineered attacks involving multiple electronic communication mechanisms, including email, messaging, mobile, and social media? Which communication and collaboration mechanisms do organizations believe are most vulnerable to threat actors?
    • How concerned are organizations that attacks will leverage, or have already leveraged, communication and collaboration tools (both sanctioned and unsanctioned) to evade security controls?
    • What types of threats that leverage communication and collaboration mechanisms (i.e., email, messaging, social media, etc.) are organizations most concerned about? What threats do organizations believe have penetrated their current communication and collaboration security controls in the past 12 months?
    • How much of a priority is securing the many communication and collaboration mechanisms for organizations beyond their primary email solution? How do organizations expect their spending for communication and collaboration security controls to change over the next 12 months?
    • How confident are organizations in the native security capabilities included in each of the formally sanctioned communication and collaboration tools they currently use?
    • Do organizations have a formal security end-user training program that informs employees about securing sensitive information policies?

    Survey participants represented a wide range of industries including manufacturing, technology, financial services, and retail/wholesale. For more details, please see the Research Methodology and Respondent Demographics sections of this report.

    (more…)

  • The Strategic and Evolving Role of Data Governance

    Research Objectives

    For organizations well along on the path of their digital transformation journey, sound data governance practices are playing a strategic role. As the amount of data and value of that data to the business continue to increase, so too does the importance of managing its availability, usability, integrity, and security. Data governance is a loosely applied term in the data management space. As ecosystems evolve and become more distributed, end-users are struggling to connect the dots between the important elements of data governance like data classification, data indexing, data placement, e-discovery, and compliance.

    In order to understand the benefits and challenges of data governance initiatives, establish the current state of deployments, identify gaps, and highlight future expectations, TechTarget’s Enterprise Strategy Group (ESG) surveyed 376 IT and business decision makers currently responsible for the governance technologies, processes, and programs used to manage their organizations’ data.

    This study sought to answer the following questions:

    • What is the approximate total volume of data organizations have stored on their corporate servers and storage systems? What is the approximate volume of unstructured data?
    • At approximately what rate do organizations believe their total volume of data is growing annually? What technology features/capabilities do organizations use to manage overall data growth?
    • What percentage of organizations’ total data contains personally identifiable information (PII) or other sensitive data?
    • In terms of data repositories, how distributed is the total volume of data for the average organization? How does this change, if at all, for PII and other sensitive information?
    • For approximately how long have organizations had their data governance practices in place?
    • How have stakeholder roles and levels of corporate involvement for organizations’ data governance initiatives evolved over the last two years?
    • Have organizations implemented or considered implementing a data governance team?
    • What are the areas of greatest concern for organizations when it comes to potential non-compliance with data governance managed regulations?
    • What is the biggest challenge for organizations when it comes to implementing and managing data governance initiatives?
    • Generally speaking, how has the use of public cloud services impacted organizations’ abilities to manage and execute data governance programs, processes, and procedures? Specifically, what SaaS application types present the biggest challenges to organizations in terms of implementing or extending data governance practices?
    • Do organizations currently leverage any data classification tools or processes? For those that do, is data indexing and classification done at the metadata or content level?
    • What are the most significant business drivers underlying organizations’ data governance programs?
    • Have organizations experienced a cybersecurity incident that impacted their ability to meet/adhere to data governance requirements in the last 12 months?

    Survey participants represented a wide range of industries including manufacturing, technology, financial services, and retail/wholesale. For more details, please see the Research Methodology and Respondent Demographics sections of this report.

    (more…)

  • Security hygiene and posture management has become increasingly difficult because of factors like a growing attack surface, the increased use of cloud computing, and the need to support a remote workforce. These factors can create security vulnerabilities that lead directly to cyber-attacks. Unfortunately, this pattern will likely persist as most organizations continue to approach security hygiene and posture management with point tools, spreadsheets, and manual processes.

    Learn more about these trends with the infographic, Security Hygiene and Posture Management Remains Decentralized and Complex.

  • IT organizations are increasingly turning to a “cloud-first” strategy for their digital transformation initiatives to overcome challenges related to maintaining operations in a fast-paced business landscape. This approach involves prioritizing cloud-based, developer-friendly solutions over traditional on-premises software and infrastructure to increase agility.

    Learn more about these trends with the infographic, Distributed Cloud Series: The Mainstreaming of Cloud-native Apps and Methodologies.

  • Nile Secures Series C Funding– Pulls in $175M

    Nile has been out of stealth mode for almost a year now and has been steadily making progress delivering new capabilities, forming partnerships, and acquiring new customers. This $175 Million Series C funding was led by March Capital and Sanabil investments and a number of other strategic and contributing investors. Nile Raises $175M Series C Funding to Propel Its Vision to Redefine Enterprise Networks – Nile (nilesecure.com) An impressive round in an uncertain economy for sure.

    Nile’s goal is to deliver next-generation network as a service (NaaS) solutions to its initial target market of k-12 and higher education markets, followed by enterprise customers. Nile delivers wired and wireless campus solutions via a cloud-based management approach that enables organizations to consume an inherently secure wired and wireless campus network entirely as a consumption-based service that includes initial assessment, design, deployment, and streamlined operations of the network.

    Back in June, it announced a partnership with Palo Alto Networks to provide integrated security solutions and secure SD-WAN. The two companies have worked together to leverage APIs to integrate network data to provide enhanced zero trust (network, access, and isolation) solutions for their joint customers. Working with a global leader in security like Palo Alto Networks makes sense and its AI-powered and cloud driven approach is a good fit for highly distributed, modern network environments.

    Having an initial focus on campus networks is a good choice for a startup like Nile as Wi-Fi technology evolves quickly (Wi-Fi 7 Consumer APs are already out) and high turnover rates (as compared to DC switches) provide an opportunity for Nile to gain traction quickly. Also, organizations are under pressure to re-imagine the campus — for the education market, it is about supporting more devices and ensuring secure and seamless experiences when coming back to campus. For the enterprise, the campus network needs to securely support the return to the office and accommodate bandwidth-intensive collaboration applications via Wi-Fi.

    For virtually all markets, Wi-Fi connectivity is viewed as a utility, in the same way older generations simply expected to pick up a phone and get a dial tone (I know, I am showing my age). Nile understands that concept and has developed a solution that removes the complexity from assessing and designing a new solution and accelerates the deployment of new, secure campus wired and wireless technology. With its partnership with Palo Alto Networks, it provides enhanced security and includes secure SD-WAN as well.

    Another notable aspect of Nile is who its founders are — namely Pankaj Patel and John Chambers. Many of you may remember John’s other successful startup — no, not Cisco, but Pensando — the company that set out to democratize smart NICs and distributed services for both enterprise and hyperscaler markets. Pensando is now part of AMD (April 2022 acquisition).

    Nile came out of stealth with significant go-to-market channels already in place and has spent the last year acquiring customers and deploying solutions with streamlined operations that enable organizations to spend time working on strategic business initiatives and not responding to problems with their Wi-Fi networks. This latest round of funding will give them the opportunity to invest in additional resources to ramp up their go-to-market and deliver more tightly integrated solutions with partners like Palo Alto Networks.

    Given the recent funding, next-gen technology, and veteran management team, it’s hard to bet against Nile. However, it should be noted that they do have formidable competition — not only from the established networking leader Cisco, but also from rising challengers, such as Arista, Extreme Networks, HPE Aruba Networking, and Juniper Networks (alphabetical order), that continue to innovate and grow.

    Ultimately, this competition will drive innovation and Nile joining the field will only help to create a rising tide that will ultimately benefit all markets and enterprises with more secure, robust, and intelligent network environments. Nile has made a lot of progress in the last 12 months, and I am looking forward to seeing what the next 12 months bring.

  • Data management teams require new capabilities to effectively harness and extract value from expansive volumes of data culled from a growing number of sources. The goal is to reach a maturity level where insights are delivered in real time to keep pace with the operational needs of the business, innovate faster, and build competitive advantages.

    Learn more about these trends with the infographic, Data Platforms: The Path to Achieving Data-driven Empowerment.

  • As the amount of data stored in the cloud continues to increase, so too do the challenges of securing that data from malicious attackers. According to research from TechTarget’s Enterprise Strategy Group, organizations are more confident in their ability to secure on-premises data than data saved in the cloud. Indeed, 54% of organizations surveyed considered their on-premises data security strategies to be more effective than their public cloud infrastructure and application data security.

    Read my blog to get more insights on how organizations are deploying cloud-native tools from CSPs and third-party tools from MSPs to achieve a defense-in-depth strategy and better secure cloud-resident data.

  • Research Objectives

    In today’s fast-paced business landscape, organizations must be sufficiently agile and flexible to meet the evolving needs of their customers. However, many still rely on legacy applications that can struggle to handle the demands of modern-day business requirements. This can create significant challenges for IT departments that are tasked with maintaining business operations while transitioning to more modern approaches that drive their organizations forward. To overcome these challenges, organizations are increasingly turning to a “cloud-first” strategy for their digital transformation initiatives. This approach involves prioritizing cloud-based, developer-friendly solutions over traditional on-premises software and infrastructure, allowing organizations to leverage the scalability, flexibility, and cost-effectiveness of cloud computing to improve their operations, increase agility, and meet the needs of their customers more effectively.

    To assess the landscape for cloud-native applications and methodologies, Enterprise Strategy Group surveyed 378 IT and DevOps/AppDev professionals in North America (US and Canada) responsible for evaluating, purchasing, building, and managing application infrastructure in their organization. This study sought to answer the following:

    • What percentage of production applications are currently based on a microservices cloud architecture today?
    • Where are organizations deploying (or planning to deploy) cloud-native applications?
    • What are the biggest challenges with cloud-native applications?
    • How are microservices improving processes across the organization? What are the most impactful benefits?
    • What are the biggest challenges or concerns with applications based on a microservices architecture?
    • How many containers are supported within today’s environments? What is the preference for orchestration?
    • What approaches are organizations employing to manage multi-cluster and multi-namespace deployments?
    • What is driving the use of serverless functions?
    • What types of tools and technologies are used to build and deliver cloud-native applications?
    • What is the adoption status of infrastructure-as-code (IaC) templates?
    • How do organizations distribute their development team’s time across tasks?
    • How extensively are organizations using DevOps methodologies?
    • What is the maturity level of organizations’ continuous integration and continuous delivery (CI/CD) initiatives?
    • How extensively are organizations using GitOps approaches to automate application builds?
    • How often do organizations typically deploy new code to production environments?
    • What individuals or groups have the most influence on decisions around cloud-native applications?
    • What are organizations’ perceptions around the effectiveness of their development teams?
    • How confident are organizations in their development team’s ability to ship secure code at an efficient pace?
    • How will spending on cloud-native technologies, services, and personnel change over the next 12-18 months?
    • What actions will organizations take to optimize their cloud-native application development strategies?

    Survey participants represented a wide range of industries, including manufacturing, technology, financial services, and retail/wholesale. For more details, please see the Research Methodology and Respondent Demographics sections of this report.

    Already an Enterprise Strategy Group client? Log in to read the full report.
    If you are not yet a Subscription Client but would like to learn more about accessing this report, please contact us.
  • Research Objectives

    Security hygiene and posture management has become increasingly difficult because of factors like a growing attack surface, the increased use of cloud computing, and the need to support a remote workforce. These factors can create security vulnerabilities that lead directly to cyber-attacks. Indeed, a majority of organizations have experienced at least one cyber-incident due to the exploitation of an unknown, unmanaged, or poorly managed internet-facing asset. Unfortunately, this pattern will likely persist as most organizations continue to approach security hygiene and posture management with point tools, spreadsheets, and manual processes. Organizations are prioritizing spending on security hygiene and posture management, focusing on areas like continuous security testing, process automation, and increasing staff. Security professionals also aspire to consolidate disparate point tools into a security observability, prioritization, and validation (SOPV) architecture to gain a holistic perspective across all aspects of security hygiene and posture management.

    To gain further insight into these trends, TechTarget’s Enterprise Strategy Group (ESG) surveyed 383 IT and cybersecurity professionals at organizations in North America (US and Canada) responsible for evaluating, purchasing, and utilizing products and services for security hygiene and posture management, including vulnerability management, asset management, attack surface management, and security testing tools, among others.

    This study sought to answer the following questions:

    • What are the biggest drivers for organizations’ security hygiene and posture management strategies and programs?
    • What groups are responsible for defining policies for security hygiene and posture management?
    • Have organizations automated security hygiene and posture management activities? If so, which ones have been automated?
    • Why do organizations perform external attack surface discovery?
    • What do organizations believe are the primary reasons for the increase in their attack surface over the past two years? What actions have they taken to reduce the attack surface?
    • Have organizations experienced some type of cyber-attack in which the attack itself started through an exploit of an unknown, unmanaged, or poorly managed internet-facing asset?
    • How often do organizations conduct comprehensive security asset inventory assessments?
    • What types of databases/systems/tools are currently in use as part of organizations’ IT asset inventory process(es)?
    • For which assets do organizations have the most difficulty maintaining a timely and accurate inventory?
    • What are the biggest challenges associated with vulnerability management? How do organizations determine which vulnerabilities to prioritize and patch?
    • What are the primary reasons organizations conduct penetration tests/red teaming exercises? What actions do they believe would most improve their penetration testing/red teaming program(s)?
    • How do organizations expect their plans for spending on security hygiene and posture management to change over the next 12 to 18 months?

    Survey participants represented a wide range of industries including manufacturing, technology, financial services, and retail/wholesale. For more details, please see the Research Methodology and Respondent Demographics sections of this report.

    (more…)

  • How to Get the Most out of Your MDR Journey

    As part of a recent study by TechTarget’s Enterprise Strategy Group, cybersecurity professionals were asked about the processes, tools, and overall assistance they need from managed detection and response (MDR) providers to help their security teams gain control and ensure future security program success. The research revealed that organizations do view MDR as a path to accelerate program development and fill gaps—and, as trust is established, this kind of relationship often grows considerably over time.

    (more…)