Thank you. We are pleased to present the results of this market research which had some very interesting results.
And if I can summarize what we found in one sentence, it it was that there is a huge gulf between IT managers’ expectations and reality. I’ll share the details with you in just a minute.
The study was primarily designed to explore this issue of collaboration. You can see various types of security products listed on this slide, from various different vendors.
[CLICK TO ADVANCE]
These logos are representative of the products in each category. How many of these products are talking with one another? We wanted to find out because we think it is and important issue.
And it is not just ForeScout who thinks it is important.
Gartner also thinks it is important. About a year ago, they came out with a security model that they call the Adaptive Security Architecture. They recommend that every enterprises have twelve different categories of security capability. Going around this chart in a clockwise direction, you can see that some of the capabilities are intended to help predict whether your organization is going to be attacked, some will help you prevent a security breach, some will help you detect a security breach, and some will help you respond to a security breach. Different categories of products, somewhat like I showed you on the last slide.
But Gartner said that the end result should not be 12 silos of disparate information security solutions. The end goal should be that these different capabilities integrate and share information to build a security protection system that is more adaptive and intelligent overall.
So ForeScout worked with SC Magazine to conduct a market study, and we surveyed 345 corporate executives and consultants in North America.
OK, so let’s get into it. What did we find out?
The first question that we asked was: How many IT security systems do you own? And the answer was quite a few. Over half of the large enterprises, which we defined as organizations with over $1 billion in annual revenue, said that they had 13 or more security systems.
Then we asked – how many of your IT security systems share information with each other? The majority of respondents said very few, just 1 to 3 systems directly shared security information.
Then we asked: “How many of Your IT Security Systems Can Automatically Mitigate Risk Or Remediate Problems?” Again, the majority of respondents said between 1 and 3 of their existing systems could do this.
So next we wanted to find out how important IT security managers believe that information sharing would be. It’s one thing for ForeScout and Gartner to say it is helpful, but we wanted to hear from customers. So we asked the question. Here we found a huge percentage – 95% of respondents said that it would be helpful or very helpful.
We asked the same question about automation. Again we found a huge percentage – 93% of large enterprise customers said that it would be helpful or very helpful.
So let me summarize the results so far. We found a huge gap between the current state and the desired state. Few systems are sharing information, and few systems can initiate automated risk mitigation actions, despite the fact that this is exactly what enterprise IT managers what to happen.
Now let me move on and present some other results of the survey.
We asked respondents: “why is more IT security system collaboration helpful?” We received a variety of rsponses.
97% said that more integrated controls would help identify, investigate, respond and resolve security incidents.
57% said that Automated security controls would have allowed the organization to avoid a compromise or reduce the impact of the compromise that they experienced in the last year
And 75% said that more automation would help prevent future compromise.
These answers were not mutually exclusive, which is why the totals add up to more than 100%. We wanted to get reactions to each of these statements.
43% or respondents said that their security processes are continous
64% said that they were planning to shift towards continuous monitoring in the next 12 to 24 months.
So those were the major conclusions of the market study. TO summarize:
We found that IT security managers strongly want their products to share information, but few do.
We found that IT security managers want automated controls, but few products can do this.
And we found that with respect to continuous monitoring and mitigation, slightly less than half of the organizations were practicing this today, but most organizations were planning to do this in the future.
And we found a large gap between desire and reality.