Strengthened Security Posture

Evidence and data. Interviewees shared that using SES Complete significantly enhanced their organizations’ security posture by providing multilayered protection across all endpoints. Its threat prevention capabilities, including behavioral analysis, proactive malicious activity blocking, threat hunting, and specialized Active Directory security, allowed organizations to stop sophisticated attacks proactively, like malware, ransomware, and targeted threats. Interviewees described several specific ways that SES Complete improved their endpoint security:

• Increased share of endpoints protected. Interviewees said that SES Complete offered endpoint protection across various device types, including laptops, mobile devices, and servers, ensuring that it protected a larger portion of their organizations’ endpoints. The IT director at a manufacturing firm described how the coverage improvement solidified their organization’s security: “Previously, we had around 50,000 endpoints. About 50% were protected at the time we switched over because we had not fully adopted an endpoint management solution. We had other tools, but it wasn't a unified solution. Now it's pretty close to 100% of endpoints protected.”

• Strengthened security from Adaptive Protection. Interviewees reported that SES Complete’s Adaptive Protection capabilities dynamically adjusted security policies based on their user base’s typical behavior as well as the evolving threat landscape. This AI-driven customization minimized vulnerabilities by optimizing defenses and policies. The cybersecurity technologist at a professional services firm described the benefit: “The Adaptive Protection features are important to us. They read and analyze data from other endpoints, bringing them into one place for better decision-making.”

• Improved visibility into endpoints. According to the interviewees, SES Complete provided enhanced visibility into all of their managed endpoints and allowed security teams to identify anomalies and potential threats quickly, reducing the likelihood of a breach. The IT director at a manufacturing firm stated that, “[With SES Complete], you have a comprehensive view of your threat landscape throughout all of your specific endpoints.”

• Provided granular detail into security alerts. Interviewees said that, beyond high level visibility into the endpoint threat landscape, SES Complete also provided more granular detail into every security threat’s source, novelty, and exploit potential. This context allowed security staff to assess the acuteness of an alert accurately and prioritize accordingly. The cybersecurity manager at a financial services firm stated: “The benefit is around the level of detail that we are getting from the SES Complete alerts. They provide the source of the threat, if it is already known, if it is new, what the level of exploit could be, and the damage based on the location where the threat is identified. That kind of information helps us understand the criticality of the issue and how to mitigate it.”

• Reduced MTTR. Interviewees shared that SES Complete accelerated incident response and remediation time, preventing threats from evolving into larger-scale incidents. The cybersecurity manager at a financial services firm described how SES Complete reduced MTTR: “Our teams are more confident and happier because we are able to identify, detect, and remediate alerts before they hit our major applications. The moment we see an alert, we classify it, segregate it, and prioritize it to be eliminated. There are automated solutions that we have developed based on SES Complete.”
  The interviewee went on to say, “I can say with confidence that the MTTR reduction is one of the best things that has happened by using SES Complete.”

• Centralized management of diverse device types. SES Complete offered interviewees’ organizations centralized management for a wide array of device types, including laptops, mobile phones, and servers, through a single console. Interviewees shared that this approach eliminated the complexities of managing disparate security solutions and ensured consistent protection. The cybersecurity technologist at a professional services organization reported: “With SES Complete, we can roll out security protections and features to all of our endpoints, whether they are laptops, phones, or standalone servers. It ties everything into our firewall, and then everything gets reported into a centralized space.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• Based on Forrester’s 2024 security survey, the composite organization has a 68% chance of experiencing a breach every year, with each breach expected to cost $4.4 million. Furthermore, 81% of those breaches originate either from external attacks, attacks targeting employees’ home or remote networks, or internal incidents. Forrester estimates that SES Complete can address 70% of these breaches.²

• With SES Complete, the composite reduces the likelihood of a severe data breach caused by an external attack, an attack targeting employees’ home or remote networks, or an internal incident by 70% in Year 1. The composite’s SES Complete deployment continuously improves based on learning from new threats and environmental data; by Year 3, the reduction in breach likelihood is 80%.

Risks. The following factors may impact this benefit:

• The percentage of endpoints that an organization chooses to protect with SES Complete.

• An organization’s security posture and maturity prior to deploying SES Complete.

• The likelihood and associated costs of security breaches each year.  

Results. To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $3.8 million.

Alert Management Time Savings

Evidence and data. Interviewees shared that SES Complete allowed their security teams to significantly reduce the time spent manually responding to true positive security alerts through several integrated capabilities. By proactively diminishing the attack surface via features like behavioral and application isolation and Adaptive Protection, the interviewees’ organizations could reduce the overall volume of alerts generated, while also accelerating alert resolution times.

• Interviewees shared that they used SES Complete to deploy automated response capabilities, such as real-time blocking of malicious behaviors and automatic actions based on deviations from normal behavior, eliminating the need for as many manual interventions. The cybersecurity manager at a financial services firm described the benefit: “Based on the alert information we get from SES Complete, we have developed an automated response system based on criticality. … There’s a 30% to 40% reduction in the MTTR for known threats and exploits.”

• When true positives do occur, interviewees noted that SES Complete provided highly descriptive alerts with crucial data on threat sources and exploit levels, allowing security teams to understand and remediate each incident quickly without extensive investigation. An engineer at a technology organization reported: “With SES Complete, we not only see the number of alerts decrease but we also decrease the support staff time spent on each ticket. … If we didn’t have SES Complete, the [ticket resolution time] would be double. When we handle the tickets, the security staff can see the logs of all the clients and the user’s behavior graph and make use of that information to make decisions much faster.”

• The IT director at a manufacturing firm agreed that their organization saw a reduction in security alerts and alert resolution time from using SES Complete: “Some of the features that helped reduce the amount of time it took to investigate threats were the automated threat prevention, the ability to better detect true and false positives, and then overall faster incident responses, because the number of incidents became lower.”
  The same interviewee went on to quantify the time savings for their security team: “The mean time for remediation has reduced by 33%. … The team is doing more monitoring with less intervention. Previously, they were spending about 50% of their time with manual remediation and now it is down to 15%. … When you deploy something like SES Complete, you’re going to get a big return right away. You’re going to get 30% to 40% reduction in time in some areas.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• Prior to using SES Complete, the composite organization has 1,500 true positive security alerts per month.

• With SES Complete, the composite reduces the number of security alerts that require investigation by 10% in Year 1. As the SES Complete deployment matures and the composite sets up more automated responses, this percentage grows to 15% and 20% in Years 2 and 3, respectively.

• Before SES Complete, each alert investigation required 2.5 hours of FTE time.

• With SES Complete, the number of hours dedicated to each alert investigation fell by 33%, down to 1.68 hours.

• A security FTE has a fully burdened hourly rate of $65.

• An 80% productivity recapture is applied since not all time savings are redeployed productively.

Risks. Alert management time savings will vary depending on:

• The volume of security alerts an organization has in its legacy environment.

• The number of hours required for each alert investigation prior to deploying SES Complete.

• The average fully burdened annual salary for a security FTE.

Results. To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $2.1 million.

False Positive Time Savings

Evidence and data. Interviewees shared that SES Complete’s ability to correlate activity from device health, user activity, and web access enabled more accurate detection rules that adapted to context, such as whether a user was remote or using a trusted device. This improvement in detection accuracy reduced the time staff spent responding to false positives.

• An engineer at a technology company described how SES Complete’s detections adapted to context, leading to an improvement in alert precision: “[SES Complete] detects behavioral threats or malware in a more contextually aware way. For example, users may switch between different accounts, such as corporate accounts, personal accounts, and testing accounts. We definitely want to offer all the protections, but the protection level could vary in different contexts. Using the same protection level may result in too many false positives or false negatives. Contextual awareness in our testing and feedback from real users is one of the best features compared to other vendors we’ve used.”

• The IT director at a manufacturing organization agreed that SES Complete had reduced the number of false positives for their organization: “SES Complete has Adaptive Protection, which prevents breaches. Their detection and response tool has the ability to do behavioral forensics, which uses machine learning and analytics to determine threats that are not fully defined or recognized and to filter out threats that may not be threats at all.”

• The same interviewee also described how SES Complete’s isolation features contributed to a reduction in false positives: “SES Complete’s app isolation and behavior isolation has been very helpful for us. It’s driven by AI capabilities that better detect threats and reduce the number of false positives we’re getting so that we don’t have our team running around in circles.”

• The IT director went on to share that after adopting SES Complete, their organization reduced the number of false positives by 35%.

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• Prior to adopting SES Complete, the composite organization investigates 300 false positives per month.

• With SES Complete, the composite reduces the amount of false positives by 20% in Year 1. As SES Complete’s adaptive learning continuously refines its detection model based on accumulated data, the reduction in false positives increases to 25% in Year 2 and 30% in Year 3.

• Before SES Complete, each false positive required 2.5 FTE hours to investigate.

• The composite uses SES Complete to accelerate alert investigations, and the time required for each investigation falls by 33% to 1.68 hours.

• A security FTE has a fully burdened hourly rate of $65.

• An 80% productivity recapture is applied since not all hours saved are redeployed productively.

Risks. False positive time savings will vary depending on:

• The share of false positive alerts an organization has in its legacy environment.

• An organization’s tolerance for false positives.

• The number of hours required for each false positive investigation prior to deploying SES Complete.

• The average fully burdened annual salary for a security FTE.

Results. To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $489,000.

IT Support Time Savings

Evidence and data. Interviewees shared that using SES Complete reduced IT support tickets by identifying and remediating issues proactively before users experienced disruptions. With centralized policy enforcement, automated response to common user access problems, and real-time threat containment, SES Complete eliminated many routine tickets related to access errors, account suspensions, malware alerts, and network slowdowns. Interviewees provided a range of estimates for the reduction in IT support tickets:

• The IT director at a manufacturing firm described the decrease in tickets: “On the help desk side, there used to be a lot more endpoint-related issues. Within the help desk, it’s a 15% reduction in time [with SES Complete].”

• The cybersecurity manager at a financial services organization provided a similar estimate for IT support time savings, “We have seen a 15% to 20% decrease in the number of tickets that are reaching the help desk team.”

• An engineer at a technology company also reported a decline in account-related endpoint tickets: “We receive alerts when account behavior is not right, or there is malware, and then we suspend their accounts. There are tickets when the user cannot log in or the account is suspended, and we need to investigate. For these time-consuming tickets, it is clearly declining [with SES Complete].”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• Prior to deploying SES Complete, the composite organization receives 30,000 IT support tickets per month.

• In Year 1 of using SES Complete, the number of IT support tickets declines by 6%. As the SES Complete deployment matures, the number of tickets declines by 7% in Year 2 and 8% in Year 3.

• Each ticket requires 10 minutes of FTE time.

• An IT support FTE has a fully burdened hourly rate of $40.

• A productivity recapture of 80% is applied since not all hours saved are redeployed productively.

Risks. The IT support time savings will vary depending on:

• The number of IT support tickets an organization receives per month, as well as the portion of tickets that are related to account suspensions, blocked work, or other endpoint security issues.

• The number of FTE minutes required for each IT support ticket.

• The fully burdened hourly rate for an IT support FTE.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $298,000.

Avoided Legacy Solution Costs

Evidence and data. Most interviewees reported that adopting SES Complete allowed them to retire legacy tools, such as legacy endpoint protection platforms or standalone web gateways. By consolidating onto one tool, interviewees reported that they could reduce the amount of internal labor dedicated to maintaining, patching, and troubleshooting separate systems.  

• The cybersecurity technologist at a professional services firm reported that migrating to SES Complete enabled them to gradually retire several point tools, which collectively cost more than SES Complete. The interviewee described why they decided to consolidate onto SES Complete: “The ease of use and setup were significant factors in choosing SES Complete. Adding users and registering devices was easy, especially for smaller organizations. It was quick to deploy on a private server or cloud.”

• The IT director at a manufacturing firm reported that prior to implementing SES Complete, they had two endpoint solutions that failed to provide them with comprehensive visibility, which led to regular security incidents and occasional breaches. Although these tools were less expensive than SES Complete, they were labor intensive to maintain, and the vulnerabilities led to high breach costs. The interviewee described the maintenance cost savings they saw after adopting SES Complete: “Having a tool that can automate security tasks and provide centralized visibility and automate the control of updating endpoints helps us be more efficient overall. … Without having the comprehensive on-prem capabilities along with capabilities in the cloud, it would be much harder for us to support our complex network.”

• The IT director went on to compare SES Complete with other comprehensive endpoint protection platforms: “There are a lot of SES Complete competitors out there, but SES Complete is working for us. There are other solutions, but [we found that] their cost and complexity would require much more cybersecurity resources.”

• The cybersecurity manager at a financial services firm reported that they adopted SES Complete to supplement their other endpoint protection platforms and are now planning to retire one of their legacy platforms to lean into SES Complete more fully. The interviewee stated that the tool they plan on retiring is roughly the same price as SES Complete.

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• The composite organization begins retiring legacy tools in Year 1 and can fully retire these tools by Year 2. In total, it retires $330,000 of legacy system costs in Year 1, with $561,000 of costs avoided in both Years 2 and 3.

• The composite’s legacy endpoint protection systems required 2.5 FTEs to maintain.

• Each security maintenance employee has an average fully burdened annual salary of $135,000.

Risks. The avoided legacy costs will vary depending on:

• The specific endpoint protection tools that an organization has in its legacy suite.

• The speed at which an organization can retire its legacy costs.

• The average fully burdened annual salary for a security employee in charge of maintaining endpoint protection platforms.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $1.8 million.

Unquantified Benefits

Interviewees mentioned the following additional benefits that their organizations experienced but were not able to quantify:

• Cybersecurity insurance benefits. Some interviewees reported that they adopted SES Complete partially at the direction of their cybersecurity insurance providers. Other interviewees shared that, although they independently decided to implement SES Complete, it made it easier to keep their existing coverage, prevent premium increases, and potentially secure lower rates. The cybersecurity manager at a financial services firm described the impact of SES Complete on their cybersecurity insurance: “Our cyber insurance cost has definitely come down. Insurance is based in part on the number of security providers you have, so we had a reduction of about 3% in premiums.”
  The IT director at a manufacturing firm reported that SES Complete not only helped them keep their coverage but also led to time savings when applying for insurance: “[SES Complete] helped us with cybersecurity insurance. Once we were using a standardized platform like this, [insurers] knew that we were compliant, and they could continue to provide insurance to us. It helped reduce the amount of time it takes to complete the audit and provide the appropriate information to them to maintain our insurance.”

• Easier compliance process. Interviewees also noted that SES Complete helped their organizations meet all of their global and local compliance obligations, simplifying the auditing process and reducing the likelihood that their organizations incurred regulatory penalties. The cybersecurity manager at a financial services organization noted that SES Complete’s adherence to these regulations was part of the reason their organization adopted the solution: “The first question we had was whether the solution was going to be fully compliant with all the local regulations like NST, HIPAA, and ISO 27000. Because we are a global organization, we also need to ensure it follows the GDPR rules. This solution meets all of those. … Being compliant is a major achievement for any large organization. If you’re not being compliant, you’ll have a huge penalty.”

Flexibility

The value of flexibility is unique to each customer. There are certain scenarios in which a customer might implement SES Complete and later realize additional uses and business opportunities.

• Using SES Complete to shrink maintenance windows and increase revenue. The cybersecurity manager at a financial services organization reported that they leveraged SES Complete to reduce their critical maintenance windows, leading to less scheduled downtime and more revenue. SES Complete enabled their organization to simulate sophisticated cyberattacks and conduct testing within isolated, lower environments, allowing it to validate system resilience without impacting live operations. The interviewee stated: “When we were using our previous tools, we had longer repair windows, which are hours where we can safely maintain or update our critical systems. The smaller the window is, the better, because there are 24/7 running applications and some people try to trade early in the morning. By using SES Complete, we were able to simulate attacks and test them thoroughly in our lower environments, so the maintenance window went from 8 hours to 4 hours. This is saving us millions of dollars per year.”