Gaps in the Next-Generation SOC

Christian Wiens Director of Marketing

Christian Wiens is Director of Marketing at MixMode. He has 10+ years of experience as a cybersecurity professional. He has his BA from The University of California, Berkeley and resides in Austin, TX.

The following is an excerpt from our recently published whitepaper, “The Failed Promises of SIEM: How Next-Generation Cybersecurity Platforms are Solving the Problems Created by Outdated Tools,” in which we discuss the ways in which SIEM has failed to deliver on promises made to the cybersecurity industry and why cyber teams must instead turn to a next generation platform powered by unsupervised AI to navigate the ever evolving threatscape of 2020 and effectively defend against modern threats and bad actors.

Gaps in the Next-Generation SOC

Customers have a clear interest in securing their networks against a quickly evolving modern threatscape where bad actors are on constant watch for the chance to exploit vulnerabilities in SIEM setups. Savvy hackers use sophisticated AI designed tactics to work around rules-based security approaches.

If they hope to keep their networks shored up, they have little choice but to sign on for supplemental features like NDR and NTA that allow their expensive software to perform fundamental security functions.

As SIEM evolved, vendors began bolting on NDR (network detection and response) and NTA (network traffic analysis) to their base SIEM offerings. The hope (and promise) was that these tools would add the real-time security solution that was lacking with SIEM technology.

Instead, this ad hoc approach compounded the issue by forcing data into siloed platforms and increasing data overload. Because these platforms used SIEM data, the promise of real-time threat detection and network analysis was doomed from the start.

Still, organizations are hurting for these capabilities. No longer are they content with relying on historic log aggregate data as their primary system of record for threat detection and analysis.

Real-time information provides the granularity necessary to truly understand network behavior. This is where SIEM falls flat. Taking all of these concerns into account, it becomes clear that SIEM is inherently flawed in several important ways:

It is additive in nature — to make it function as a security tool, customers must add additional solutions like NDR and NTA.
Even when customers opt for these additive solutions, the system is ineffective as a modern, real-time, self-adapting security offering.
They need continual monitoring and an endless supply of data, which organizations must store indefinitely.

In short, SIEM is not an inclusive approach. Rather, customers must add functions to benefit adequately from this software, a fact vendors are happy to exploit.

Despite its inherent flaws, today’s SIEM software solutions still shine when it comes to searching and investigating log data. One effective, comprehensive approach to network security pairs the best parts of SIEM with modern, AI-driven predictive analysis tools. Alternatively, organizations can replace their outdated SIEM with a modern single platform self-learning AI solution.