How AI can close gaps in cybersecurity tech stacks
Gaps in cybersecurity tech stacks, especially in endpoint security and patch management, are increasingly leaving enterprises vulnerable to attacks. CISOs are focusing on how to drive new digital revenue strategies while reducing risk and protecting virtual workforces amidst the various threats.
From cybercriminal gangs trying to recruit AI engineers, to state-funded Advanced Persistent Threat (APT) networks capable of simultaneously launching attacks across multiple attack vectors, cybercriminals are getting smarter all the time. Studies of job ads on the dark web show that those who know how to breach web services, have AI-based hacking skills, and can capture privileged access credentials are the most in-demand.
Keeping the balance of power in check with AI
Machine endpoints are proliferating at twice the pace of human ones and new digital revenue strategies enterprises have are expected to deliver double-digit growth in 18 months. Virtual workforces to support new digital revenue growth need new security tools that are intuitive and easy to use. CISOs are balancing these demands with the need for real-time risk management insights and improving user experiences on their applications. Solving these challenges and maintaining a balance of power against threats and risks requires data-driven AI and machine learning technologies that deliver at scale.
AI and machine learning effectively automate tasks IT and cybersecurity departments don’t have time to get to. A few are automated endpoint security, patch management and improving supply chain security, visibility, and control with the industrial internet of things (IIoT). Enterprises proactively employ and prioritize zero-trust security, starting with identity access management (IAM), privileged access management (PAM), micro segmentation and endpoint security, then struggle to keep up with endpoints and patch management.
Using AI and machine learning brings greater intelligence to endpoint and patch management and improves risk-based vulnerability assessments. Cybersecurity providers’ sales partners are also helping to close gaps in tech stacks by providing their expertise and insights.
Closing tech stack gaps
There are five strategies cybersecurity vendors should rely on to help their enterprise customers close widening gaps in their security tech stacks. Based on conversations with endpoint security, IAM, PAM, patch management and remote browser isolation (RBI) providers and their partners, these strategies are beginning to emerge in a dominate way among the cybersecurity landscape.
Fast-tracking endpoint, ransomware, and risk management roadmaps
Cybersecurity vendors are accelerating their launch plans in three core areas today. Endpoint security is still one of the most elusive problems for a security team to fix and it’s typical for organizations not to know where up to 40% of their endpoints are. Broadcom, CrowdStrike, McAfee and Microsoft lead the endpoint security market, and each has implied in earnings and briefings that they are accelerating their roadmaps.
An analysis of Ivanti’s roadmap reflects how vendors are moving applications up and creating larger releases faster. Ivanti released five modules on its Neurons platform, a significant accomplishment for its DevOps, engineering, and product management teams. Ivanti that Ivanti Neurons Patch for MEM (Microsoft Endpoint Manager) is highly demanded by enterprises who want to automate patch management and extend Intune implementations to include third-party application update capabilities.
Land & expand selling of zero trust with partners is a high priority.
Cybersecurity vendors that one of the primary factors accelerating their roadmaps is reseller and partners’ demand for new cloud services to support high margin sales. On the last earnings call, George Kurtz, president, CEO, and cofounder of CrowdStrike said that channel sales are core to the company.
Further validating its high priority to rely on partners to land, expand and provide zero trust solutions through the channel, Ivanti announced Dennis Kozak had joined them today as Chief Operating Officer (COO). Dennis will oversee Ivanti marketing, global sales, customer experience and operations as COO. Mr. Kozak is a long-time channel veteran, having spent 23 years with CA Technologies, where he led organizations such as global sales, global channel sales and strategy, sales operations, and global transformation to deliver a next-generation portfolio strategy. He was most recently head of global channels at Avaya, which drove approximately 70% of their total revenue.
Mr. Kozak during an interview that his goals include turning channel sales into a force multiplier of growth for Ivanti by capitalizing on the five acquisitions made over the past 16 months. Additionally, Mr. Kozak explained in an interview with that bringing together all acquisitions into a unified go-to-market and channel strategy is the goal.
Quantifying risk is table stakes
Enterprises need better tools to assess risks and vulnerabilities to identify and close gaps in tech stacks. As a result, there’s a growing interest in using Risk-Based Vulnerability Management (RBVM) that can scale across cloud, mobile IoT and IIoT devices today. Endpoint Detection & Response (EDR) vendors are moving into RBVM with vulnerability assessment tools. Leading vendors include CODA Footprint, CyCognito, Recorded Future, Qualys and others. Ivanti’s acquisition of RiskSense delivered its first product this month, Ivanti Neurons for Risk-Based Vulnerability Management (RBVM). What’s noteworthy about Ivanti’s release is that it is the first RBVM system that relies on a state engine to measure, prioritize, and control cybersecurity risks to protect enterprises against ransomware and advanced cyber threats. Ivanti also developed proprietary Vulnerability Risk Ratings (VRR) that quantify adversarial risk so enterprises can identify and thwart risks before breaches occur.
Doubling down on endpoint security as a core product strategy
Fast-tracking endpoint security applications and platforms are also helping to close the gaps in tech stacks today. All leading cybersecurity vendors either have announced or will shortly announce self-healing endpoints. A recent Tanium survey found that only 29% of security teams are confident the patches they’re installing will stop a breach. Absolute’s 2021 Endpoint Risk Report found 12.9 mission-critical applications per enterprise device, 11.7 of which are security controls. Absolute’s report found that the greater the endpoint complexity, the greater the risk of applications conflicting, colliding, and canceling, leaving endpoints less secure.
Ivanti’s recent survey on patch management found that 71% of IT and security professionals found patching to be overly complex and time-consuming and 53% said that organizing and prioritizing critical vulnerabilities takes up most of their time. Ivanti’s launch last week of their Neurons Patch for MEM reflects the future of AI-based patch intelligence for endpoint security by relying on AI-based bots to identify which patches most need updating. Additional vendors providing AI-based endpoint protection include Broadcom, CrowdStrike, SentinelOne, McAfee, Sophos, Trend Micro, VMWare Carbon Black, Cybereason, etc.
Digital experiences need to drive greater productivity
Improving how intuitive any security application is to use increases productivity and reduces risks. Enterprise applications are known for being a challenge to use, however. Apple, known for its intuitive designs, relies on metrics and analytics combined with design principles to streamline each new application and system. No standard comes close to Apple’s success in this area in enterprise software.
It’s encouraging to see cybersecurity vendors take on the challenge of using AI to improve user experience. Ivanti launched their Digital Experience Score within Ivanti Neurons Workspace last week. CIOs’ most common request from users is to improve application usability to drive greater security productivity and operational agility. Ivanti’s Digital Experience Score provides a 360-degree view and real-time insights into the devices, operating systems, networks, and applications employees rely on in their virtual workspace.
Ivanti claims it gets organizations out of using ticket counts as a proxy for employee experience, as closing tickets alone is not the service-level agreement (SLA) that needs to be measured; rather, organizations need to quantify how effective IT and digital experiences (XLAs) are and seek new ways to improve them. Machine Learning algorithms to produce a combined metric of holistic the users’ digital experience.
Quantifying risks
The severity, speed, and sophistication of cyberattacks are increasing quickly. CIOs and CISOs know they need to rely on more advanced technologies, including AI and machine learning, to keep on top of split-second attacks that can take down their networks. With cybercrime gangs recruiting AI engineers out of school and state-sponsored cyberattacks becoming more common, AI and machine learning’s potential to thwart breach attempts and sophisticated attacks is becoming more proven.
Cybersecurity vendors accelerate their product roadmaps with hardened, more data-driven applications, while AI platform players are looking to land and expand in partner strategies. Quantifying risks is now table stakes and every cybersecurity vendor in the endpoint security or adjacent markets is introducing self-healing endpoints. Cybersecurity tech stacks need AI to identify how best to thwart advanced attacks today and in the future.
