Research | Our Q3 report details what's new in the world of ransomware.
Reduce Alert Noise and False Positives
Boost your team's productivity by cutting down alert noise and false positives.
Automate Security Operations
Boost efficiency, reduce burnout, and better manage risk through automation.
Dark Web Monitoring
Online protection tuned to the need of your business.
Maximize Existing Security Investments
Improve efficiencies from existing investments in security tools.
Move your security operations beyond the limitations of MDR.
Secure with Microsoft 365 E5
Boost the power of Microsoft 365 E5 security.
Secure Multi-Cloud Environments
Improve cloud security and overcome complexity across multi-cloud environments.
Secure Mergers and Acquisitions
Control cyber risk for business acquisitions and dispersed business units.
Solve security operations challenges affecting critical operational technology (OT) infrastructure.
Force-Multiply Your Security Operations
Whether you’re just starting your security journey, need to up your game, or you’re not happy with an existing service, we can help you to achieve your security goals.
Detection Investigation Response
Modernize Detection, Investigation, Response with a Security Operations Platform.
Locate and eliminate lurking threats with ReliaQuest GreyMatter
Find cyber threats that have evaded your defenses.
Security metrics to manage and improve security operations.
Breach and Attack Simulation
GreyMatter Verify is ReliaQuest’s automated breach and attack simulation capability.
Digital Risk Protection
Continuous monitoring of open, deep, and dark web sources to identify threats.
GreyMatter Phishing Analyzer removes the abuse mailbox management by automating the DIR process for you.
The GreyMatter cloud-native Open XDR platform integrates with a fast-growing number of market-leading technologies.
Unify and Optimize Your Security Operations
ReliaQuest GreyMatter is a security operations platform built on an open XDR architecture and designed to help security teams increase visibility, reduce complexity, and manage risk across their security tools, including on-premises, clouds, networks, and endpoints.
Brands of the world trust ReliaQuest to achieve their security goals.
Learn how to achieve your security outcomes faster with ReliaQuest GreyMatter.
The latest security trends and perspectives to help inform your security operations.
Industry Guides and Reports
The latest security research and industry reports.
Catch up on the latest cybersecurity podcasts, and mindset moments from our very own mental performance coaches.
A deep dive on how ReliaQuest GreyMatter addresses security challenges.
The latest threat research report from ReliaQuest Threat Research research team.
The latest white papers focused on security operations strategy, technology & insight.
Current and future SOC trends presented by our security experts.
Events & Webinars
Explore all upcoming company events, in-person and on-demand webinars
From prevention techniques to emerging security trends, our comprehensive library can arm you with the tools you need to improve your security posture.
Get the latest threat analysis from the ReliaQuest Threat Research Team. ReliaQuest ShadowTalk Weekly podcast featuring discussions on the latest cybersecurity news and threat research.
ReliaQuest's ShadowTalk is a weekly podcast featuring discussions on the latest cybersecurity news and threat research. ShadowTalk's hosts come from threat intelligence, threat hunting, security research, and leadership backgrounds providing practical perspectives on the week's top cybersecurity stories.
November 30, 2023
We bring our best attitude, energy and effort to everything we do, every day, to make security possible.
Security is a team sport.
No Show Dogs Podcast
Mental Performance Coaches Derin McMains and Dr. Nicole Detling interview world-class performers across multiple industries.
Make It Possible
Make It Possible reflects our focus on bringing cybersecurity awareness to our communities and enabling the next generation of cybersecurity professionals.
Join our world-class team.
Press and Media Coverage
ReliaQuest newsroom covering the latest press release and media coverage.
Become a Channel Partner
When you partner with ReliaQuest, you help deliver world-class cybersecurity solutions.
How can we help you?
A Mindset Like No Other in the Industry
Many companies tout their cultures; at ReliaQuest, we share a mindset. We focus on four values every day to make security possible: being accountable, helpful, adaptable, and focused. These values drive development of our platform, relationships with our customers and partners, and further the ReliaQuest promise of security confidence across our customers and our own teams.
Take one look at the headlines, and it becomes evident that the current threat landscape demands swift and decisive action across security operations. With adversaries constantly evolving and accelerating their attacks, the dynamic nature of today’s threat landscape presents a critical challenge for both CISOs and their organizations. Agility, achieved through the judicious use of automation, can help to minimize risks and free up time for more impactful work.
In this blog, we will discuss how to navigate the ever-changing threat landscape by leveraging automation and how security leaders can determine the best use cases for automation within their organization.
ReliaQuest has seen threat actors accomplish their objectives in a matter of days, and sometimes even hours. As a result, CISOs must reassess their automation strategy. The fear of potentially blocking a user or device must be reevaluated, considering the speed of attacks. Actions that require configurations or rule changes may need approval, but when seconds count, the Change Control Board’s approval is weeks away.
The status quo of relying on existing manual processes and traditional change control procedures is no longer sufficient to combat the evolving threat landscape. Defenders must adopt an agile strategy to keep up. Acting with a sense of urgency and leaning forward on automation can streamline security operations to effectively combat the speed of adversaries and minimize potential damage from threats.
Automation enables accelerated capabilities across prevention, detection, investigation, and response. It provides opportunities to gather incident context, isolate infected systems, block relevant IPs/domains, and reset credentials. Using automation expedites response times, reduces the risk of human error, and enables organizations to stay ahead of adversaries, protecting critical assets from threats.
While implementing automation has many benefits to an organization’s security operations, it’s crucial to approach the implementation with careful consideration. Leaning forward on automation is not simply a matter of turning on response playbooks and expecting immediate success. Using a measured approach helps prevent unintended disruptions and ensures a smooth adoption. It requires evaluating potential risks and trade-offs, assessing whether the degree of automation aligns with the organization’s risk tolerance level. Automation is not something to run headlong into.
Each organization has its own unique risk tolerance, which is based on factors such as its industry, regulatory requirements, and overall risk management strategy. Strategic planning and careful evaluation of risk tolerance are crucial in determining the appropriate amount of human involvement and decision-making in automated actions. CISOs should collaborate with their leadership and IT peers throughout this automation journey, communicating the goals, benefits, risks, and automation methodology. This is not an initiative that should be done in isolation, as mistakes in automation have the potential to be a “career limiting move” for CISOs.
When evaluating a playbook, it’s important to consider whether it should require human involvement or can be fully automated. For example, when handling high-fidelity alerts, organizations may choose to automate the response process without human intervention, whereas in other scenarios, human execution of a playbook may be preferable. It’s essential to avoid misapplying automation and inadvertently causing self-inflicted denial-of-service (DOS) situations.
It’s also worth noting that the automation strategy can be dialed up or dialed down depending on the business environment and threat landscape. For example, in a situation where ransomware actors are actively targeting a specific sector, there may be an increased appetite to automate prevention and isolation use cases.
In the ongoing process of improving security operations, it’s crucial to identify optimal use cases for automation. By pinpointing these use cases, CISOs can effectively implement automation to address key areas, thereby improving response efforts and enhancing an overall security posture.
To begin identifying some specific use cases for automation, a valuable starting point is to conduct an analysis of the top alerts encountered within the past year. By examining these top alerts, organizations can identify areas that would benefit from implementing automated processes to optimize their security operations. One important question to consider during this analysis is: Where is the team spending the most of their time?
For example, organizations should evaluate their top true-positive alerts. Let’s assume that a “phishing email clicked” is a frequent true-positive, which can be deemed as a high-fidelity alert. In this case, the organization can implement a phishing response play, as shown below.
In addition to phishing, we’ve observed other common top true-positive alerts in customer environments, such as compromised credentials and malware incidents. The responses to these alerts are highly actionable, making them prime use cases for automation. By implementing automation to respond to these alerts, organizations can be more agile in responding to threats.
There is not a CISO or security leader that I speak with today that is not interested in maximizing their security investments and rationalizing their security stack. While at Forrester Research, I wrote about the term “expense in depth,” which I described as the multilayered approach to ensuring minimal return on investment. Understanding the technology stack is crucial for organizations to align their automation efforts with existing infrastructure, optimizing processes and improving efficiency. This approach is designed to achieve long-term scalability and compatibility. It allows for smooth integration and minimizes any potential challenges or disruptions that may arise. Organizations can make informed decisions by identifying redundancies across their toolsets and selecting automation solutions that seamlessly fit within existing tech stacks, thereby maximizing their return on investment (ROI).
To uncover opportunities for automation, it is essential to conduct a comprehensive analysis that considers various components, including integrations, APIs, and the complexity of the technology stack. Start by identifying specific pain points or challenges to provide a basis for identifying potential use cases for automation. During this identification stage, it’s helpful to ask questions such as: What integration options exist? What can you start to stack together to build a playbook?
Organizations must also understand the different components involved in a specific use case, such as email security, network security, cloud security, and more. This understanding helps in determining the complexity of the tech stack and the number of consoles that need to be accessed to solve a problem.
After identifying the components, assess the effectiveness and complexity of handling them manually. This assessment can involve evaluating the documentation and determining the level of expertise needed to successfully manage these components. As this process can sometimes prove to be overly complex or time-consuming, outsourcing to a security operations platform could be a viable option.
Interviewing the broader security team is an effective approach for organizations to uncover additional use cases for implementing automation. With their firsthand experience working in the security environment, they have a deep understanding of the organization’s needs and can provide valuable insights for improvement.
One approach is to analyze the number of steps or pivots that analysts and engineers must go through in different tools to complete a specific task. By deconstructing the steps involved in routine tasks, we can identify opportunities to streamline the workflow by consolidating these steps. This analysis also helps us understand the manual effort and time spent on each task to pinpoint specific areas where automation can be effectively applied. As a result, we can reduce overall effort required to complete these tasks and determine the value of automation in terms of savings.
Quantifying the hours spent on specific tasks also allows us to better understand the potential efficiency gains and resource allocation benefits that automation can offer. For example, the top five incidents and alerts that analysts spent time doing manually in the past year could represent a substantial amount of time savings that could be allocated elsewhere. The goal is to automate low-complexity, time-consuming tasks, freeing up analysts to focus on more strategic and valuable activities.
When assessing automation use cases with the security team, consider asking questions such as:
By asking these questions, organizations can evaluate whether automation is suitable for particular use cases and ensure that the automated actions align with the organization’s goals and requirements. There are added benefits to soliciting this feedback. Firstly, implementing automation can make the day-to-day lives of security teams easier, leading to improved morale. Secondly, automation frees up resources within the security team, allowing them to focus on other less mundane areas. This enables them to shift their focus towards improving their skillsets and careers. Lastly, CISOs are getting “ground truth” from the staff in the security operations trenches, which is an invaluable perspective.
CISOs can no longer afford to apply security operations strategies from previous decades to address today’s threat landscape. The lower barriers to entry, combined with the increasing sophistication of adversaries, require a more proactive security operations strategy. Automation can prevent threats, accelerate threat detection, reduce response times, mitigate human error risks, and maintain an edge against adversaries. CISOs don’t want to conduct a post-ransomware after-action review only to discover that the integrations and playbooks necessary to prevent the attack existed but were not implemented. Such a scenario may not be well-received by leadership, who expect proactive measures to be in place to prevent such incidents.
However, the implementation of automation requires careful deliberation. Each organization has its own unique risk tolerance, which must be considered to ensure an appropriate level of human involvement and decision-making in automated actions. To identify specific use cases for automation, organizations should analyze their top alerts and incidents, maximize their technology stack integrations, and gather feedback from their security teams to provide valuable insights for effective automation deployment. By Implementing automation for use cases specific to their organizations, CISOs can navigate the dynamic threat landscape, enhance incident response capabilities, and protect critical assets from evolving threats.
Get a live demo of our security operations platform, GreyMatter, and learn how you can improve visibility, reduce complexity, and manage risk in your organization.