Improved Security From Using ReliaQuest GreyMatter

Evidence and data. Interviewees reported that ReliaQuest’s GreyMatter platform integrates and analyzes data from their various security tools to provide comprehensive visibility, enabling faster detection and response to threats before they escalate into breaches.

• Interviewees reported that prior to adopting GreyMatter, they had several security gaps that sometimes led to breaches. The director of security operations at an aerospace organization reported that prior to GreyMatter, they would sometimes have multiple breaches in a year, each one costing their organization hundreds of thousands — if not millions — of dollars. The interviewee noted the improvement in their visibility with GreyMatter: “[ReliaQuest’s] alerts are hydrated with really relevant data. … We use threat hunting, detect and response, and their mobile app, which is one of their greatest features. The GreyMatter interface and platform is really good. … Since we’ve been with them, we haven’t had anything major come across.”

• Interviewees also shared that the GreyMatter platform included features such as threat hunting and attack simulations to identify and remediate vulnerabilities, further minimizing the likelihood of successful attacks. The technical security manager at a facilities services organization shared: “With the help of GreyMatter, their threat hunting capabilities, and their help testing our security controls, we’re going to shift left the quell process.”

• The interviewees reported that GreyMatter accelerated their mean time to resolve security vulnerabilities, reducing the likelihood of a security breach. The deputy CISO at a manufacturing firm described the improvement: “We talk a lot about our reduction in mean time to resolve tickets. When we were using [our previous tool], it took about 17 days. Now it’s 1.5 days to resolve a ticket. That’s huge. … From an advanced threat perspective, dwell time went from days to 6 minutes.”

• Outside of faster response times and a reduction in breaches, interviewees shared a wide range of metrics highlighting how their security posture has improved with ReliaQuest GreyMatter. The deputy CISO at the manufacturing firm went on to say: “We’ve gained MITRE coverage, which is really important for detection and monitoring. From a threat adversary perspective, we were at 29%. Now, we’re at 78%.”

• Interviewees reported that their organizations rely on ReliaQuest’s Digital Risk Protection capability to provide continuous external threat monitoring and intelligence, enabling the proactive detection of risks like data leakage and exposed credentials before they can be exploited. The CISO at a lighting solutions organization stated that: “We have the Digital Risk Protection module. So, for example, if things are leaked on the dark web from an insider on our part, we know it through ReliaQuest.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• Using GreyMatter helps the composite organization improve a wide range of its security metrics. Significantly, the composite’s MTTR decreases by 75%.

• The mean cumulative cost of a breach for the composite organization is $3.85 million.²

• Prior to implementing GreyMatter, the composite organization has a 67% chance of being breached per year.³

• Fifty-six percent of breaches originate from either external attacks targeting the organization or internal incidents within an organization.⁴

• With GreyMatter, the composite organization reduces its risk of these types of breaches by 45%.

Risks. The improved security benefit can vary depending on:

• Threat detection and remediation capabilities in the legacy environment.

• The specific security tools that an organization uses alongside GreyMatter.

• The types of attacks and breaches in the previous environment.

• Expected breach costs, which depend on an organization’s size and industry.

Results. To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $1.4 million.

Alert Management Time Savings With ReliaQuest GreyMatter

Evidence and data. Interviewees shared that GreyMatter’s agentic AI capabilities significantly reduce manual alert response hours by autonomously triaging and investigating security alerts. Instead of simply generating summaries of alerts, GreyMatter analyzes security data from a variety of tools, correlates events, and frees up human analysts from repetitive and time-consuming initial investigation tasks. Interviewees also said that GreyMatter’s automated response playbooks further reduce staff response time by executing preconfigured actions across an organization’s security tools, such as isolating compromised accounts or blocking suspicious IP addresses.

• Interviewees described how implementing ReliaQuest GreyMatter has created a culture of innovation and automation on their security team, with more and more manual processes handled by GreyMatter’s automation and AI features. The deputy CISO at a manufacturing firm stated: “We have gone all in on automated response playbooks. … [We have] 500 alerts per month, and [GreyMatter] is handling around 99% of them.”

• The same interviewee went on to say that GreyMatter’s AI capabilities and automated response playbooks are also reducing their MTTR: “What we get through GreyMatter is the ability to leverage their detections and their automations, which greatly reduces the administrative burden on our team. … It actually shrinks the time to action immensely.”

• The director of security operations at an aerospace organization confirmed that GreyMatter improves the efficiency of their security team, while also reducing their MTTC alerts: “We have alerts that are automated, manual, and combined. … We have a goal of MTTC within minutes, which we comfortably accomplish consistently. … Our MTTC is phenomenal, and a lot of that has to do with automation.”

• The CISO at a lighting solutions organization shared that using GreyMatter has allowed them to reallocate members of their security team to other tasks: “Previously, I had a team that was doing everything themselves. Tier one and tier two alerts are now fully outsourced to ReliaQuest. Tier three alerts are handled by internal specialists. … With ReliaQuest, I can do the work of 20 people with the work of a nine-person internal team. I can also monitor three times as much, all without having to hire additional people.”

• The technical security manager at a facilities services firm agreed that using GreyMatter improved both staff productivity and their organization’s overall security posture: “We saved time from an employee perspective. We’re working things faster than we ever have before. … We’re seeing more than we’ve ever seen before from a visibility perspective.”

• In addition to the time savings, interviewees shared that GreyMatter helped their teams respond to manual alerts more efficiently than they were able to in the past. The CISO at the lighting solutions organization described how ReliaQuest GreyMatter offered guided response workflows for their analysts to follow: “There are also time savings on alerts [that are not automated] because it’s already laid out in GreyMatter. ReliaQuest provides detailed descriptions when an incident happens and background on what they have done already. Most of the research is already done so they provide actionable items that we need to do. It’s probably 50% time savings on each [nonautomated] alert.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• The composite organization has 400 security alerts per month.

• Each alert requires both a tier one and a tier two security employee to investigate and resolve it. On average, each employee dedicates 1.5 hours to each alert.

• With GreyMatter’s agentic AI capabilities and automated response playbooks, 85% of the composite’s alert investigations are handled without any human intervention. For more manual alert investigations, GreyMatter’s correlation capabilities and guided response workflows enable security analysts to respond to each alert more quickly. Overall, the composite is able to reduce the amount of time spent on true-positive alert investigations by 89.5%.

• The average fully burdened hourly rate for a security FTE is $71.

• Forrester applies an 80% productivity recapture to account for the fact that not all employee time savings are redeployed productively.

• The faster alert management allows the composite organization to reduce MTTR by 75% and to reduce MTTC to 6 minutes.

Risks. The alert management time savings will vary depending on:

• The number of security alerts per month.

• The number of security FTEs dedicated to responding to each alert.

• The specific automated response playbooks that an organization deploys.

• The alert automation capabilities in an organization’s legacy environment.

• The fully burdened hourly rate of security FTEs.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $1.6 million.

Reduced Cost To Investigate False Positives

Evidence and data. Interviewees shared that ReliaQuest’s GreyMatter platform helps reduce false positives by centralizing and correlating security data from various tools, providing a more holistic view of potential threats. They also said that ReliaQuest’s team of service experts collaborates with their organizations to fine-tune the platform’s detections and distinguish between genuine threats and benign anomalies. The CISO at a lighting solutions organization estimated that, “False positives have declined by 80% to 90% with ReliaQuest.”

The deputy CISO at a manufacturing firm added that the reduction in false positives led to additional time savings for their security team: “Our SOC manager doesn’t have to spend a lot of time responding to false positives. It’s all on [ReliaQuest’s] behalf.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• Prior to adopting GreyMatter, the composite organization experiences 80 false positives per month.

• With GreyMatter, the composite organization reduces the number of false positives by 80%.

• Each alert requires both a tier one and tier two security employee to investigate and resolve it. On average, each employee dedicates 1.5 hours to each alert.

• The average fully burdened hourly rate for a security FTE is $71.

• Forrester applies an 80% productivity recapture to account for the fact that not all employee time savings are redeployed productively.

Risks. The time savings on responding to false positives will vary depending on:

• The agreed-upon percentage of false positives. Some organizations may work with their security vendors to allow some false positives. Organizations with a higher tolerance for false positives may see a smaller reduction in false positives and therefore smaller time savings.

• The amount of employee time dedicated to responding to each false positive.

• The fully burdened hourly rate of security FTEs.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $293,000.

Legacy Cost Savings

Evidence and data. Interviewees reported two types of cost savings from implementing the GreyMatter platform. First, some said their organizations were able to retire legacy tools, such as standalone SIEM tools, legacy SOAR tools, point solutions for specific tasks like threat intelligence, or underutilized security tools. Second, some interviewees reported that GreyMatter’s universal query language and data stitching capabilities enabled them to correlate data from various sources without needing to store and centralize all the raw data, leading to a significant decrease in data ingest costs. The interviewees reported that, collectively, these cost savings can more than cover the annual cost of GreyMatter.

• The director of security operations at an aerospace organization described how GreyMatter performed better than their legacy tool: “We are saving $100,000 to $150,000 a year, which comes out to savings of 25%. ReliaQuest is doing a much better job [than our legacy vendor]. There is no comparison for about 25% cheaper.”

• In addition to the tool savings, the same interviewee reported that they no longer have to ingest certain data types, leading to additional cost savings: “Some things do not need to go into the SIEM [tool]. [Our whole Defender suite] goes directly to GreyMatter. So that cuts ingest, and we don’t need to worry about it.”

• The CISO at a lighting solutions organization described the cost savings from GreyMatter’s multi-SIEM approach: “Because they do direct API calls on everything, I don’t have to put everything in a SIEM [tool]. … From the calculations we’ve done, we are saving $3.5 million on a yearly basis.”

Modeling and assumptions. After adopting GreyMatter, the composite organization is able to retire a legacy point solution and also reduce its data ingest costs. In Year 1, the composite organization is able to save $810,000. As the deployment becomes more mature, the annual cost savings grow to $900,000 in Years 2 and 3.

Risks. The legacy cost savings will vary depending on:

• The type of security tools deployed in the legacy environment.

• The speed at which organizations are able to retire their legacy tools.

• Whether organizations are subject to regulations that require them to store more of their log data. These organizations may see smaller data ingest cost savings.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $1.9 million.

Unquantified Benefits

Interviewees mentioned the following additional benefits that their organizations experienced but were not able to quantify:

• An improved ability to meet compliance and cybersecurity insurance requirements. Interviewees shared that, prior to implementing GreyMatter, it was increasingly cumbersome to meet regulatory requirements related to data security, incident management, and operational resilience. Additionally, cybersecurity insurance premiums were rising, particularly for organizations with gaps in their security coverage. Because GreyMatter centralizes alert management and threat reporting into a single platform, interviewees noted that GreyMatter helped them more easily meet the requirements set by auditors or cybersecurity insurance providers, allowing them to reduce manual time spent on compliance reporting and potentially helping them avoid premium hikes. The CISO at a lighting solutions organization described the benefit: “It’s becoming more and more clear that we need ReliaQuest for more [regulations], and they are expanding with European standards coming up like NIST 2 and CRA. With these legislations coming up, we have to know what we’re doing, how fast we act, and how fast things are resolved if there’s an incident. I’m already reporting on that now [with ReliaQuest GreyMatter] for certain legislations and certifications.”

• Improved visibility from gaining a single, easy-to-use platform. Interviewees shared that GreyMatter has a simple, user-friendly interface that allows analysts to efficiently monitor their security data, alerts, and potential threats in their environment. Because GreyMatter centralizes data from different security platforms, analysts did not have to switch between different security tools to assess threats or execute response actions, making their entire security environment more navigable. The deputy CISO at a manufacturing firm praised the platform: “The big thing about GreyMatter is that everything is consolidated into one single platform: not just detection but also response and reporting. Everything is in there. … From a measurement and metrics perspective, you can measure so many different things, from detection to response to resolution, because it is all in one centralized platform.”
  Interviewees also lauded GreyMatter’s mobile application, which made it easier for analysts to respond to alerts during off-hours from their phones. The technical security manager at a facilities services firm reported: “They have a feature offering that nobody else had [when we decided to implement GreyMatter], which is to be able to work alerts from their mobile app. That is key for us because people are on call in our department every six or seven weeks.”

• Faster time to value from a quick implementation process. Interviewees reported that ReliaQuest’s team of experts helped them quickly integrate GreyMatter with their organizations’ existing security tools and set up common automation rules. While the deployment of security solutions can take months, interviewees shared that GreyMatter was implemented over the course of weeks, allowing their organizations to quickly see improvements in their security posture and operational efficiency. The director of security operations at an aerospace firm stated: “The GreyMatter architecture allows immediate deployment of hundreds of detection rules right off the bat. You get the added visibility and coverage once the initial deployment is completed, which usually takes three to four weeks.”

• Proactive support from ReliaQuest’s experts. Interviewees reported that ReliaQuest’s team of experts were extremely proactive and helpful in setting up automated response playbooks and recommending improvements to their GreyMatter deployment. Moreover, interviewees stated that ReliaQuest actively solicits and incorporates customer feedback into their platform’s development, ensuring ongoing innovation that directly addresses real-world security challenges. The technical security manager at a facilities services organization described their relationship with ReliaQuest: “Very rarely have I seen a vendor of any kind proactively come to me and say, ‘Let’s do this, let’s do that. We’re looking at your environment, and we can tweak this to make it better.’ … They’re constantly bringing stuff to the table and asking, ‘How do we enhance this experience?’”