Speed is of the essence in digital defense. As the latest Ponemon Institute Cost of a Data Breach Report makes clear, businesses and agencies that are able to respond to and contain an incident rapidly will save millions over their slower peers. The average total cost of a data breach increased by nearly 10%, the largest increase in nearly a decade. However, groups able to identify and contain a breach in less than 200 days saved an average of $1.26 million compared to those that needed more time. So, the right thing to do is put more cybersecurity solutions in place, right?

Not always. There are many tools that speed up breach response times, such as artificial intelligence (AI) and security automation. But these are challenging to implement. Groups with AI and automated security solutions saved 80% in total breach costs over those that did not. The use of such advanced tools is strongly connected with faster time-to-identify and time-to-contain. However, making the architecture more complex can make analysts’ jobs more difficult, too.

Recent research reveals this exact paradox. According to the 2020 Cyber Resilient Organization Report, security operations programs with fewer than 50 different solutions perform better than SecOps programs running more tools. In fact, those using fewer solutions are 9% faster to detect threats, and 7% better at responding to incidents. Past a certain point, adding more tech to the stack does increase network telemetry coverage and visibility. But it actually decreases operational effectiveness.

Shortening the On-Ramp for New Cybersecurity Solutions

How can we get past this dilemma and begin taking full advantage of the value of the new tech that we adopt? In the end, security leaders and vendors alike must work together to support data sharing, product interoperability and an open ecosystem. In the long run, this will support greater speed and responsiveness.

The slow-moving gears of procurement, deployment and internal bureaucracy can pose the largest threat to good posture. Every program must be able to respond nimbly to changes in threat actors’ skills and strategies.

Scaling Up

To do so, it’s key that we find vendors and partners that can help scale up defenses. That will help them keep pace with the demands of the growing business and evolving threat landscape. This means speeding up the process of implementing, customizing and tuning new tools and cybersecurity solutions as much as possible. That’s the case even if all those solutions aren’t from the same vendors. It means keeping the number of lines of code that SecOps workers are asked to write down to a bare minimum. And, most of all, it means ensuring that tools can work together quickly and seamlessly. At best, they should do so right out of the box, or on day one of their deployment.

The need for tool sets that work together smoothly is strong and pressing. Numerous vendors have responded by building architectures of their own. Another popular method is pushing the “single vendor” approach as a means of solving the management and interoperability challenges that different tool sets create. This approach has numerous shortcomings, including preventing people from employing a “best of breed” approach. That can cause them to miss out on the most innovative, advanced or efficient solutions. It can also prevent them from getting the most out of the investments they’ve already made. In the end, it isn’t practical, which is why most enterprise security programs continue to rely on a multi-vendor solution mix.

The Best Path Forward: An Open Approach


The approach championed by the Open Cybersecurity Alliance (OCA) and other open source advocates has numerous benefits for developers, workers and vendors alike. With robust data integrations and open APIs, vendors can get the most out of their real-time threat data. SecOps teams can share insights and findings among themselves. They can deploy analytics, orchestrated response tools and AI-powered assistants for incident investigation and case-building. And that’s without taking time away from higher value work, such as threat hunting, to build complex custom integrations.

Focused on enabling data interchange within the security event lifecycle, the people who make up OCA are creating standards and protocols that enable tools to seamlessly work together. It’s hoped that these standards will evolve into an industry-wide norm. That, in turn, might reduce the amount of time, effort and money companies will need to invest in building and maintaining integrations. This will make it so that even the most disparate tech and products can work together.

How Do Open Standards Help?

With open standards in place across cybersecurity solutions, workers will be able to:

  • Share information, analytics and orchestrated response patterns among team members and between tools
  • Gain enhanced visibility into the environment as a whole
  • Maximize the value of existing products and solutions, while reducing the need for new ones
  • Free themselves from vendor lock-in.

In turn, cybersecurity solutions vendors can:

  • Make their products more appealing to a wider customer base
  • Showcase the value of their internal engineering expertise
  • Provide their customers with greater value – and demonstrate this value consistently
  • Take advantage of when their solutions are reusable.

The Future of Cybersecurity Solutions

Numerous global vendors have joined OCA or voiced their support for this mission. In turn, their partnerships in support of interoperability are already speeding up data sharing and reducing integration costs. Cybersecurity workers and service providers are taking advantage of custom scripting or APIs to serve as the ‘glue’ that holds multi-vendor security architectures together. In addition, private enterprises like Netflix are getting into the game by releasing custom integration engines as open source projects.

Security teams have long wished that they could integrate new and advanced solutions into their environments quickly and with little effort. With greater emphasis on open standards and broad support for their adoption across private industry, government agencies, nonprofits and individual workers, OCA’s future looks bright. This brings new promise to the ongoing quest to reduce complexity in cybersecurity solutions.

More from Incident Response

5 Golden Rules of Threat Hunting

When a breach is uncovered, the operational cadence includes threat detection, quarantine and termination. While all stages can occur within the first hour of discovery, in some cases, that's already too late.Security operations center (SOC) teams monitor and hunt new threats continuously. To ward off the most advanced threats, security teams proactively hunt for ones that evade the dashboards of their security solutions.However, advanced threat actors have learned to blend in with their target's environment, remaining unnoticed for prolonged periods. Based…

Everyone Wants to Build a Cyber Range: Should You?

In the last few years, IBM X-Force has seen an unprecedented increase in requests to build cyber ranges. By cyber ranges, we mean facilities or online spaces that enable team training and exercises of cyberattack responses. Companies understand the need to drill their plans based on real-world conditions and using real tools, attacks and procedures. What’s driving this increased demand? The increase in remote and hybrid work models emerging from the COVID-19 pandemic has elevated the priority to collaborate and…

People, Process and Technology: The Incident Response Trifecta

Let's say you are the CISO or IT security lead of your organization, and your incident response program needs an uplift. After making a compelling business case to management for investment, your budget has been approved and expanded. With your newfound wealth, you focus on acquiring technology that will improve your monitoring, detection and analysis of data traffic. Has the incident program really improved by the technology acquisition, or is the uplift merely cosmetic? If no other changes have been…

Self-Checkout This Discord C2

This post was made possible through the contributions of James Kainth, Joseph Lozowski, and Philip Pedersen. In November 2022, during an incident investigation involving a self-checkout point-of-sale (POS) system in Europe, IBM Security X-Force identified a novel technique employed by an attacker to introduce a command and control (C2) channel built upon Discord channel messages. Discord is a chat, voice, and video service enabling users to join and create communities associated with their interests. While Discord and its related software…