Security information and event management (SIEM) systems remain a key component of security operations centers (SOCs). Security orchestration, automation, and response (SOAR) frameworks, meanwhile, have emerged to fill the gap in these capabilities left by many SIEM systems.

But as many companies have begun reaching the limits of SIEM and SOAR systems over the last few years, they have started turning to other solutions such as extended detection and response (XDR). But does this shift spell the end of SIEM and SOAR? Or is the future one of component-based cooperation?

Here’s what SOAR and SIEM look like in 2023 and what’s on the horizon for enterprise security.

SIEM and SOAR: What’s changed since 2020?

In 2020, a Security Intelligence piece spoke to the increase in fast, flexible and customizable cloud-based SIEM solutions. The piece also highlighted the need for SOAR deployments to help companies automate key operations and respond to emerging threats.

Three years on, the market has evolved. While most SOCs still rely on SIEM tools, IT professionals are painfully aware of their limitations. Much like legacy technologies that may frustrate moves to the cloud, aging SIEM solutions can hamper effective incident response.

The reason is simple. While logging and event management are necessary to understand one’s current security posture, they’re not enough in isolation to address issues as they occur. Combining them with SOAR helps extend their usable life but doesn’t eliminate the main issue. At their core, these tools are reactive, not proactive, meaning their security benefits are finite.

Explore IBM Security QRadar: Request a demo

Current trends in SIEM and SOAR

Despite their limitations, SIEM and SOAR are both seeing significant market growth. It makes sense: While companies recognize the need for new approaches to evolving security threats, SIEM and SOAR solutions have become fundamental aspects of cybersecurity frameworks. In 2022, the SIEM market was worth $5.2 billion and is now on track to reach $8.5 billion in the next five years. SOAR, meanwhile, saw a market value of $1.32 billion last year with a predicted compound annual growth rate of 16.4%.

While the scale of SIEM and SOAR adoption contributes to this increasing valuation, market trends also play a role. Key trends in 2023 include:

Shifting Attack Patterns

Attackers are changing their approach. Informed by the move to remote and hybrid work, malicious actors have shifted both forward and back: Forward, in that they’ve found new ways to exploit third-party and zero-day vulnerabilities. Back, in that they’ve ramped up phishing attack efforts on remote workers because these attacks still work.

In response, SIEM and SOAR tools are both getting back to basics to help companies detect potential phishing efforts, and integrating new threat data to help pinpoint possible points of compromise.

Process Automation

Automation now plays a key role in effective defense. According to a recent IBM survey, 87% of SOC team members say that automation would save some or a lot of time during threat response. But just 55% of teams use automation for threat hunting, and only 53% use automation to improve logic and alerts.

As a result, 2023 comes with an ongoing effort to move SIEM and SOAR solutions into the cloud where scalable resources can better support automation options.

Breathing new life into SIEM

Read a few articles on SIEM, and you’ll find a common theme: Security information and event management is “dead.”

Is it true? Not quite. Is it wrong? Not exactly. Here’s why: SIEM is great at what it does, which is collecting security data and informing IT teams. But what began as regular reports on the state of security have rapidly escalated into what’s known as “alert fatigue” — the sheer number of potential incidents and possible problems tied to desktop, mobile and personal devices has inundated teams with alerts. Despite best efforts, these alerts eventually begin to blend together, and they start to lose meaning. Add in a few false positives, and it’s often easier for teams to ignore repeated warnings.

Consider recent survey data, which found that SOC team members are only getting to half of the alerts they’re supposed to review every day. Even worse? Team members spend one-third of their workday validating incidents that aren’t a real threat. It’s no surprise, then, that alert fatigue is setting in.

The result is a landscape where both SIEM and SOAR are now starting to benefit from artificial intelligence. In both cases, the adoption of AI tools can narrow alert windows and automate security responses so IT staff aren’t inundated with alerts. Instead of getting hundreds of easily addressed alerts each day, teams only get alerts that require responses ASAP. All other issues can be handled by self-service portals for staff encountering login or credential issues or session termination by AI if suspicious behavior is detected.

What’s next for security solutions?

While most companies have no plans to abandon SIEM or SOAR — after all, why fix what’s (mostly) not broken — they recognize the need for solutions that help fill in the gaps.

This is the role of extended detection and response (XDR). A combination of network and endpoint detection and response (NDR and EDR) tools, XDR makes it possible for companies to both identify threats and respond to them in real-time. This is critical in a world driven by hybrid and remote work. The sheer number of endpoints across increasingly complex network environments makes visibility a top priority for organizations but makes achieving this visibility a challenge. XDR targets the behavior of applications and services across complex networks to help companies pinpoint where potential problems exist and take action to remediate these threats.

Now considered the most effective tool for threat hunting, XDR solutions are an expected investment for two-thirds of companies over the next six to 12 months. Much like SOAR and SIEM, however, even XDR tools aren’t a magic bullet for security. Instead, they form part of a connected, holistic approach to cybersecurity that provides the proactive processes currently missing from most enterprise SOCs.

Put simply? In 2023, SOAR and SIEM are part of a larger threat management landscape where companies will shift to proactive models by layering real-time detection and response solutions onto existing security frameworks.

Enhance your security posture with a modern-day SIEM solution that makes threat detection smarter so analysts can remediate faster – all while maintaining your business’s bottom line. Get a hands-on demo of the award-winning IBM Security QRadar SIEM here.

More from Incident Response

X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon

4 min read - Every year, IBM X-Force analysts assess the data collected across all our security disciplines to create the IBM X-Force Threat Intelligence Index, our annual report that plots changes in the cyber threat landscape to reveal trends and help clients proactively put security measures in place. Among the many noteworthy findings in the 2024 edition of the X-Force report, three major trends stand out that we’re advising security professionals and CISOs to observe: A sharp increase in abuse of valid accounts…

What cybersecurity pros can learn from first responders

4 min read - Though they may initially seem very different, there are some compelling similarities between cybersecurity professionals and traditional first responders like police and EMTs. After all, in a world where a cyberattack on critical infrastructure could cause untold damage and harm, cyber responders must be ready for anything. But are they actually prepared? Compared to the readiness of traditional first responders, how do cybersecurity professionals in incident response stand up? Let’s dig deeper into whether the same sense of urgency exists…

X-Force uncovers global NetScaler Gateway credential harvesting campaign

6 min read - This post was made possible through the contributions of Bastien Lardy, Sebastiano Marinaccio and Ruben Castillo. In September of 2023, X-Force uncovered a campaign where attackers were exploiting the vulnerability identified in CVE-2023-3519 to attack unpatched NetScaler Gateways to insert a malicious script into the HTML content of the authentication web page to capture user credentials. The campaign is another example of increased interest from cyber criminals in credentials. The 2023 X-Force cloud threat report found that 67% of cloud-related…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today