Cybersecurity & Networking

  • Research Objectives

    • Assess the career progression of cybersecurity professionals.
    • Determine whether cybersecurity professionals are satisfied with their careers and current jobs.
    • Measure the impact of the global cybersecurity skills shortage and uncover what organizations are doing in response.
    • Monitor cybersecurity leadership stat

  • Securing the API Attack Surface

    Research Objectives

    Organizations across industries improve their productivity, innovation, and customer service with an increase in web, mobile, and cloud applications leveraging microservices architectures. But this brings an increase in APIs connecting application components and resources. Organizations rate APIs as the element in the cloud-native stack most susceptible to attack, and attacks stemming from insecure APIs were the most commonly identified cybersecurity incident tied to cloud-native app development over the last 12 months. As the number of APIs continues to grow, security risk increases.

    As a result, organizations need effective API security solutions to reduce risk as cloud-native development scales and help their teams discover, manage, configure, monitor, and protect their APIs to keep pace with modern software development. To gain further insight into these trends, TechTarget’s Enterprise Strategy Group surveyed 397 IT, cybersecurity, and application development professionals at organizations in North America (US and Canada) responsible for evaluating, purchasing, and managing API security solutions.

    This study sought to answer the following questions:

    • Approximately what percentage of public-facing web applications are based on a microservices, cloud-native architecture today? How is this expected to change, if at all, over the next 24 months?
    • How frequently do organizations’ developers (and/or DevOps teams) deliver new software builds to production? How is this expected this change, if at all, over the next 6 to 12 months?
    • What security challenges do organizations face with the faster development cycles of CI/CD?
    • What is the average number of APIs per application? What proportion of cloud-native applications use APIs today? How is that expected to change, if at all, over the next 24 months?
    • Have organizations experienced a security incident related to insecure APIs in the last 12 months? What type of security incident(s) did organizations suffer as a result of insecure APIs?
    • What are the biggest challenges organizations have faced with API security? What types of API vulnerabilities are of greatest concern?
    • How long does it typically take for organizations to remediate an API vulnerability? How do organizations ensure APIs do not expose sensitive data?
    • How would organizations describe the collective level of understanding their development teams have of security risks for APIs?
    • Do organizations provide formal API security training to their development teams?
    • When new APIs are published, when does the team responsible for securing them become involved?
    • What is the source from which API security is funded, or will likely be funded? Do organizations expect to increase their spending on API security technologies, services, and personnel over the next 12-18 months?
    • What do organizations expect to increase their API security spending on the most over the next 12-18 months?
    • What actions do organizations expect to take over the next 12-18 months to implement or optimize their web application and API protection strategies?

    Survey participants represented a wide range of industries including manufacturing, technology, financial services, and retail/wholesale. For more details, please see the Research Methodology and Respondent Demographics sections of this report.

    (more…)

  • The Appeal of Cloud-based Network Management

    With modern IT environments comprising distributed applications across private data centers, public clouds, and edge locations, plus support for hybrid employees working outside of traditional office settings, networking professionals have plenty of choices to make as they ensure critical connectivity for their businesses. Recent research by TechTarget’s Enterprise Strategy Group revealed some interesting findings when it comes to these decisions makers’ preferences for cloud-based network management versus on-premises-based strategies.

    (more…)

  • In networking, a digital twin is a virtual representation of an organization’s actual network environment that IT teams can use as a virtual test bed to assist in planning changes or upgrades to the environment. TechTarget’s Enterprise Strategy Group recently looked into how familiar organizations are with these solutions, how important they are perceived to be, and what current levels of interest are in terms of applying digital twin technology to the networking space.

    (more…)

  • As more workers collaborate virtually, many organizations now depend on additional digital communication tools beyond email. Unfortunately, these new collaboration tools provide attackers the opportunity to engage with humans and evade automated cybersecurity controls.

    Learn more about these trends with the infographic, Challenges in Securing an Overabundance of Communication and Collaboration Tools.

  • Research Objectives

    • Assess how organizations approach security hygiene and posture management today.
    • Understand coverage gaps, why these gaps exist, and whether these gaps lead to security incidents.
    • Evaluate how organizations test the efficacy of their security controls and what this testing accomplishes.
    • Highlight what cybersecurity professionals believe their organizations should do to improve security hygiene and posture management.
    • (more…)
  • Research Objectives

    As more workers collaborate virtually, many organizations now depend on additional digital communication tools beyond email. New collaboration tools provide attackers the opportunity to engage with humans to evade automated controls, extending phishing, BEC, credential theft, and other socially engineered attacks beyond email. Advanced attacks leverage multiple attack vectors, requiring individual, core security controls to work together to detect and prevent advanced attacks. This extends beyond traditional security operations tools (e.g., SIEM, SOAR, EDR, and XDR) to core network, cloud, endpoint, and identity controls.

    As IT and security teams focus on risk-driven security strategies, consistency of policies and priorities across all enterprise communication channels becomes critical to strengthening security posture. More education is needed to motivate security architects to embrace this higher-level perspective. To gain further insight into these trends, TechTarget’s Enterprise Strategy Group (ESG) surveyed 490 IT and cybersecurity professionals at organizations in North America (US and Canada) and Western Europe (UK, France, and Germany) involved with securing enterprise communication and collaboration technology and processes.

    In terms of the risk and security of the many electronic communication and collaboration tools in use, this study sought to answer:

    • What types of communication and collaboration tools have organizations formally sanctioned for their employees’ use?
    • Approximately how many disparate communication and collaboration tools, including email, have organizations formally sanctioned for use?
    • Do organizations formally plan to consolidate one or more communication and collaboration tools into a common platform over the next 12 months? What is the primary driver for this consolidation of communication and collaboration tools?
    • How frequently do organizations estimate they face socially engineered attacks involving multiple electronic communication mechanisms, including email, messaging, mobile, and social media? Which communication and collaboration mechanisms do organizations believe are most vulnerable to threat actors?
    • How concerned are organizations that attacks will leverage, or have already leveraged, communication and collaboration tools (both sanctioned and unsanctioned) to evade security controls?
    • What types of threats that leverage communication and collaboration mechanisms (i.e., email, messaging, social media, etc.) are organizations most concerned about? What threats do organizations believe have penetrated their current communication and collaboration security controls in the past 12 months?
    • How much of a priority is securing the many communication and collaboration mechanisms for organizations beyond their primary email solution? How do organizations expect their spending for communication and collaboration security controls to change over the next 12 months?
    • How confident are organizations in the native security capabilities included in each of the formally sanctioned communication and collaboration tools they currently use?
    • Do organizations have a formal security end-user training program that informs employees about securing sensitive information policies?

    Survey participants represented a wide range of industries including manufacturing, technology, financial services, and retail/wholesale. For more details, please see the Research Methodology and Respondent Demographics sections of this report.

    (more…)

  • Security hygiene and posture management has become increasingly difficult because of factors like a growing attack surface, the increased use of cloud computing, and the need to support a remote workforce. These factors can create security vulnerabilities that lead directly to cyber-attacks. Unfortunately, this pattern will likely persist as most organizations continue to approach security hygiene and posture management with point tools, spreadsheets, and manual processes.

    Learn more about these trends with the infographic, Security Hygiene and Posture Management Remains Decentralized and Complex.

  • Nile Secures Series C Funding– Pulls in $175M

    Nile has been out of stealth mode for almost a year now and has been steadily making progress delivering new capabilities, forming partnerships, and acquiring new customers. This $175 Million Series C funding was led by March Capital and Sanabil investments and a number of other strategic and contributing investors. Nile Raises $175M Series C Funding to Propel Its Vision to Redefine Enterprise Networks – Nile (nilesecure.com) An impressive round in an uncertain economy for sure.

    Nile’s goal is to deliver next-generation network as a service (NaaS) solutions to its initial target market of k-12 and higher education markets, followed by enterprise customers. Nile delivers wired and wireless campus solutions via a cloud-based management approach that enables organizations to consume an inherently secure wired and wireless campus network entirely as a consumption-based service that includes initial assessment, design, deployment, and streamlined operations of the network.

    Back in June, it announced a partnership with Palo Alto Networks to provide integrated security solutions and secure SD-WAN. The two companies have worked together to leverage APIs to integrate network data to provide enhanced zero trust (network, access, and isolation) solutions for their joint customers. Working with a global leader in security like Palo Alto Networks makes sense and its AI-powered and cloud driven approach is a good fit for highly distributed, modern network environments.

    Having an initial focus on campus networks is a good choice for a startup like Nile as Wi-Fi technology evolves quickly (Wi-Fi 7 Consumer APs are already out) and high turnover rates (as compared to DC switches) provide an opportunity for Nile to gain traction quickly. Also, organizations are under pressure to re-imagine the campus — for the education market, it is about supporting more devices and ensuring secure and seamless experiences when coming back to campus. For the enterprise, the campus network needs to securely support the return to the office and accommodate bandwidth-intensive collaboration applications via Wi-Fi.

    For virtually all markets, Wi-Fi connectivity is viewed as a utility, in the same way older generations simply expected to pick up a phone and get a dial tone (I know, I am showing my age). Nile understands that concept and has developed a solution that removes the complexity from assessing and designing a new solution and accelerates the deployment of new, secure campus wired and wireless technology. With its partnership with Palo Alto Networks, it provides enhanced security and includes secure SD-WAN as well.

    Another notable aspect of Nile is who its founders are — namely Pankaj Patel and John Chambers. Many of you may remember John’s other successful startup — no, not Cisco, but Pensando — the company that set out to democratize smart NICs and distributed services for both enterprise and hyperscaler markets. Pensando is now part of AMD (April 2022 acquisition).

    Nile came out of stealth with significant go-to-market channels already in place and has spent the last year acquiring customers and deploying solutions with streamlined operations that enable organizations to spend time working on strategic business initiatives and not responding to problems with their Wi-Fi networks. This latest round of funding will give them the opportunity to invest in additional resources to ramp up their go-to-market and deliver more tightly integrated solutions with partners like Palo Alto Networks.

    Given the recent funding, next-gen technology, and veteran management team, it’s hard to bet against Nile. However, it should be noted that they do have formidable competition — not only from the established networking leader Cisco, but also from rising challengers, such as Arista, Extreme Networks, HPE Aruba Networking, and Juniper Networks (alphabetical order), that continue to innovate and grow.

    Ultimately, this competition will drive innovation and Nile joining the field will only help to create a rising tide that will ultimately benefit all markets and enterprises with more secure, robust, and intelligent network environments. Nile has made a lot of progress in the last 12 months, and I am looking forward to seeing what the next 12 months bring.

  • As the amount of data stored in the cloud continues to increase, so too do the challenges of securing that data from malicious attackers. According to research from TechTarget’s Enterprise Strategy Group, organizations are more confident in their ability to secure on-premises data than data saved in the cloud. Indeed, 54% of organizations surveyed considered their on-premises data security strategies to be more effective than their public cloud infrastructure and application data security.

    Read my blog to get more insights on how organizations are deploying cloud-native tools from CSPs and third-party tools from MSPs to achieve a defense-in-depth strategy and better secure cloud-resident data.

  • Research Objectives

    Security hygiene and posture management has become increasingly difficult because of factors like a growing attack surface, the increased use of cloud computing, and the need to support a remote workforce. These factors can create security vulnerabilities that lead directly to cyber-attacks. Indeed, a majority of organizations have experienced at least one cyber-incident due to the exploitation of an unknown, unmanaged, or poorly managed internet-facing asset. Unfortunately, this pattern will likely persist as most organizations continue to approach security hygiene and posture management with point tools, spreadsheets, and manual processes. Organizations are prioritizing spending on security hygiene and posture management, focusing on areas like continuous security testing, process automation, and increasing staff. Security professionals also aspire to consolidate disparate point tools into a security observability, prioritization, and validation (SOPV) architecture to gain a holistic perspective across all aspects of security hygiene and posture management.

    To gain further insight into these trends, TechTarget’s Enterprise Strategy Group (ESG) surveyed 383 IT and cybersecurity professionals at organizations in North America (US and Canada) responsible for evaluating, purchasing, and utilizing products and services for security hygiene and posture management, including vulnerability management, asset management, attack surface management, and security testing tools, among others.

    This study sought to answer the following questions:

    • What are the biggest drivers for organizations’ security hygiene and posture management strategies and programs?
    • What groups are responsible for defining policies for security hygiene and posture management?
    • Have organizations automated security hygiene and posture management activities? If so, which ones have been automated?
    • Why do organizations perform external attack surface discovery?
    • What do organizations believe are the primary reasons for the increase in their attack surface over the past two years? What actions have they taken to reduce the attack surface?
    • Have organizations experienced some type of cyber-attack in which the attack itself started through an exploit of an unknown, unmanaged, or poorly managed internet-facing asset?
    • How often do organizations conduct comprehensive security asset inventory assessments?
    • What types of databases/systems/tools are currently in use as part of organizations’ IT asset inventory process(es)?
    • For which assets do organizations have the most difficulty maintaining a timely and accurate inventory?
    • What are the biggest challenges associated with vulnerability management? How do organizations determine which vulnerabilities to prioritize and patch?
    • What are the primary reasons organizations conduct penetration tests/red teaming exercises? What actions do they believe would most improve their penetration testing/red teaming program(s)?
    • How do organizations expect their plans for spending on security hygiene and posture management to change over the next 12 to 18 months?

    Survey participants represented a wide range of industries including manufacturing, technology, financial services, and retail/wholesale. For more details, please see the Research Methodology and Respondent Demographics sections of this report.

    (more…)

  • How to Get the Most out of Your MDR Journey

    As part of a recent study by TechTarget’s Enterprise Strategy Group, cybersecurity professionals were asked about the processes, tools, and overall assistance they need from managed detection and response (MDR) providers to help their security teams gain control and ensure future security program success. The research revealed that organizations do view MDR as a path to accelerate program development and fill gaps—and, as trust is established, this kind of relationship often grows considerably over time.

    (more…)