Security teams face more challenges than ever — an expanded attack surface, an increased number of vulnerabilities, and a non-stop barrage of cyberattacks, all of which materially increase organizational risk. According to the Splunk State of Security Report 2023, security operations centers (SOCs) have become so overwhelmed that 23% of SOC analysts say they struggle with the high volume of security alerts. There are so many to process that 41% of those alerts are being ignored. This enables threats to slip through an organization’s defenses. This can increase mean time to detection (MTTD) and result in lengthy dwell times. In fact, organizations report an average of about 2.24 months of dwell time, and 52% of organizations reported breaches within the last two years.
These challenges are being exacerbated by headwinds fueled by generative AI. According to the recently released Splunk Security Predictions 2024 report, attackers will create AI-designed evasive malware, deep fakes and more authentic social engineering tactics. Plus, new types of assaults will emerge in 2024, including commercial and economic disinformation campaigns, with more targeted attacks against companies’ brands and reputations. Ransomware authors will increasingly rely on zero-day threats to infiltrate networks.
Sophisticated cyberattacks like these can be very difficult to uncover and detect. While man-made correlation rules can detect malicious behavior, they should not be solely relied upon to identify 100% of threats in any given environment. Consider the limitations of human-fueled security tactics. Security teams are so overwhelmed by the sheer volume and sophistication of attacks that they have reached, if not exceeded, their capacity to effectively and rapidly observe, orient, decide and take action. A more sound strategy is a combined human and machine approach to scale the SOC team with technology that can streamline and automate key elements of the detection, investigation, response and remediation cycle.