Some recently announced security tool integrations also demonstrate the pressure for vendors to unite disparate security tools. Security management platform vendor ReliaQuest, for example, acquired Threatcare earlier this month and plans to add its attack simulation technology to its GreyMatter security platform.
GreyMatter basically aggregates security data from SIEMs, endpoint detection and response tools, firewalls, threat intelligence feeds, and other security tools, in addition to providing some of its own analytics and automation functions. “The main problem we want to solve is tools fatigue and vendor sprawl,” says Joe Partlow, CTO of ReliaQuest. “CISOs are trying to adapt and get greater coverage of their attack surface, but the opposite is happening: not greater visibility … but instead more complexity and data residing in silos” and more alerts than they can handle, he says.
GreyMatter basically does the dirty work of pulling together the different tools and their data. It gathers the data from the tools and then “normalizes” that data into a standard format for the platform. That replaces the spreadsheet-merging approach many organizations use to sort and correlate data from various tools.
Aaron Sherrill, a senior analyst at 451 Research, says many security tools are mostly just narrowly focused security features that ultimately get swallowed up by other vendors or get wrapped inside existing platforms — or fall by the wayside. “I view GreyMatter as aggregating a few different security approaches, [including] a managed service provider, SOAR, attack simulation,” and some other security tools, Sherrill says. “It’s [also] an opportunity for them to go a little deeper and look at the effectiveness of the tools in place,” too, by providing the status and health of the various security tools in the organization’s environment.
By: Kelly Jackson Higgins
Media Outlet: Dark Reading
Date: October 9, 2019
Read the full story here.