SOC Efficiency

Evidence and data. The interviewees shared that Securonix helped reduce the cost of their SOC with built-in functionality that reduced false positives, ease of use that up-leveled junior employees, and efficient federated search capabilities for TDIR.

The Securonix SIEM Platform has built-in whitelisting capabilities, threat intelligence integration, UEBA, and SOAR capabilities. Interviewees noted that combined, these features reduced the number of false positives requiring investigation, which in turn helped their organizations avoid additional SOC hires. The VP of information security at the EMEA healthcare company said: “Securonix enabled us to whittle down 1.4 billion incidents generated monthly to between 200 and 250 incidents. This saves us from having to hire at least seven to eight additional team members.”

Interviewed customers also shared that Securonix was easy to use, with an intuitive user interface, customization capabilities, and streamlined workflows. This enabled junior team members to up-level their work and provide the same level of value as more experienced team members. The VP of information security at the EMEA healthcare company noted, “Securonix is so easy to use that our junior SOC team members can be quickly trained and ramped to do the work of midtier resources, providing us the value of these more experienced resources at lower cost.”

Interviewees reported further cost reduction due to Securonix’s federated search capabilities, which dramatically improved the speed of their search queries and reduced the SOC’s time spent investigating threats. The senior manager of cybersecurity engineering at the pharmaceuticals company shared: “On our prior SIEM, our queries would time out 80% of the time. This would then force the underlying infrastructure to go down multiple times, which would eventually bring the entire application down. With Securonix, our query time-out rate is down to less than 5%.”

The VP of information security at the EMEA healthcare company also noted that cloud-based federated search improved their speed in building use cases. He said: “What matters to me is how quickly we’re getting out logs and how quickly we can build and implement use cases to prevent future incidents. Our prior SIEM took a very long time to collate data to get to the necessary analysis for use cases. Securonix’s cloud-based infrastructure enables this for us in at least half the time.”

Additionally, interviewed customers with a prior SIEM technology found that the Securonix SIEM Platform could replace it, removing the need to pay for and manage that solution while providing more capabilities and value to their organization.

Modeling and assumptions. For the composite organization, Forrester models:

• A SOC team of four employees that includes:

  • Two Level 1 security analysts with an average fully burdened annual salary of $110,000 each.
  • Two Level 2 security analysts with an average fully burdened annual salary of $160,000 each.
  • One Level 3 security analyst with an average fully burdened annual salary of $190,000.

• Compared to the organization’s prior SIEM, Securonix reduces false positives by 80%.

• The reduction in false positives allows the composite to avoid 60% of its SOC team size in additional hires (three FTEs).

• Securonix’s ease of use enables the composite’s Level 1 security analysts to provide the value of Level 2 security analysts, saving the company the 45% higher wage it would have to pay new Level 2 hires for the same value-add.

• The SOC previously spent 1,800 hours annually on search queries and 84 hours annually on building use cases. With Securonix, the SOC’s time spent searching decreases by 60%, and its spent time building use cases decreases by 40%.

• The composite achieves 50% of these benefits in Year 1 due to the SOC team ramping up. In Years 2 and 3, the composite receives 100% of the benefit.

• The composite decommissions its legacy SIEM in favor of Securonix, saving $150,000 annually on licensing costs and $190,000 annually on management costs.

Risks. The amount of SOC cost reduction will vary with:

• The current SOC team size and its projected growth due to security alert and incident increases.

• The number of Level 1 security analysts able to level up to Level 2 security analyst work.

• The prior time spent conducting search queries and building use cases.

• The average fully burdened annual salary for a SOC team member.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $1.8 million.

Risk Savings

Evidence and data. Securonix helped interviewees save on security risk-related costs by reducing the cost of their cyber insurance policies and the risk of security incidents.

Regarding cyber insurance, customers noted that the ability to gather their organization’s threat data in one place and easily access and search that data enabled them to demonstrate a detailed view of their security posture to potential insurance providers. They could also leverage Securonix’s data ingestion, access, and search to build strategic plans for additional security improvements, which further assuaged insurance providers’ concerns about cybersecurity incident risks. One customer reported saving 26% on their policy costs after implementing Securonix.

In security incident risk, interviewed customers noted that the additional information Securonix’s SIEM Platform contains out of the box, including built-in use cases, industry-specific use cases, threat intelligence data, UEBA, and SOAR, all helped to reduce the risk of a security incident by up to 80% compared to their prior environment.

Modeling and assumptions. For the composite organization, Forrester models:

• A prior annual cost of cyber insurance of $300,000.

• A conservative 10% reduction in policy costs due to the Securonix SIEM Platform.

• An average unauthorized access incident cost of $1,147,740, composed of an average incident cost multiplied by the percentage of incidents involving external access.²

• A likelihood of an unauthorized access incident of 65%.³

• A reduction in unauthorized access incident risk of 80%, with much of this due to the inclusion of UEBA.

• A benefit ramp of 50% in Year 1, with 100% of benefits achieved by Year 2.

Risks. Risk savings may vary with:

• The difference in visibility into the customer’s security environment and understanding of attack vectors before and after implementing Securonix.

• The ability of the customer to negotiate a better rate with their cyber insurance provider.

• The industry and size of the organization, which impact the cost of a security incident, annual breakdown of incident types, and the likelihood of any type of incident.

Results. To account for these risks, Forrester adjusted this benefit downward by 20%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $1 million.

Compliance Savings

Evidence and data. Securonix further benefited the interviewees’ organizations by helping avoid or reduce costs associated with regulations and compliance. Customers reported that Securonix helped avoid regulatory penalties and improved their SOC team’s efficiency in responding to audits and regulatory requests.

Regarding avoided regulatory penalties, the VP of information security at the EMEA healthcare company shared: “Securonix made it easy for us to have all our events and regulatory due diligence in one place, proving to auditors and regulators that we are acting in accordance with regulations. In the past couple of years, we protected ourselves against eight or nine incidents which could have easily resulted in $2 million in regulatory penalties if not for Securonix.”

The same customer shared that Securonix reduced the time their SOC team spent on audits thanks again to Securonix’s use of cloud-based federated search. He said: “As a healthcare provider, we undergo around 10 audits each year. Log collection for these audits was always burdensome, taking time from our team that could have been used on strengthening our security posture. Securonix has reduced the time the team spends on log collection for our audits by 70%, allowing them more time to advance our strategy.”

Modeling and assumptions. For the composite organization, Forrester models:

• A $12 million potential annual cost of regulatory penalties.

• A 25% potential of receiving these regulatory penalties before Securonix.

• A 10% to 15% reduction in the potential for receiving these regulatory penalties due to Securonix.

• Four annual audits.

• Thirty-two hours to collect logs for each audit before Securonix.

• A conservative 40% reduction in log collection time with Securonix.

• The composite solely uses their Level 1 resources for audit log collection.

• A benefit ramp of 50% in Year 1, with 100% of benefits achieved by Year 2.

Risks. Total regulatory savings will vary with:

• The total potential annual penalties and the likelihood of receiving these penalties.

• The total number of hours required for audit log collection and the mix of resources used to conduct audit log collection.

Results. To account for these risks, Forrester adjusted this benefit downward by 20%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $622,000.

Unquantified Benefits

Interviewees mentioned the following additional benefits that their organizations experienced but were not able to quantify:

• Improved analyst experience. Interviewed customers shared that Securonix improved their SOC teams’ experience by reducing the number of false positives they had to investigate; improving the time spent running TDIR processes due to fast federated search, built-in use cases, and more efficient custom use-case building; and enabling junior employees to add more value than before. Combined, these benefits allowed SOC team members to think and act at a higher, strategic level rather than just triaging alerts.

• Skilled implementation and support. Interviewed customers praised Securonix for the support they received throughout their contract. Customers noted that Securonix’s implementation team was very skilled and easily handled platform setup and deployment in a complex technological environment. They also shared feeling “spoiled” at the availability of Securonix’s support team and that any issues were always resolved quickly.

Flexibility

The value of flexibility is unique to each customer. There are multiple scenarios in which a customer might implement the Securonix SIEM Platform and later realize additional uses and business opportunities, including:

• Improved visibility. Customers noted that Securonix’s platform improved visibility by ingesting more data thanks to its numerous cloud connectors and improving access to this data via fast federated search. This increased visibility led to an improved understanding of the organizations’ security postures and bettered their leaderships’ abilities to make effective, strategic security decisions.

• Industry-specific use cases. Customers also shared that Securonix has built-in use cases for responding to threats that are industry specific. Not only does this help to improve security posture and incident response from Day 1, but it also ensures that customers remain up to date with the shifting attack vectors and regulatory demands specific to their industries, while focusing on their daily work.

Flexibility would also be quantified when evaluated as part of a specific project (described in more detail in Total Economic Impact Approach).