When it comes to cybersecurity, most IT organizations continue to do things right. They spend more than US$100 billion annually to deploy everything from next-generation firewalls to an array of complementary technologies such as endpoint pro-tection, anti-virus software, and intrusion detection systems.1 And yet all this tech-nology does not make them safe from breaches. A recent independent study re-vealed 90% of organizations impacted by a significant security attack were running up-to-date cybersecurity software.
Where do bad actors find gaps in the gauntlet of protections deployed in the typical small to medium-sized enterprise? Part of the weakness in today’s security models stems from an overemphasis on technology. For decades we have played catchup with cybercriminals, responding to the latest threat with a new piece of technology. Security vendors told us that if only we purchased the latest software gizmo or pizza box, we would be safe from increasingly sophisticated attacks.
The first problem with this approach is that it has increased complexity. Driving this complexity is a patchwork of disconnected security products, which results in numerous manual cybersecurity processes as well as a lack of security transparency and centralized controls.