Insight

Research Objectives

The potential for serious business disruptions makes detecting threats quickly and accurately critical to preventing data loss, compliance violations, and lost revenue. Even as resources and users leave the traditional perimeter, the network should play a key role in detecting threats to avoid business disruption. Specifically, network-based tools provide consistent, comprehensive visibility across distributed, heterogeneous environments and remain outside the scope of attacker manipulation. Yet the number of threat detection and response tools that are available can leave users unsure of where to prioritize.

In order to gain insight into these trends, Enterprise Strategy Group surveyed 376 IT, cybersecurity, and networking professionals responsible for evaluating, purchasing, and managing network security products and services for their organizations.

This study sought to answer the following questions:

• What challenges do organizations face with threat detection and response today?
• In which part of the MITRE ATT&CK framework do organizations have the most difficulty detecting and stopping threats?
• Have organizations ever fallen victim to an attack that used encrypted traffic to avoid detection? How did the attack use encryption?
• What technologies do organizations believe are most effective for threat detection and response?
• What are the primary reasons organizations use, or plan to use, network detection and response tools? How do organizations use or plan to use NDR for threat detection?
• What specific use cases do, or will, organizations support through their use of NDR tools?
• What attributes are most important to organizations in an NDR solution?
• What benefits have organizations realized as a result of using NDR?
• How do organizations weigh, or expect to weigh, artificial intelligence when selecting an NDR tool? For what reasons would organizations leverage artificial intelligence/machine learning capabilities with their NDR solutions?
• What plans do organizations have to use XDR technology? How do organizations expect to consume NDR as part of their XDR strategy?
• How do organizations expect their spending on network detection and response technologies, services, and personnel to change over the next 12 to 18 months?
• Survey participants represented a wide range of industries including manufacturing, technology, financial services, and retail/wholesale. For more details, please see the Research Methodology and Respondent Demographics sections of this report.

Already an Enterprise Strategy Group client? Log in to read the full report.

If you are not yet a Subscription Client but would like to learn more about accessing this report, please contact us.

Research Objectives

The use of managed detection and response services has become a mainstream strategy in modern security programs. But IT organizations shouldn’t be fooled by the name: MDR providers are delivering much more than basic detection and response, helping IT and security leaders accelerate program development and improve security posture. With no end in sight for the cybersecurity skills shortage, MDR services can bring immediate expert resources online, together with proven, best-of-breed processes and tools that can help security teams gain control and set themselves up for future security program success.

In order to understand these trends, as well as assess the general state of managed detection and response service offerings, Enterprise Strategy Group surveyed 373 cybersecurity professionals personally involved with cybersecurity technology, including products, services, and processes.

Already an Enterprise Strategy Group client? Log in to read the full report.

If you are not yet a Subscription Client but would like to learn more about accessing this report, please contact us.

Research Objectives

Cyber-threat intelligence (CTI) is analyzed information about cyber-threats that helps inform security decision making. Although security professionals recognize the value of cyber-threat intelligence, many organizations still consume it on a superficial basis. Rather than collect, process, analyze, and disseminate cyber-threat intelligence to internal stakeholders, they simply look to cyber-threat intelligence for indicators of compromise (IoCs) like malicious IP addresses, web domains, and files that could be blocked by firewalls, email gateways, and endpoint security tools. Unfortunately, an IoC-based approach to CTI is extremely limited as adversaries can easily change IoCs, thus circumventing security controls, signatures, and blocking rules. Recognizing these limitations, most organizations have established CTI teams to gain a better understanding of the cyber-threats, adversaries, and attacks with the potential to disrupt business operations or steal sensitive data. This is the right decision, but establishing a productive CTI program isn’t easy. CTI program success depends upon a lifecycle approach spanning five phases:

1.      Planning and direction.

2.      CTI collection.

3.      Processing.

4.      Analysis and production.

5.      Dissemination and feedback.

Mature CTI programs formalize this lifecycle approach, gain a thorough understanding of adversary behavior, and respond with appropriate countermeasures. Immature CTI programs are fraught with waste, overhead, and constant questioning of program results and value. Are organizations establishing mature CTI programs? What are the key success factors? In order to gain insights into these trends, TechTarget’s Enterprise Strategy Group surveyed 380 cybersecurity professionals at organizations in North America (US and Canada) with knowledge of and participation in their organization’s CTI programs.

(more…)