Interpretation of the 2021 Gartner Hype Cycle for Security Operations

On 23 July, Gartner released the "Hype Cycle for Security Operations, 2021", and people are gradually turning their attention to security operations technologies.

Compared to 2020, digital transformation has strengthened the connection between companies and IT technologies. Coupled with the ongoing impact of the pandemic, the frequency of remote working using mobile devices and cloud services has gradually increased. This change leaves enterprises facing more cyber threats.

Maturity of Security Operations Technologies

Gartner's "Hype Cycle for Security Operations, 2021" provides a systematic description of around 20 of the latest and most popular security operations technologies, in terms of attention, current stage, and years to reach productivity plateau.

The following is a further analysis and discussion of several technologies that are of greater public interest, such as those in the Innovation Trigger, Peak of Inflated Expectations, Trough of Disillusionment, Slope of Enlightenment, and Plateau of Productivity. It will systematically explain them to you in terms of public expectations, developmental stage, years to reach maturity, and the pros and cons of the technologies.

Penetration Testing as a Service (PTaaS):

Penetration Testing as a Service (PTaaS) provides continuous and timely penetration testing services for applications and infrastructure, which historically relied heavily on professional penetration testing personnel. Regarding the security operations maturity of PTaaS, which has emerged in recent years, Gartner's newly released "Hype Cycle for Security Operations" analysis shows that PTaaS is currently in the Innovation Trigger stage, with enterprise and user attention still at a relatively low level.

However, as the number of cybersecurity threats increases and the level of enterprise digitisation rises, attention to PTaaS will also increase year by year. After 5-10 years of technology accumulation and tackling key technical problems, PTaaS security operations will gradually develop into a relatively mature stage.

With penetration testing (PT) acting as the foundation of cybersecurity initiatives, the PTaaS model provides a platform that supports faster scheduling and execution, and enables real-time communication with testers in a timely manner. Regardless of the size or maturity of the enterprise, PTaaS provides quick access to penetration testing, enhancing the organisation's security posture, optimising costs, improving output quality, and re-validating patched vulnerabilities.

Of course, there are still various issues in the application of PTaaS at this stage. Most PTaaS vendors in the market only focus on internet-facing digital assets, such as web and mobile applications, which only meets the requirements of some customers. There is fierce competition in the security testing market, with Breach and Attack Simulation (BAS), autonomous penetration testing, and red teaming also fighting it out in the market, so the pressure on the PTaaS market is still quite significant.

Digital Risk Protection Services (DRPS)

In recent years, the highly watched Digital Risk Protection Services (DRPS), after a period of technology accumulation, has broken through the Innovation Trigger stage and reached the Peak of Inflated Expectations, with attention gradually climbing to its peak. People have high expectations for its development, hoping to combine DRPS with services to build a fortress protecting critical digital assets and data security.

The rise of social media and frequent exchange of data and information have led to criminals having an increasing impact on digital assets and the complexity of attacks gradually rising, causing great harm to the business operations of organisations worldwide. Therefore, users have put forward higher requirements for asset security protection.

According to the analysis of Gartner's "Hype Cycle for Security Operations" shown in the figure above, in 2-5 years, with the input of R&D funds and the maturity of application models, the development of DRPS will move towards perfection. After being successfully applied in market practice, it can help users identify potential threats to critical assets at a deeper level.

Of course, the commercialisation of DRPS is not determined by its maturity alone. The rapid growth of the market means it increasingly overlaps with other competitive products. TI, Endpoint Protection Platforms (EPP), Managed Security Service Providers (MSSPs), Managed Detection and Response (MDR) providers, and External Attack Surface Management (EASM) will all pose unpredictable obstacles to the large-scale application of DRPS.

Breach and Attack Simulation (BAS)

BAS technology runs simulations by deploying software agents, virtual machines, cloud platforms, and other means to test threat vectors, mimicking attacks that may be deployed by cybercriminals. Such as external and internal threats, lateral movement, and data exfiltration, BAS can better enable enterprises to continuously simulate multiple attack vectors against enterprise assets to better protect enterprise network security. Currently, large enterprises mostly use methods such as auditing, vulnerability management, application security testing, and penetration testing to verify their own network security. Compared to previous methods, BAS can better ensure users' network security.

In addition, it validates whether infrastructure cybersecurity, configuration settings, and detection/prevention technologies are operating as expected. When used as a supplement to red teaming or penetration testing exercises, BAS can also be used to verify whether Security Operations Centre staff can detect specific attacks.

According to the Gartner Security Operations Hype Cycle shown in the figure above, BAS technology is currently at the Peak of Inflated Expectations, with technology maturity not yet perfect, but public attention has reached an all-time high. However, BAS still faces difficulties in deployment and maintenance. BAS vendors need strong support from internal collaboration within teams such as security operations centres, application operations, and network operations, while also addressing issues such as expanding diagnosis and basic remediation guidance through standard frameworks. Even in such a situation, Gartner optimistically predicts that within 2-5 years, BAS technology will break through technical bottlenecks and achieve mature commercial applications.

Managed Detection and Response (MDR) Services

Managed Detection and Response (MDR) services leverage a combination of host, network, and increasingly cloud technologies, combined with advanced analytics, threat intelligence, and human expertise, to provide round-the-clock threat monitoring, detection, and response.

According to the Gartner "Security Operations Hype Cycle" shown in the figure below, people's attention and expectation levels for MDR are gradually decreasing, and the development of the technology has already passed the Peak of Inflated Expectations, turning into the Trough of Disillusionment. During this period, MDR faces huge pressure, and its previous technology accumulation needs to usher in a technical breakthrough to achieve true market recognition.

Based on the advantages of MDR in the following aspects and combined with actual market behavior analysis, Gartner believes that MDR will develop into the Plateau of Productivity within 2-5 years.

1. Due to the increasing number of external attacks, organisations that have not yet strengthened their threat detection and response capabilities face cyber threats. MDR services enable such organisations to directly purchase features like network protection from service providers, thereby reducing the complexity of finding the right combination of people, processes, and technology;

2. In response to customer demand, MDR providers have added basic security operation features to their offerings, such as vulnerability management, log management, and risk management;

However, the large-scale commercial application of MDR services faces many difficulties that need to be overcome. The number of vendors continues to grow, making it harder for buyers to identify the best provider for their needs. Technology providers with XDR solutions position Managed Endpoint Detection and Response (EDR) as a form of MDR, branding their MDR services as Managed XDR, which may increase confusion for buyers. Managed Security Service Providers (MSSPs) have added MDR products to their portfolios, a practice that further complicates the buyer's decision-making process.

Threat Intelligence (TI) Services

Threat Intelligence (TI) services provide knowledge about the cyber threat landscape by recording tactics, techniques, procedures, and details that identify threats and actors. At the same time, they provide tools to assist in applying TI to security products, and can also alert users to threats they face. TI provides information on who, what, why, how, and to a lesser extent, when, based on technical and strategic analysis of adversaries and their craft.

Additionally, TI services help organisations understand their cyber threat landscape, thereby driving better protection against significant threats and improving detection and response efficiency. Utilizing TI services through APIs, marketplaces, portals, and staff augmentation simplifies the task of implementing intelligence within the environment.

The Gartner "Hype Cycle for Security Operations" in the figure below analyzes the technical development of Threat Intelligence (TI) services. The development of new technologies must go through the stages of innovation trigger, rapid growth, bottleneck, breakthrough, and maturity. After several years of technical development, TI technology has reached its current bottleneck. In the curve, we can find that along with the bottleneck in technical development, media and public attention and expectations have gradually slid into the "trough".

TI also faces negative impacts such as consumers not fully understanding its value, false positives, and high budget costs. Combining various factors, Gartner predicts that TI technology will develop into the Plateau of Productivity within 2-5 years.

Cloud Access Security Broker (CASB)

Gartner's Security Operations Hype Cycle in the figure below shows that Cloud Access Security Broker (CASB) has passed its technical bottleneck and is at the threshold between the Slope of Enlightenment and the Plateau of Productivity. After a period of development, the social attention generated by CASB is also gradually increasing. After experiencing the "ups and downs" of people's expectations, it has gradually stabilised. Gartner predicts that within 2 years, CASB will break through the threshold and reach the Plateau of Productivity.

Cloud Access Security Brokers (CASBs) provide critical cloud governance controls for visibility, compliance, data security, and threat protection by consolidating multiple types of security policy enforcement for SaaS, IaaS, and PaaS into one place. For example, authorisation, UEBA, adaptive access control, DLP, device profiling, object encryption, tokenisation, logging, alerting, and malware mitigation. Combined with these benefits, CASBs support the shift to remote working styles and business-critical cloud services.

A lack of focus on DLP can lead to frustration with CASB usage, making it difficult to establish comprehensive policies and manage false positive rates. In addition, unclear organisational ownership of SaaS tenants has led to CASB implementations failing to adequately secure SaaS. Finally, overlapping CASB capabilities from some vendors lead to duplication and confusion. These currently unavoidable flaws pose certain obstacles to the development of CASB.

Priority Matrix

The priority of each technology is divided into four levels: transformational, high, moderate, and low. The priority matrix in the table below visually describes the developmental priority of various technologies.

Transformational: Will enable new ways of doing business across industries that will result in major shifts in industry dynamics

High: Will enable new ways of performing horizontal or vertical processes that will result in significantly increased revenue or cost savings for an enterprise.

Moderate: Will enable incremental improvements to established processes that will result in increased revenue or cost savings for an enterprise

Low: Will enable minor process improvements (for example, improved user experience) but will be difficult to translate into increased revenue or cost savings

Source of reference: https://www.gartner.com/doc/reprints?id=1-26YZC5AD&ct=210729&st=sb