The Ponemon Institute’s annual “Cost of Data Breach” study, released this week, served up a clear message: Damages from cyberattacks continue to climb, but organizations can stem these rising costs by preparing and supporting their incident response (IR) team, saving hundreds of thousands of dollars on average.

It’s long been our mission to help organizations transform their IR capabilities, and we’ve done so through our innovative Security Orchestration, Automation, and Response (SOAR) Platform. With our latest platform release, version 26, we’re delighted to launch Resilient Incident Visualization.

Incident Visualization Changes the Game

Resilient Incident Visualization is an industry first. It leverages the simple fact that actually seeing connections between incidents in a way like never before can help security analysts zero in on concerted attacks and respond in record time. It’s a simple yet powerful concept successful in, and now adopted from, other business areas.

Resilient Incident Visualization graphically displays multidimensional relationships between incident artifacts or indicators of compromise (IoCs) and incidents in an organization’s environment. Security analysts can:

  • Instantly gain intelligence, context and direction by seeing the most pertinent connections between artifacts and incidents, both past and present.
  • Immediately uncover broader campaigns targeting the organization and understand how an attack has unfolded over time.
  • Rapidly take investigative or remedial actions from directly within the visualizer, such as querying QRadar or blocking a malicious URL.

Decreasing Costs and Time

With Resilient Incident Visualization, a security analyst can instantly see that artifacts related to a malware incident (e.g., suspicious IP addresses, DNS names, malware hashes, etc.) have appeared in several past incidents. This suggests that these incidents are part of a bigger attack, and the platform provides direction on how to put an end to it.

This latest innovation comes only a few months after Resilient Systems was acquired by IBM Security. It shows that we’re committed to continuously innovating and pushing this market forward to help our customers thrive in the face of today’s cyberthreats. As part of IBM Security, we can innovate faster and more significantly than ever before.

In the end, Resilient Incident Visualization is a step change for incident response — making teams smarter and faster responders.


More from Incident Response

3 recommendations for adopting generative AI for cyber defense

3 min read - In the past eighteen months, generative AI (gen AI) has gone from being the source of jaw-dropping demos to a top strategic priority in nearly every industry. A majority of CEOs report feeling under pressure to invest in gen AI. Product teams are now scrambling to build gen AI into their solutions and services. The EU and US are beginning to put new regulatory frameworks in place to manage AI risks.Amid all this commotion, hackers and other cybercriminals are hardly…

What we can learn from the best collegiate cyber defenders

3 min read - This year marked the 19th season of the National Collegiate Cyber Defense Competition (NCCDC). For those unfamiliar, CCDC is a competition that puts student teams in charge of managing IT for a fictitious company as the network is undergoing a fundamental transformation. This year the challenge involved a common scenario: a merger. Ten finalist teams were tasked with managing IT infrastructure during this migrational period and, as an added bonus, the networks were simultaneously attacked by a group of red…

Why security orchestration, automation and response (SOAR) is fundamental to a security platform

3 min read - Security teams today are facing increased challenges due to the remote and hybrid workforce expansion in the wake of COVID-19. Teams that were already struggling with too many tools and too much data are finding it even more difficult to collaborate and communicate as employees have moved to a virtual security operations center (SOC) model while addressing an increasing number of threats.  Disconnected teams accelerate the need for an open and connected platform approach to security . Adopting this type of…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today