di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Explore Deep Instinct DSX

Prevent Zero-Day Attacks

Real-Time Malicious Verdicts

Real-Time Explainability

Lower TCO

Ensure Privacy & Compliance

Deep Instinct DSX

Cloud

Applications

Endpoints

Use Cases

Asset Library

Blog

Videos

Events & Webinars

Resources

About Deep Instinct

Our Customers

Newsroom

Careers

Contact Us

Company

Free Scan

Customer Portal

Integrations and Compliance

Training

Quick Links

Discover how our revolutionary deep learning-powered solution prevents and explains unknown, never-before-seen threats.

explore deep instinct dsx

why dsx

Prevent zero-day attacks

Detect and prevent threats in <20ms, faster than the blink of an eye.

real-time malicious verdicts

Gain actionable, AI-driven intelligence on zero-day threats in seconds.

Real-Time Insights & Explainability

Reduce cybersecurity costs with efficient, high-performance threat prevention.

Enhance data protection while meeting stringent privacy and regulatory requirements.

DSX USE CASES

Scan and secure your S3 buckets and prevent threats to your data with this natively integrated and certified solution.

Amazon S3

Secure files and empower your hybrid-cloud with natively integrated preemptive data security.

Amazon FSx for NetApp

Protect your NetApp ONTAP storage with a purpose-built solution designed to prevent zero-day threats targeting NAS.

NetApp

Stop attackers from breaching your Dell EMC NAS with our purpose-built, natively integrated solution.

Dell EMC

Integrate scanning with your middleware layer to secure your applications with greater stability and customization.

Middleware

Ensure the files moving through your environment remain malware-free, without introducing bottlenecks or slowdowns.

Secure File Transfer

DEPLOYMENT TYPES

Secure your multi-cloud or hybrid infrastructure against zero-day threats.

CLOUD

Safeguard critical data on Network-Attached Storage systems from advanced cyber threats.

Defend SaaS and custom applications from zero-day vulnerabilities and threats.

APPLICATIONS

Protect devices and endpoints with AI-driven threat prevention.

ENDPOINTS

EXPLORE 

Threat Research

Voice Of SecOps

COMPARE

Deep Instinct complements Microsoft Defender with advanced threat prevention to stop threats before they enter your environment.

+ Microsoft Defender

Deep Instinct and Tanium deliver prevention-first endpoint security to reduce risk and boost productivity.

+ Tanium

EDR is not enough — enhance existing cybersecurity tools with advanced, real-time threat prevention using deep learning to produce defense in depth.

EXTEND/ENHANCE EDR

Replace outdated, legacy AV solutions with prevention-first, deep-learning-based protection purpose-built for cybersecurity.

REPLACE LEGACY AV

Faster and more accurate – Deep Instinct safeguards your data and protects your NAS storage better than Trellix.

REPLACE TRELLIX

Faster and more effective – Deep Instinct safeguards your data and protects your NAS storage better than Symantec.

REPLACE SYMANTEC

Leadership Team

Board of Directors

Partners

Login

content_block

Perspective & Findings

<h4>Don’t Let Application File Uploads Become Malware Downloads</h4>

file-upload-security-blog.jpg

Recent Blog Posts

Listing preview

Perspective & Findings

image_media_card

Recent Blog Posts

listing_preview

BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game

Who is the only NEW vendor in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms?

ChatGPT and Malware: Making Your Malicious Wishes Come True

Top-3 Drawbacks of Content Disarm + Reconstruction (CDR) for Malware Prevention

LSASS Memory Dumps are Stealthier than Ever Before

LSASS memory dumps

Trending at Deep Instinct

carousel_cards

DI_Trellix_Blog.png

<h2>Deep Instinct wins in efficacy, scalability, speed, and total cost of ownership</h2>Enterprise data storage has become a lucrative attack vector for cybercriminals. The explosive growth of data, especially for large financial institutions that have deep stores of sensitive material, has made them attractive targets. Banks face numerous challenges in securing their storage environments, including the following:<ol><li>An ever-evolving threat landscape: Cybercriminals are constantly developing new and more sophisticated methods to infiltrate storage systems, particularly with the emergence of generative AI and LLM-aided malware tools.</li><li>Performance and latency issues: Traditional security solutions often struggle to efficiently scan large volumes of data without impacting system performance and causing unacceptable latency.</li><li>High infrastructure costs: Infrastructure costs can be expensive because of the sheer number of servers required to scan storage data.</li><li>Complexity of deployment and management: Implementing and managing storage security solutions can be cumbersome, especially when using products not purpose-built for the task.</li></ol>Deep Instinct, a leading provider of <a href="https://www.deepinstinct.com/why-deep-instinct">deep learning-based cybersecurity solutions</a>, recently had the opportunity to prove the value of its data storage protection capabilities to a top-five global bank facing these challenges. The bank needed a solution to secure its network attached storage (NAS) against the growing threat of ransomware and other malware. Deep Instinct’s prevention-first approach was especially intriguing.<h5>Bank puts Deep Instinct and Trellix head-to-head</h5>They evaluated <a href="https://www.deepinstinct.com/prevention-for-storage">Deep Instinct Prevention for Storage (DPS)</a> head-to-head against the incumbent, Trellix ENS (Endpoint Security). Trellix had been struggling to complete scans within designated maintenance windows, and the bank wanted to reduce its total infrastructure spend from running over 3,200 scanning servers while strengthening overall storage security.<blockquote>The bank compared DPS and Trellix across several key criteria: efficacy, scalability, scan speed, ease of deployment &amp; operation, and TCO. The evaluation used the latest versions of both products under identical conditions — the same hardware, network speed, and data set.</blockquote>Here are the results of the comparison.Efficacy: In the evaluation, Deep Instinct prevented &gt;99% of known and unknown threats across multiple file types and sizes. Trellix, on the other hand, had much lower efficacy. Additionally, Deep Instinct had a significantly lower false positive rate, enabling the bank’s security team to focus on real threats instead of chasing false positives.Scalability/Speed: DPS outperformed Trellix in terms of performance and scan speed, scanning files ~10x faster, on average. This is a significant advantage in network attached storage environments with inherent latency, as our local deep learning models don’t require cloud calls, making it extremely efficient. DPS’s remarkable speed enables full-volume scans that weren’t feasible with Trellix.Ease of Deployment: The bank gave high marks to DPS for ease of deployment and operation because it is purpose-built for storage security. This includes streamlined implementation and management, intuitive policy configuration, scan stats, and visibility. In contrast, Trellix ENS is essentially an endpoint security product repurposed for storage, making deployment and management cumbersome.Total Cost of Ownership: Based on the performance data, the bank determined that it could secure its storage environment with ~500 DPS servers versus the ~3,200 required by Trellix, an astonishing reduction of ~2,700 servers while offering superior, prevention-first cybersecurity. This reduction has a significant ROI upside — worth millions in infrastructure and licensing costs.<h5>The switch to Deep Instinct</h5>Upon completion of the head-to-head evaluation, the choice was clear: the bank decided to replace its Trellix solution and standardize on Deep Instinct Prevention for Storage across its NAS infrastructure.Here’s why. DPS is tough to beat for organizations securing their storage systems and data against known and unknown threats without compromising performance or driving up costs. It is purpose-built for storage and <a href="https://www.deepinstinct.com/why-deep-instinct">powered by a static analysis engine based on deep learning</a>, delivering unmatched efficacy, speed, efficiency, and ease of use.The hype around Deep Instinct’s cyberstorage offering is real — and is now validated in one of the world's largest and most demanding enterprise environments.<a href="https://info.deepinstinct.com/request-a-demo" target="_self">Request a demo</a> with us to see it for yourself.

Deep Instinct vs. Trellix: A Banking Giant Cyberstorage Bakeoff

Blog Image - Not All AI is Equal

<h2>Preventing Cyber Threats Requires Deep Learning, Not Just AI</h2>The rapid advancement of artificial intelligence (AI) is fundamentally reshaping the cybersecurity landscape. On one hand, AI-powered tools hold tremendous potential for automating threat detection and making security teams more efficient. However, these same technologies also empower threat actors to create increasingly sophisticated and hard-to-detect attacks. Organizations now face a critical challenge: leveraging “good” AI while also defending against this new breed of “bad” AI.On the positive side, AI can automate threat monitoring, reduce human error, and give time back to security operations (SOC) teams who are underwater chasing alerts, making prevention and detection more effective and efficient. Recent reports found that false positives from antiquated cybersecurity tools significantly strain these team members’ time, accounting for <a href="https://www.deepinstinct.com/voice-of-secops-reports">over two working days of lost productivity</a> per week.Conversely, AI makes it much easier for bad actors to create and manipulate malware that continuously changes to evade detection from traditional cyber tools – like <a href="https://www.deepinstinct.com/deep-instinct-vs-competitors">legacy Anti-Virus (AV)</a> – and steal sensitive data. According to the <a href="https://www.verizon.com/business/resources/reports/dbir/#industry-reports">Verizon 2023 Data Breach Investigation Report</a>, the success rate for attacks has escalated to more than 30% due to threat actors’ use of AI. These advancements in attack methods and the harsh realities of AI are making existing security measures obsolete.The potential for unlocking competitive advantage led <a href="https://www.deepinstinct.com/voice-of-secops-reports">69% of organizations</a> last year to adopt generative AI tools. However, with so much on the line, organizations need to understand the risks and limitations of AI and what’s required to get ahead of adversaries and predict advanced cyber threats.<h5>Evaluating the Challenges and Limitations of AI</h5>With the widespread availability of generative AI, new cyber threats are emerging daily, and much faster than in previous years. Recent examples include hyper-realistic deepfakes and phishing attacks. Threat actors are using tools like ChatGPT to craft well-written and grammatically correct emails, videos, and images that are difficult for spam filters and readers/viewers to catch. We’ve seen popular reports of deepfakes using high-profile figures such as <a href="https://streaklinks.com/BwzsOuG8vB-hEI-DrQZ7iCcv/https%3A%2F%2Fapnews.com%2Farticle%2Ffact-check-kelly-clarkson-weight-loss-gummies-702026826728%23%3A~%3Atext%3DCLAIM%253A%2520A%2520video%2520on%2520Kelly%2Cpromotions%2520for%2520the%2520diet%2520product.?email=kjohnson%40inkhouse.com">Kelly Clarkson</a>, <a href="https://fortune.com/2019/06/12/deepfake-mark-zuckerberg/">Mark Zuckerberg</a>, and <a href="https://fortune.com/2024/01/30/ai-policing-taylor-swift-porn-deepfakes-porn/">Taylor Swift</a>. We also saw <a href="https://www.cnn.com/2024/02/04/asia/deepfake-cfo-scam-hong-kong-intl-hnk/index.html">a hacker posing as a CFO</a> trick a finance worker at a multinational firm into transferring $25 million.Concerns with the use of large language models extend beyond phishing and social engineering techniques. There are widespread concerns about the unintended consequences of companies using these generative AI tools in typical business scenarios. For example, after a recent <a href="https://www.forbes.com/sites/siladityaray/2023/05/02/samsung-bans-chatgpt-and-other-chatbots-for-employees-after-sensitive-code-leak/?sh=73e2b17f6078">Samsung</a> breach, the company banned ChatGPT and other AI-based tools among its employees to cut back on potential security gaps if the technology – and the sensitive data shared on these platforms – were to fall into the wrong hands. In the Samsung case, a crackdown occurred after an accidental leak of sensitive internal source code was uploaded to ChatGPT by an engineer.We’re seeing similar complications with threat actors using tools like FraudGPT, WormGPT, and EvilGPT opening advanced attack techniques up to a broader audience of less sophisticated users. With these tools, a cybercriminal can perform an array of tasks to write new malware code, reverse engineer existing code, and identify vulnerabilities to generate novel attack vectors.&nbsp;As threat actors use AI to make their attacks smarter, stealthier, and quicker, we’ve seen more and more organizations deploy new solutions that tout AI capabilities. However, <a href="https://www.deepinstinct.com/blog/are-your-cybersecurity-vendors-really-fighting-ai-with-ai-">not all AI is created equal</a>, creating limitations with many solutions that claim to be powered by AI. Advanced adversarial AI can’t be defeated with basic machine learning (ML), the type of technology most vendors are leveraging and promoting (and calling it AI, generically). The cybersecurity community needs to shift away from a reactive, “assume breach” approach and turn to one focused on prevention.&nbsp;Furthermore, we’ve reached the notable <a href="https://www.idc.com/getdoc.jsp?containerId=US49349323">end of the Endpoint Detection and Response (EDR) honeymoon period.</a> EDR is too outdated, reactive, and ineffective against today’s sophisticated, adversarial AI-driven cyber threats. Most cybersecurity tools leverage ML models that present several shortcomings. For example, they are trained on limited subsets of available data (typically 2-5%), offer just 50-70% accuracy with unknown threats, and introduce an avalanche of false positives. ML solutions also require heavy human intervention and are trained on small data sets, exposing them to human bias and error.We’ve entered a pivotal time in the evolution of cybersecurity, one that can only be resolved by fighting AI with better, more advanced AI.<blockquote>“In this new era of generative AI, the only way to combat emerging AI threats is by using advanced AI – one that can prevent and predict unknown threats. Relying on antiquated tools like EDR is the equivalent of fighting a five-alarm fire with a garden hose. Assuming breach has been an accepted stance but the belief that EDR can get out ahead of threats is simply not true. A shift toward predictive prevention for data security is required to remain ahead of vulnerabilities, limit false positives, and alleviate security team stress.” -- <a href="https://www.deepinstinct.com/voice-of-secops-reports" target="_self">Voice of SecOps, 4th Edition 2023, The Power of Deep Learning</a></blockquote><h5>The Power of Deep Learning</h5>Due to AI advancements, we can now prevent ransomware and other cyber attacks rather than detect and respond to them afterward. Deep Learning (DL) is the most advanced form of AI and is the only way to deliver true prevention. When applied to cybersecurity, DL trains its neural networks to autonomously predict threats to prevent known and unknown malware, ransomware, and zero-day attacks.Traditional AI can’t keep pace with the sheer volume of data entering an organization. It only leverages a portion of the data to make high-level business decisions. With DL, data is never discarded, making it much more accurate and enabling it to predict and prevent known and unknown threats quickly.There are less than a dozen major DL frameworks in the world – and only one is dedicated fully to cybersecurity: the <a href="/platform" target="_self">Deep Instinct Prevention Platform</a>. It continuously <a href="https://www.deepinstinct.com/blog/congratulations-now-smarter-than-ever-we-got-a-new-brain">trains</a><a href="https://www.deepinstinct.com/blog/congratulations-now-smarter-than-ever-we-got-a-new-brain"> itself on millions of raw data points</a>, becoming more accurate and intelligent over time. Because DL models understand the building blocks of malicious files, it makes it possible to implement and deploy a predictive prevention-based security solution. This allows savvy cybersecurity teams to shift from an outdated “assume breach” mentality to a predictive prevention approach.Only deep learning has the power to match the speed and agility of this next-gen adversarial AI.

Watch Deep Learning Explainer

AI, Machine Learning and Deep Learning: What They Are and Why They Are Different?

Deep Instinct Provides Broad Protection Without Human Intervention

Solution-EPP-Reduce-Risk-Deep-Learning.svg

<h5>AI and the End of the "Assume Breach" Mentality</h5>2023 was the year when we saw AI burst onto the scene; 2024 will be the year AI alters the way threat actors create and deploy cyber-attacks, forcing organizations to emphasize prevention.At Deep Instinct, we firmly believe that the “assume breach” mentality is ineffective and extremely destructive to organizations. Businesses can – and should – protect themselves from advanced forms of attacks by leveraging a more sophisticated form of AI, such as deep learning, to fight against AI-driven threats.For more information about <a href="https://www.deepinstinct.com/blog/mit-explores-how-deep-learning-is-transforming-cybersecurity">how deep learning is transforming cybersecurity</a>, read our blog post.

Why All AI Isn’t Created Equally in Cybersecurity

Blog Image - 2024-predictions.png

Over the past 12 months, we have seen rapid changes in the cybersecurity landscape—and there are no signs of it slowing down in 2024. In fact, in our most <a href="https://www.deepinstinct.com/cyber-threat-reports">recent Cyber Threat Report</a>, we found that the total number of ransomware victims in 2023 increased significantly, with more victims in the first half of 2023 than in all of 2022.Attacks themselves were also more disruptive—the MOVEit data breach leaked the personal information of up to 11 million people while the FBI struggled to stop the cybergang behind the attacks on MGM and Caesars Entertainment. With sophisticated cyberattacks and techniques like <a href="https://www.deepinstinct.com/ransomware-protection-solution">ransomware</a>, <a href="https://www.deepinstinct.com/zero-day-attacks">zero-day exploits</a>, and other never-before-seen threats increasing, the status quo, “assume breach” mindset needs to get crushed in 2024.As we kick off 2024, members of our executive leadership team, including CEO Lane Bess, CPO Yariv Fishman, and CIO Carl Froggett, share their outlook on the new year and the relevant themes to keep a close eye on. This includes the shift to a prevention-first mindset, the impacts of AI on security, and a heightened awareness of vulnerable attack vectors.<h5>The Year of the Prevention-first Mindset</h5><a href="https://www.computerweekly.com/microscope/opinion/How-can-security-vendors-react-to-the-growing-AI-threat">TechTarget</a> shared Fishman’s perspective that this year we’ll see the “assume breach” mindset finally shift to prevention first.“Since the dawn of cybersecurity, organizations have operated with a ‘detect and respond’ approach to breaches. This also meant that they had an ‘assume breach’ mentality. The rapid advances in AI mark a turning point for organizations and the end of the Endpoint Detection and Response (EDR) honeymoon period, making way for a focus on prevention. It's high time to eliminate the ‘assume breach’ status quo. In 2024, organizations will start shifting towards a prevention-first mindset, utilizing Deep Learning (DL), the most advanced form of AI, which allows for increased prevention capabilities, reduction of Total Cost of Ownership (TCO), and tools to block and prevent future adversarial AI cyber-attacks.”Bess predicts that prevention will become a board-level imperative.“As cybersecurity becomes a critical topic amongst the C-suite in 2024, boards will prioritize threat prevention. There’s currently a board-level mandate for organizations to have detection and response capabilities within their security plans and portfolios; however, in the coming years, there will also be a prevention strategy mandate.”Bess strongly believes prevention against cyber attacks is possible, and agrees with Fishman that it requires a shift away from the status quo, “assume breach” mentality that has plagued the industry for far too long.<h5>The Impacts of AI on the Security Industry</h5><a href="https://www.computerweekly.com/microscope/opinion/How-can-security-vendors-react-to-the-growing-AI-threat">Fishman</a> foresees that adversarial AI will skyrocket in the new year.“Large Language Models (LLMs) hold a lot of promise—but they are nowhere near their maximum potential. In 2024, as public LLMs become more accurate and powerful, we'll simultaneously see an uptick in adversarial AI. LLMs can already perform standalone vulnerability research, exploit implementation, and execute attacks, including custom obfuscation and malware builders like never before. Existing tools have proven they cannot address zero-day threats, creating the need to fight AI with AI—specifically, a more advanced form of it, deep learning (DL). Only DL, the most sophisticated form of AI, is best positioned to combat these zero-day Adversarial AI threats.”Furthermore, the cybersecurity market will continue to consolidate, with AI being a catalyst for increased M&amp;A investments and innovation, as predicted by Bess.“The cybersecurity market is overcrowded with point solutions. In 2024, we’ll continue to see the larger platform players extend their capabilities via acquisition. The ideal targets are smaller security companies with great technology, especially advanced AI and ML capabilities that aren’t scaling year over year. Cybersecurity companies that solve significant problems in the industry will continue to thrive.”Lastly, quantum computing will continue to collide with AI, causing destruction, according to Froggett in a conversation with <a href="https://betanews.com/2023/12/21/faster-problem-solving-more-investment-and-time-travel-attacks-quantum-predictions-for-2024/">BetaNews</a>.“While there are still a lot of unknowns, the intersection of quantum computing and AI will take the cybersecurity and tech industry by storm—and blow traditional computing capabilities out of the water. Quantum computing is likely to become disruptive—if not destructive—the more it integrates with AI and gets into the hands of bad actors. Recently, the Cybersecurity and Infrastructure Security Agency, the National Security Agency, and the National Institute of Standards and Technology published a quantum ‘<a href="https://www.cisa.gov/news-events/news/cisa-nsa-and-nist-publish-new-resource-migrating-post-quantum-cryptography">fact sheet</a>’ to help industries prepare now for the inevitable future—which is coming sooner than we think.”<h5>A Heightened Awareness of Vulnerable Attack Vectors</h5>According to Bess, a heightened awareness of data in motion and at rest as a vulnerable attack vector will emerge.“Storage and cloud solution vendors will become more ambitious in ensuring their solutions offer adequate protection. Up until now, this has been the focus of the CISO within the enterprise. Moving forward, storage-focused decision-makers will join forces with their security counterparts to ensure the enterprise is secure from data breaches, and storage providers will shift to focus on offering security solutions.”Furthermore, Froggett predicts bad actors will leverage hyper-realistic deepfakes to breach organizations.“In 2023, threat actors manipulated AI to deploy more sophisticated malware and ransomware, as well as hyper-realistic deepfake and phishing campaigns. We’ve seen this in action with the MGM breach involving social engineering, as well as high-profile figure <a href="https://streaklinks.com/Bu2xRowFxfM3G2cTvw32Thxw/https%3A%2F%2Fapnews.com%2Farticle%2Ffact-check-kelly-clarkson-weight-loss-gummies-702026826728%23%3A~%3Atext%3DCLAIM%253A%2520A%2520video%2520on%2520Kelly%2Cpromotions%2520for%2520the%2520diet%2520product.?email=pditoppa%40inkhouse.com">Kelly Clarkson</a> being mimicked through deepfake technology. In 2024, bad actors will take these attack techniques to a new level, enacting more holistic end-to-end campaigns through AI and automation. As a result, traditional cybersecurity approaches to defend against these campaigns, including information security training and awareness, will need to be significantly updated, refreshed, or totally revamped.”While the road to an optimal security posture presents challenges in the year ahead, it also reveals solutions to protect a company’s greatest assets. By facing these challenges head-on and working to achieve a prevention-first approach to cybersecurity, companies can successfully work to protect against malicious actors and keep themselves safe and secure this new year.Be sure to follow the Deep Instinct blog for additional insights on emerging threats and solutions to overcome them as highlighted by the threat research team.

New Year, New Prevention-First Security Mindset: Predictions for 2024

There is a contentious relationship between budgets and cybersecurity.

General consensus has it that bigger budgets equate to better security, but 

cost-of-a-data-breach.png

There is a contentious relationship between budgets and cybersecurity.
General consensus has it that bigger budgets equate to better security, but undoubtedly the security analysts at Desjardins Group would beg to differ. The Canadian lender revealed that it had spent $70 million CAD on its security operations prior to an attack that ended up exposing the personal data of 2.9 million of its members.
A <a href="https://www.csoonline.com/article/3434601/what-is-the-cost-of-a-data-breach.html#:~:text=The%20average%20cost%20of%20a,over%20the%20last%20five%20years." target="_blank" rel="noopener">report conducted by the Ponemon Institute</a> confirmed the upward path in the cost of a data breach, that in 2020 was at $3.86 million. While the impact of suffering from a cyber-attack remains high for all companies, irrespective of how big they are, where they are or what they do, the report did confirm that companies can exert some control in managing the cost of a data breach.
Interestingly, the study found that while there has been a 10% rise in cybersecurity costs over the last five years, 2019 saw a decrease in costs by 1.5%. The researchers attributed this decrease to companies who had taken effective precautions and processes, which contributed to coming out of 2020 relatively unscathed, and yet still in budget.
&nbsp;
<h3>The Costs of a Data Breach that can be Controlled</h3>
Depending on the configuration of a SOC, there are numerous aspects where the costs can be kept under control with the right combination of technological capabilities and processes.
<ul>
<li>Time Managing Endpoint Protection</li>
</ul>
This cost is born out of inordinate management overhead due to the use of multiple endpoint products, burdensome maintenance work, constant updates, and patching required. SOC teams should seek out <a href="https://www.deepinstinct.com/product-overview/" target="_blank" rel="noopener">cybersecurity solutions</a> that have wide platform play and provide protection across different devices, OS, and environments. They should require only the occasional update (ideally, just once or twice a year). This relieves SecOps employees of many of these manual and mundane processes.
&nbsp;
<ul>
<li>Time Investigating Endpoint Threats</li>
</ul>
This includes costs associated with the manual investigation of alerts and addressing false positives. Activities redressing alerts that are ultimately found to be benign, conducting triages and threat hunting activities contribute to a significant consumption in security analysts’ time. To address this security analysts should be using solutions that provide a high degree of detection accuracy (best-in-breed is a 99% and a 0.1% false-positive rate). Also, when considering a new vendor solution, it’s worthwhile to check what manual processes are automated and the degree to which <a href="https://www.deepinstinct.com/automatic-threat-analysis/" target="_blank" rel="noopener">threat analysis</a> is provided in bite size actionable slices.
&nbsp;
<ul>
<li>Time Remediating Endpoint Attacks</li>
</ul>
This cost includes all the activities undertaken by security engineers in remediating endpoint attacks, such as restoring from back-ups, re-imaging machines, and so on. The coronavirus pandemic upscaled the risk profile of endpoint attacks, not only due to the increase in attempted attacks but also due to added difficulties of remediating attacks on a remote workforce. As the perimeter no longer really exists anymore, SecOps need to refocus their attention on where events are occurring, and that is on the endpoint.
&nbsp;
<ul>
<li>Minimizing the financial loss due to user downtime</li>
</ul>
Endpoint attacks not only create remediation work for an organization’s IT security analysts, but they also impact the productivity of affected employees with the result of causing an organization even further financial loss. With employees working remotely, COVID-19 even further amplified the detrimental impact of an attack. Over the course of the pandemic, average user downtime per endpoint attack went up to 12 hours, as now the affected employee would have to cease work until they were able to obtain a replacement computer and set it up for usage. One of the ways SecOps can minimize the impact of these consequences of being breached is by retiring legacy solutions. Whether it be a legacy EDR or anti-malware software, these solutions simply cannot keep up with the modern threat landscape.
&nbsp;
<ul>
<li>Minimizing Likelihood of a Material Breach</li>
</ul>
Weaknesses in vendor products combined with a remotely located workforce that make it difficult to define the norm in user behavior, create loopholes for attackers to gain a foothold within an organization, especially through endpoint devices. By establishing a security operation that is not constantly flooded with alerts and overwhelmed by investigation activities help to close this window of opportunity. Eliminating alert fatigue allows security operations to pounce on the fewer threats that may manage to still get through.
Beyond these costs, there are also harder to quantify sources of financial loss to business operations. The non-direct impact of a security breach can include brand reputation damage, customer attrition, regulatory fines, customer reacquisition costs, and compensation payouts.
&nbsp;
<h3>Avoiding a Budgetary Journey to Bust</h3>
Despite the multiple moving parts that contribute to the cost-efficiency of a cybersecurity operation, with the right combination of technology, automation and optimal processes, the cost of securing an organization can be brought down. A <a href="https://info.deepinstinct.com/en/mof/deep-instinct-tei-study" target="_blank" rel="noopener">Forrester Total Economic Impact Study</a> found that customers of Deep Instinct were able to reduce their costs by 446%. The study which compiled the responses of customers into a representative organization of 7,000 endpoints managed by a SecOps team of 15 employees, calculated that they were able to reduce security operation costs by $3.5 million.
A break-down of the cost savings for each of the elements listed above can be found here:
<img class="alignnone wp-image-10307 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltec2a9521525815ed/611a79d8005cd416221b4b23/cost-of-a-breach-pie-chart.jpg" alt="" width="716" height="416" />
Figures are indicated in terms of thousands of dollars. The biggest cost saving was $1,300 million in time saved in threat investigation work, retiring legacy solutions was another big cost-saver at $860.7K.
Through the investment in <a href="https://www.deepinstinct.com/" target="_blank" rel="noopener">Deep Instinct</a>, the interviewed customers reported both quantitative and qualitative benefits against the backdrop of enhanced endpoint security. The early prevention through deep-learning predictive algorithms meant that the representative organization was able to prevent more attacks from occurring pre-emptively, they were able to get better visibility and control over the far fewer attacks that still managed to slip through, and SecOps employees were able to reallocate their time towards higher-value tasks and projects. The implementation of Deep Instinct reduced the number of false positives by 99% and significantly alleviated the workload placed on SecOps.
To learn more about how these customers were able to optimize their cybersecurity environment and put their budgetary figures in the green, we recommend <a href="https://info.deepinstinct.com/en/mof/deep-instinct-tei-study" target="_blank" rel="noopener">checking out the full Deep Instinct TEI Study</a>.

How Companies are Successfully Bringing Down the Cost of a Data Breach

With the advancement of technology and artificial intelligence in the 21st century, AI applications are being introduced in a myriad of sectors. Parti

shutterstock_394552096-1.jpg

With the advancement of technology and artificial intelligence in the 21st century, AI applications are being introduced in a myriad of sectors. Particularly in the Covid era, digital transformation has been rapid in many sectors that are not yet equipped to deal with advanced and increasing cyber threats, putting valuable digital assets at risk of malicious AI attacks.To cope with these increased threats, an efficient Advanced Threat Protection (ATP) security system is required that can filter malicious breaches and prevent user data from falling into the wrong hands. ATP security is an <a href="https://www.deepinstinct.com/product-overview/" target="_blank" rel="noopener">advanced malware protection</a> system designed to protect sensitive data from complex and malicious <a href="https://www.deepinstinct.com/2019/05/19/how-ai-can-be-used-for-malicious-purposes/" target="_blank" rel="noopener">AI malware attacks</a>.Among ATP security solutions are <a href="https://www.deepinstinct.com/product-overview/" target="_blank" rel="noopener">artificial intelligence antivirus products</a> that are purposed to protect organizations to achieve ongoing security of digital assets and valuable data. Different vendors have introduced highly innovative <a href="https://www.deepinstinct.com/endpoint-protection/" target="_blank" rel="noopener">endpoint security platforms</a> to help users improve organizational and corporate digital security. ATP Security provides the best adaptive system for organizations to deal with various cyber-attacks and malware, providing detection and prevention before a cyber attack strikes. By taking a preventative approach, files are analyzed before they get the chance to execute, keeping the risk profile of an organization as low as possible, while easing the endpoint management of the threats that still manage to get through.&nbsp;<h3>How Does ATP Security Work?</h3>Despite their focus on preventing cyber threats, ATP security solutions should address the entire cybersecurity protection lifecycle, from prevention, detection and response, and finally remediation. It has three main goals.<ol><li>Early detection: It scans for access vulnerabilities to critical data before the risks are noticed</li></ol><ol><li>Swift defense: Automatically scans all files to defend against AI-based malware attacks.</li><li>Response:&nbsp; Proactive response&nbsp;to mitigate risks and respond to offensive events.</li></ol>To achieve these goals an ATP security solution will need several components and functions. Such as;Real-time visibility:Provides real-time visibility into events occurring behind your network programs. Without real-time visibility, it will be too late to detect attacks before the damage is already done.Deep Learning capabilities:&nbsp;Ideally, the ATP operation should involve an automated deep learning algorithm that can detect and prevent not just known malware, but more importantly new, never-seen-before malware variants.Data awareness:The system must be aware of data sensitivity, value, and other factors, to determine risk severity and respond accordingly.Further study may be required when a risk is found. The ATP's security services typically handle risk analysis and enable the business to carry on as usual with minimal downtime. File analysis, minimizing threat surfaces, and detection and response functions are all carried on behind the scenes.&nbsp;<h3>Key Features of an ATP Operation:</h3>ATP products have various features that make them stand out from traditional detection or antivirus products. Some of their key features are:Automatic File Analysis:The most important feature is to combat and deal with imminent threats swiftly. ATP products monitor data traffic and <a href="https://www.deepinstinct.com/zero-day-attacks" target="_self">prevent zero-day attacks</a> with strong artificial intelligence deep learning models. They analyze data in real-time to automatically mitigate threats that are indicated to be above a set risk threshold.Attack Surface Reduction:ATP products eliminate risk by minimizing the attack surface area of the organizational work environment with hardware-based and file isolation, exploit and network protection, and application control (particularly for smartphones), etc. This is particularly important given the expansion of attack surfaces due to the rapid and widescale move to work from home.Protection and Detection:ATP security prevents ongoing attacks and mitigates threats before system breaches occur. However, even after an attack has been able to execute, it provides some level of protection by continuously monitoring behaviors with a dynamic analysis engine to protect against advanced, and highly threats that managed to get through the prevention-focused solutions. This includes advanced threat hunting, intrusion detection, and providing analysis tools that enable the security analyst to pivot and quickly narrow down suspicious activity.&nbsp;ATP security is a comprehensive <a href="https://www.deepinstinct.com/endpoint-protection/" target="_blank" rel="noopener">endpoint protection</a> system that mitigates the threat of cyberattacks and protects sensitive business or organizational data from breaches. Artificial intelligence antivirus, with its focus on prevention, is one of the most vital applications used in an ATP security operation. The cost of cleaning up a security breach, rather than mitigating it proactively, is enormous. Without a robust preventative defense, an attack can bring business to a halt, cause brand damage, and contribute to customer attrition. In the present era, as digital adoption increases and more sensitive is hosted on the cloud, ATP is undoubtedly a leading asset of any security operation and a necessity for organizations.

What is ATP Security?

As originally published in VMblog

How is the cybersecurity landscape shaping up for 2021? With the wholesale structural shift to WFH, we provide so

blog3-copy-12.jpg

As originally published in <a href="https://vmblog.com/archive/2021/01/25/deep-instinct-2021-predictions-connected-world-means-many-challenges-for-cybersecurity.aspx#.YA7-T-gzZPZ" target="_blank" rel="noopener">VMblog</a>
How is the cybersecurity landscape shaping up for 2021? With the wholesale structural shift to WFH, we provide some cybersecurity predictions into how this rupture will continue to pan out in 2021. Cyber leaders will need to keep their proverbial ‘finger on the pulse’ to keep pace with the new risks, priorities, and considerations that are emerging in this rapidly evolving arena.
<h3>Covid19 After Effects</h3>
While all the <a href="https://www.deepinstinct.com/2020/03/26/attackers-abuse-the-covid-19-pandemic-to-spread-malware/" target="_blank" rel="noopener noreferrer">Covid19 themed Mal-spam</a> that we’ve seen will eventually die down, the new arrangement of Working From Home (WFH) is going to become the industry norm. The concern is that in the time that it takes companies to upscale their security to meet the changing location and form of the office network, we will see hackers taking advantage of this window of exposure. Previously, an organization’s network and all its data were sitting securely behind fortifications of the organizational security network. All of a sudden, the transition of moving to a wide and varied mess of different work environments makes it far more complex for defenders to keep protecting the enterprise at the same level. Naturally, the organization’s attack surface is amplified. While in the past only one attempt was all a hacker could get of successfully breaking in using a new variant of malware, now they have multiple attempts, all with equally good chances. And for an attack to cause damage, it only needs to succeed once.
An example of this was the <a href="https://www.zdnet.com/article/cognizant-expects-to-lose-between-50m-and-70m-following-ransomware-attack/" target="_blank" rel="noopener noreferrer">Cognizant incident</a> that hit the company early on in the work from home transition. The IT Service provider was attacked by ransomware that managed to bring business to a halt for a period of time and is alleged to have cost the company between $50 and $70 million.
<h3>The Proliferation of Botnets and Access as a Service</h3>
Botnets have become one of the biggest cyber threats today and by that nature a major cause for concern to those charged with cybersecurity. What makes botnets so dangerous is the size of their network, where the more infected online devices that a botnet has under its command, the wider its pool of malware delivery, and therefore the bigger its impact. And considering, a hacker’s ultimate goal is financial gain, malware infiltration, or just disruption, the bigger the pool, the better. In 2021, we expect to see more malware creators sell access to their botnets, and thereby access into their network of millions of infected connected devices. In an exchange that researchers at Deep Instinct have coined ‘Access-as-a-Service”.
The implication of this is bad. These botnets have market value in the dark web for their ability to break down the attack chain into several components, so that a smaller scale hacker can just focus their efforts on fewer components of the attack chain, and thereby become more skilled in just those limited components. For example, the botnet will provide the initial access, while the hacker will focus their effort on becoming better at information theft or the ransomware logic.
<h3>Organized Cybersecurity Co-operation Between Government and Private Enterprise</h3>
Combatting the growing complexity of attacks has necessitated the collaboration between private companies and government security departments. This was particularly observed in the lead up to the US elections this past November where the U.S. Cyber Command branch of the Department of Defense collaborated with multiple security companies in an effort to <a href="https://www.bleepingcomputer.com/news/security/trickbot-botnet-targeted-in-takedown-operations-little-impact-seen/" target="_blank" rel="noopener noreferrer">take down Trickbot</a>. The malicious botnet which is known to be one of the most active and dangerous, had many of its infected computers liberated, as the combined effort worked to put the brakes on the attempt to interfere with electoral systems.
Furthermore, Microsoft was able to clear a legal pathway to sabotage the botnet on the basis that the writers of Trickbot malware are infringing their terms of service. Instead of writing their own code from scratch, they’re abusing Microsoft code, an activity that almost every malware writer is bound to do.
We expect to see this collaboration continue and escalate as more nation-states engage in cyber warfare and support both the development and defense efforts of APTs, zero-day exploits, and machine learning-based adversarial attacks.
<h3>Continued Adoption of Adversarial Machine Learning Malware</h3>
As knowledge on adversarial machine learning continues to grow, that knowledge is disseminating among both sides of the cyber battleground. 2020 saw the increased adoption of machine learning academic knowledge being used in adversarial attacks in private industry research. As this knowledge gradually makes the transition from academia to the wild, we expect to see malware campaigns attempting to evade products based on machine learning models, either by fooling the model, learning how to subvert it, or by forcing it to shut down. Since machine learning-based products are becoming the market-dominant solution, it makes sense that they represent the next target for well-resourced hackers. We expect that those perpetrating the attacks will be only a select few of very sophisticated and highly capable threat actor groups who most likely will be acting as part of a nation state-sponsored campaign. The bar of entry to AI based attacks is still very high, and we, therefore, don’t expect it to become “run-of-the-mill” malware next year.
<h3>Ransomware to Target Mission-Critical Organizations</h3>
2020 saw <a href="https://www.deepinstinct.com/2020/04/20/the-evolution-of-ransomware-and-its-culmination-to-the-nameshame-game/" target="_blank" rel="noopener noreferrer">ransomware attacks</a> increasingly amplify their leverage to coerce ransom pay-outs by not only stealing a victim’s sensitive data but also threatening to expose it. It appears that the lesson learned for hackers is that the test of a good ransomware attack is its method of extortion. The greater the stakes the better likelihood of a payday. For this reason, in 2021 we expect to see a move towards targeting mission-critical organizations, i.e. those organizations that have the minimal risk tolerance to having their digital systems shut down or their data stollen and exposed.
Hospitals and educational institutions are a good example of this, with both sectors having already suffered from a wave of ransomware infections, both schools and hospitals are under enormous pressure to keep their doors open. In the crossroads between ransomware and data privacy regulations, private companies are also more susceptible to being breached, with the added risk of being hit with large fines if found to have exposed data.
<h3>Rising Cybersecurity Company Valuations</h3>
During the recent worldwide economic downturn, cybersecurity was one of the few industries to record growth. In 2021 we expect to see cybersecurity stock prices and company valuations continue this upward trajectory, with multiples expected to reach new heights. This development appears to reflect a changing market perception of cybersecurity products no longer seen as a discretionary item, but rather as a staple.
For more insights download Deep Instinct’s “2020 Cyber Threat Landscape Report” which includes an analysis of the latest malware trends and developments, insights on the past year’s cyber threat landscape, and predictions for this year, all based on empirical research findings. A full copy of the 31-page “<a href="https://info.deepinstinct.com/en/tof/cyber-threat-report" rel="noopener noreferrer">2020 Cyber Threat Landscape Report</a>” is available. In addition, anyone interested can join a live webinar “<a href="https://info.deepinstinct.com/en/tof/the-pandemic-and-its-manipulation-by-the-cyber-underworld" rel="noopener noreferrer">The Pandemic and its Manipulation by the Cyber Underworld</a>” scheduled on Tuesday, February 23 at 1 pm Eastern. Featuring the Deep Instinct security intelligence researchers who contributed to the study, participants will also have an opportunity to ask questions on the report findings.

Cybersecurity Predictions for 2021

The FBI has released a public service announcement that K-12 schools should expect a surge of cyberattacks, particularly ransomware infections, during

FBI-alert-blog.jpg

The FBI has released a public service announcement that K-12 schools should expect a surge of cyberattacks, particularly ransomware infections, during the ongoing uptick in remote-learning as a result of the coronavirus pandemic.
Schools, colleges, and universities have all experienced an increased reliance on technology, they have opened up their infrastructure to enable remote learning connections, yet their resources dedicated to network defense haven’t grown accordingly. With their attack surfaces wider than ever before, schools have come to represent prized ransomware victims.
Schools are tempting targets for hackers for two important reasons; they hold troves of sensitive student data. and have minimal defense mechanisms - effectively making them the “low hanging fruit” of cyber-attack targets.
According to the report, the number of attacks targeting K12 schools in 2019 was 1,233, with another 422 schools being attacked just within the first quarter of 2020. This represents a huge increase from previous years. Some of these schools lost total access to their computer networks, files, and communication systems as a result.
The Bureau also raised awareness on the increased proliferation of <a href="https://www.deepinstinct.com/2020/04/20/the-evolution-of-ransomware-and-its-culmination-to-the-nameshame-game/" target="_blank" rel="noopener noreferrer">ransomware</a> gangs that steal data from infected networks and then threaten to publish that sensitive data if the school refuses to pay the ransom. This added risk “may create an elevated urgency for schools to pay ransoms” and thereby perpetuate the practice. For this reason, the FBI advised schools to pay particular attention to attacks involving Ryuk ransomware which exploits RDP endpoints to gain an initial point of entry.
Unlike what most people think, when ransomware hits, decrypting the ransomware with a special key won’t necessarily help you return to a clean state or be enough to stop the impact of having been attacked - because the machine is still infected. This means that any new files, files restored from a backup, or decrypted files are still vulnerable to the ransomware logic that is still lying dormant within the system. Paying the ransom doesn’t put you out of harm’s way, there is still every risk of getting encrypted again.
The ransomware persistence methods, for example, those used by Ryuk, entail that stopping the process of the ransomware won’t be enough since after a period of time or even after a reboot, the ransomware will still be active.
According to Guy Propper, Threat Intelligence Team Leader at Deep Instinct, it’s critical for schools to realize the threat, but that there are also solutions available to help defend against it, “your school doesn’t have to become another statistic, forced to close its doors on students.”
“Probably the most effective and reliable way to get rid of ransomware is to reimage or format the machine, but that’s of course very expensive, especially when there is a lot of data that is likely to be lost” advises Propper. This approach necessitates that a school network’s typically short-staffed IT team needs to know and be familiar with all the places or methods that malware (not just ransomware) gains its persistence. For example, recovering or reverting to a previous mode before the registry key was changed.
Therefore, the most effective way to handle ransomware attacks is to prevent them from happening, an approach that has been pursued and successfully deployed by <a href="https://www.deepinstinct.com/" target="_blank" rel="noopener noreferrer">Deep Instinct</a>. Deep Instinct offers powerful solutions, based on the advanced A.I technology of deep learning to enable resilient prevention against even the most advanced malware and ransomware threats.
To trial the efficacy of Deep Instinct’s preventative approach, school networks can <a href="https://info.deepinstinct.com/education_30day_threatanalysis" target="_blank" rel="noopener noreferrer">schedule a free threat analysis</a> that is currently available at Deep Instinct. This analysis is designed to provide <a href="https://www.deepinstinct.com/endpoint-protection/">endpoint security</a> teams with sufficient insight on how school networks can be kept secure, even as more educational activities go virtual.
<a href="https://info.deepinstinct.com/education_30day_threatanalysis" target="_blank" rel="noopener noreferrer"><img class="alignnone wp-image-7329 size-large" src="https://www.deepinstinct.com/wp-content/uploads/2020/08/education_security_solution_lIn_2-002-1000x523.jpg" alt="" width="1000" height="523" /></a>
&nbsp;
&nbsp;
&nbsp;

Schools on Red Alert After FBI Issues Cybersecurity Warning

Over the past 3 months, Zoom, a video conference solution, jumped from 10 million active users to 200 million users. Any software solution that has a 

Zoom.jpg

Over the past 3 months, Zoom, a video conference solution, jumped from 10 million active users to 200 million users. Any software solution that has a large user base, becomes a target for attackers, in a simple equation where the more users on a platform, the larger the number of successful attacks achieved using the platform. This is the situation in many software domains; in cybersecurity, there are more evasion techniques used in the wild to undermine and bypass the more commonly used security tools. The same rule applies to OS platforms; Windows, the most common OS platform in the market, is also the most targeted.
And Zoom is no exception. This same pattern has been noticed with Zoom’s rapid jump in its user base. During 2018-2019, only three security vulnerabilities in Zoom were exposed, while over the past few weeks many more were observed:
<ol>
<li>Bruteforce: An attacker can perform a brute-force attack by entering a meeting they’re not invited to by finding an open meeting ID to connect to.</li>
</ol>
The problem: A problematic product design was implemented, with a weak ID mechanism.
The solution: Approve only valid users to join a call.
<ol start="2">
<li>Data leakage: Zoom shared information with Facebook.</li>
</ol>
The problem: Manipulated usage of a Facebook SDK.
The solution: Zoom has removed the relevant SDK that shared information with Facebook. Other protection measures can include limiting connectivity to Facebook from the workspace.
<ol start="3">
<li>End-to-end encryption: Zoom is not performing E2E encryption.</li>
</ol>
The problem: Attackers can perform Man-in-the-Middle attacks while hearing or watching live calls.
The solution: An E2E encryption is to be incorporated into Zoom. As an alternative, either a VPN can be used to a secured location (although ISPs would still be able to inspect the traffic) or alternatively, monitor for network attacks in the internal network. Android, Chrome OS, and iOS devices can be protected by Deep Instinct from these and other various network attacks.
<ol start="4">
<li>Un-secured network route: Zoom calls are routed through China.</li>
</ol>
The problem: Countries like China which intercept the traffic of its citizens, can now hear or watch calls of any participant, even if they are not located physically in China.
The solution: Zoom has fixed this unsecured network route by changing the traffic route, so it doesn't pass through China.
<ol start="5">
<li>Credential theft: Zoom has a common vulnerability in UNC links.</li>
</ol>
The problem: Attackers can steal Window’s credentials.
The solution: Zoom has fixed this security vulnerability.
<ol start="6">
<li>Dropping technique: Zoom can be installed on macOS devices in a way that lets it skip the need to insert a root password by the user.</li>
</ol>
The problem: By modifying the Zoom installer, an attacker can hitch additional malicious tools to the installation.
The solution: By using Deep Instinct, devices are protected from any malicious file that can be dropped as part of a Zoom installation. Deep Instinct can even scan the Zoom installer that might contain malicious files inside, before the installation itself happens.
<ol start="7">
<li>Code injection: Zoom gains access permissions to use webcam and microphone.</li>
</ol>
The problem: An attacker can inject itself into Zoom in order to get permissions to these resources.
The solution: By using Deep Instinct, devices are protected from various code injection techniques.
The security vulnerabilities listed here are not particularly unique to Zoom and many of them may also be found within other video conferencing tools as well, like Microsoft Teams and Google Hangouts. However, the critical factor is to have a robust security tool in place that works to eliminate many of these potential threats.

The Zoom Security Vulnerabilities to Join Your Every Meeting

The cybersecurity industry is nothing if not crowded. If you ever attended a security event, like RSA “crowded” is an understatement, both figurativel

cybersecurity-Economy.jpg

The <a href="https://www.deepinstinct.com/">cybersecurity industry</a> is nothing if not crowded. If you ever attended a security event, like RSA “crowded” is an understatement, both figuratively and literally.  There are hundreds of vendors and many more attendees, all hoping to find that missing piece to their security stack puzzle. Yet more often than not, attendees are likely to leave a conference awash with brochures all promising to deliver very similar, if not the same, benefits.
However, this hyperbole contrast greatly with the sober reality that increased spending trends have <a href="https://www.deepinstinct.com/2020/01/29/cutting-cybersecurity-budgets-in-a-time-of-growing-threats-2/">not equated to improved security</a>. Over the past ten years or so, the budget organizations have allocated for cybersecurity strategies have tripled. This increased budget must mean cybersecurity challenges are finally solved. We can all go home now, trusting organizations are now secure. Of course, that is not the case.
Recently we partnered with the Ponemon Institute to survey IT and security professionals on their perceptions and impacts of prevention during the cybersecurity lifecycle. With over 600 participants from many different industries providing feedback, we believe the results of the survey to be representative of the security landscape. Review the full report <a href="https://info.deepinstinct.com/value-of-prevention">The Economic Value of Prevention in the Cybersecurity Lifecycle</a>.
Survey respondents have found that delivering a continuous and consistent level of prevention is difficult, with 80% rating prevention as the most difficult to achieve in the cybersecurity lifecycle. So, it is no surprise that almost 80% of budget funds non-prevention priorities (containment, detection, remediation, and recovery). Here is where things get frustrating and confusing. 70% of respondents believe the ability to prevent would strengthen their security posture. When asked how much preventing attacks could drive down costs, respondents estimated savings between $396,675 and $1,366,365 (for ransomware and nation-state attacks respectively). Couple this information with the fact that 40% of the respondent feel their security programs are underfunded, and you find yourself scratching your head. Why are organizations spending their scarce budget in ways that seem contrary to their interests?
I am a big fan of examples, so let us use one here to crystallize the situation.
You are a CISO for a company with 1,500 employees and 2,000 endpoints, servers, mobile devices, etc. spread across several geographies. You have a $10 million budget for security; $6 million of that budget is spent on a security stack of products focused on reacting to an active threat and $2 million is spent on an AV “prevention” solution that you know is not very effective.
Let’s say, for argument sake, that you have three significant security incidents a year. Not hair on fire incidents, but incidents that require calling in outside help to return to a normal state. These three incidents (two phishing, one ransomware) set you back roughly $2 million in containment and remediation costs. By its end, you’ve essentially used your entire budget and improved your cybersecurity posture by 0%.
You know that if you were able to prevent these security incidents from happening, let’s even be conservative here and say you prevent two of the three incidents (one phishing, one ransomware) you could avoid spending $1.5 million yearly. Your “effective” security budget would keep its value and not drop to $8.5 million, and you could argue your cybersecurity posture has improved by 66% (with two of the three security incidents being non-events).
If the definition of insanity is doing the same thing over again and expecting a different result, this current pattern begs critical evaluation. I propose two reasons why the results of this survey indicate a dysfunctional relationship between budget allocation and resulting security posture.
<h3>The failed expectation of machine learning prevention tools</h3>
The understanding of attackers of how to circumvent even advanced <a href="https://www.deepinstinct.com/">machine learning</a>  prevention tools has developed and proven successful. While many of these solutions do a relatively better job at preventing successful attacks compared to legacy AV solutions, the illusion of near-complete prevention never materialized, especially in regards to zero-day, or unknown, threats. As a result, budgets are back into the detection and response mode. In fact, respondents report they are more confident in their ability to contain an active breach (55%) over other tasks along the cybersecurity lifecycle.
<h3>Plan B: Speeding-up detection and response</h3>
Perceiving continuous prevention as a “fool’s errand,” organizations are taking a “cause least harm” approach to secure their organization. This involves a focus on technologies aimed at shrinking attacker dwell time to limit the impact of the inevitable attack. This approach makes perfect sense, considering the constant refrain across the security vendor landscape that “it’s not if, but when” an attack will succeed. If an attack is inevitable, it would be irresponsible for security departments to prioritize investment in any other way. To that end, an overwhelming percent of respondents (76%) are no longer even considering improving their prevention efforts given the perceived inherent fallibility.
<h3>Sea-Change</h3>
The joint research with Ponemon could be considered a gloomy picture of security and IT professionals tasked with the enormous responsibility of keeping their organizations secure with a limited budget, facing unlimited threats. They work with security vendors who repeatedly fail to deliver on expectations, while a continuous stream of new vendors make the same promises they have heard for years.
So, why take another look at prevention? Prevention has evovled in the last few years with deep learning technology enabling an advanced predicitive analysis of threats that has to date achieved unparallel accuracy and speed. Unlike machine learning, that requires a human expert to effectively guide the machine through the learning process by extracting features that need to be learnt, deep learning skips the human process to analyze all of the available raw data. This results in the ability to prevent new first seen attacks, like zero-days, and achieve a better detection rate against a broader range of attack vectors. The predictive capabilities of the <a href="https://www.deepinstinct.com/machine-learning-vs-deep-learning/">deep learning ai</a> algorithm are also platform agnostic and can be applied across most OS and environments.
Over the past decade or so, total spending on cybersecurity has more than tripled with some forecasting overall spending to eclipse $1 trillion in the next few years. 50% of respondents say their organization makes budgetary decisions that deliver limited to no improvement to their overall security posture. Furthermore, the licensing on expensive but ineffective technology can lock in portions of future budget dollars, inhibiting the security team’s ability to take advantage of better security solutions as they enter the market.  Sadly, unless something changes radically, I’d suspect a similar survey completed in 2024 or 2025 may show the same kind of results we see today.
It’s time for wide-scale change that addresses the root of the problem, I propose a sea change that begins earlier in the cybersecurity lifecycle – prevention.
Preventing more attacks from succeeding will have a knock-on effect across your entire security investment. More time will be available for security analysts to think strategically, making better use of the security tools at their disposal. Management can also benefit from better prevention over time, analyzing the value of their entire security investment, optimizing both technology and resource allocations, with a focus on process improvements rather than constant repair and recovery.
The good news for security professionals is that there are advanced prevention technologies in the market today that provide real value. Security professionals need to demand more from their security vendors when it comes to prevention, and if they are not able to improve prevention, then look for someone who can.
Prevention is by no means a cure-all for everything security. However, with a constantly evolving threat landscape and ever-changing business priorities, rethinking prevention can make everyone involved more effective.
Deep Instinct and the Ponemon Institute will be hosting a joint webinar discussing these and other key findings on April 30th at 1pm EST. Click here for more <a href="https://www.brighttalk.com/webcast/16681/397814?utm_source=Deep+Instinct&amp;utm_medium=brighttalk&amp;utm_campaign=397814">information and to register</a>.

The Cybersecurity Paradox

In this testimonial video Matthew Fredrickson, the Director of IT for Council Rock School Districts explains what a huge difference Deep Instinct’s au

School-testimonial.jpg

In this testimonial video Matthew Fredrickson, the Director of IT for Council Rock School Districts explains what a huge difference Deep Instinct’s automated <a href="https://www.deepinstinct.com/what-is-deep-learning/">deep learning</a>-based solution has made for managing day-to-day security tasks for him and his team.
The Council Rock School District is located in Newtown, Pennsylvania, and is comprised of 15 Kinder to year 12 schools which comprise around 13,000 end users. Deep Instinct has been deployed into the production environment for Windows OS and servers. Matthew advises that the deployment of Deep Instinct compared to other products he has used was remarkably quick and easy. The environment currently has about 3k+ agents deployed, all of which are functioning in prevention mode.
<iframe src="https://www.youtube.com/embed/7gCQMvkq3hI" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe>
To see the Deep Instinct agent in action you can <a href="https://www.deepinstinct.com/request-a-demo/">request a demo</a>, and start your school’s long-awaited journey to become one of the Learned Few.

DSX for Cloud - Amazon S3 provides natively integrated preemptive data security for Amazon S3.

Deep Instinct

From Deep Instinct.