A recent survey by the Ponemon Institute of about 600 users of SIEM solutions shows how efficient SIEM solutions (Security Information and Event Management) are in companies.
SIEMs are central to cybersecurity in organizations because they detect threats that other security solutions cannot identify. To achieve this, the solutions collect log data – so-called log files – from various network sources and analyze them in real time in the best case in order to evaluate suspicious events in the network.
But SIEM is not the same as SIEM: In the market, numerous providers are busy with more or less advanced solutions. Here, the Ponemon Institute’s SIEM Productivity Study provides important insights that can help companies choose the right technologies.
Time and Resource Eaters "False Positives"
In 80 percent of cases, the solutions are not very effective and do not manage to reduce the necessary personnel expenses in the SOC. What are the causes and what can be done about them?
The reason for this inefficiency of many SIEM solutions, according to the study, is that security analysts in the company spend 25 percent of their time following the false positives because security alerts are not correct.
Divide between conventional SIEM and next-gen SIEM solutions such as LogRhythm
Such false alarms are found in particular in conventional SIEM solutions. Compared to older solutions, modern next-gen SIEMs such as LogRhythm use artificial intelligence and machine learning. Current SIEM technologies from LogRhythm such as UEBA (User and Entity Behavior Analytics), NDR (Network Detection & Response) and SOAR (Security Orchestration, Automation & Response) have also significantly increased productivity in the companies using them. The total time spent on security tasks in companies decreased by 51 percent compared to the time spent before using the solution. Considering these findings, given that many SOCs are chronically understaffed, it can be concluded that next-gen SIEMs can not only help to increase productivity, but also better protect the company.
With its partner LogRhythm, TWINSOFT has one of the three market leaders in its portfolio, but it has the best price-performance ratio in comparison. Just contact us for a personal appointment or a demo!
