AI/ML Security

AI Governance

Establishing and overseeing guidelines and practices to ensure the ethical, transparent, and accountable development and implementation of AI.

Example(s): Credo AI, Holistic AI, Cranium

LLM Security

Practices and measures to protect LLM models from being exploited for malicious purposes, and to ensure their safe, ethical, and responsible use.

Example(s): CalypsoAI, Cape Privacy, Robust Intelligence, Lakera

ML Security

Protecting machine learning systems from attacks, manipulations, and vulnerabilities, ensuring the integrity, reliability, and confidentiality of ML models and their data

Example(s): Protect AI, HiddenLayer, Adversa AI

Application Security

Application Protection

API Security

Processes and tools for preventing and monitoring malicious attacks and misuse of APIs.

Example(s): 42Crunch, Astrix, Wallarm, Noname, Salt Security

Bot Mitigation

Techniques and tools for assessing website bots and blocking malicious activity.

Example(s): Netacea, Fingerprint, HUMAN, Kasada

CI/CD Security

Integrating security practices and tools into the Continuous Integration (CI) and Continuous Deployment (CD) pipeline to protect software during the testing, build, and deployment processes.

Example(s): Cloudsmith, BluBracket

Runtime Application Self-Protection (RASP)

Technology that integrates with an application to detect and prevent real-time attacks by analyzing behavior and context during execution.

Example(s): Contrast, Ghost, Data Theorem, Talsec

Web Application Firewall (WAF)

Systems to protect web applications or APIs against exploits, bots, and attacks that compromise the security and availability of web applications.

Example(s): Reblaze, Cloudflare Web Application Firewall, Signal Sciences, F5 Advanced WAF

Application Security Testing

Application Security Orchestration and Correlation (ASOC)

Integration and automation of various application security tools and processes to enhance efficiency and effectiveness in identifying and mitigating vulnerabilities.

Example(s): ArmorCode, Kondukto

Application Security Posture Management (ASPM)

The continuous process of assessing, improving, and monitoring the security state of software applications.

Example(s): Legit Security, Bionic, Cycode, Enso Security

Dynamic Application Security Testing (DAST)

A method of testing applications for security vulnerabilities by simulating external attacks on a running application.

Example(s): Project Discovery, OWASP ZAP, StackHawk, Burp Suite

Fuzz Testing

A testing technique that involves inputting random, malformed, or unexpected data into an application to detect coding errors and security vulnerabilities.

Example(s): Code Intelligence, Mayhem, Google OSS-Fuzz

Infrastructure as Code (IaC) Security

Practices and tools used to ensure that the code and processes used to automate and manage IT infrastructure are secure and free from vulnerabilities.

Example(s): GuardRails, Trivy, Apiiro, Bridgecrew

Interactive Application Security Testing (IAST)

A testing approach that combines static and dynamic analysis to evaluate applications for vulnerabilities in real-time during testing and operation.

Example(s): Acunetix, Oxeye

Mobile Application Security Testing (MAST)

The process of assessing and identifying security vulnerabilities in mobile applications.

Example(s): Guardsquare, Zimperium Mobile App Protection Suite (MAPS), Appknox

Static Application Security Testing (SAST)

A method of analyzing code for security vulnerabilities without executing the application.

Example(s): Semgrep, Sonar, Bearer

Software Supply Chain Security

Code Signing

The process of digitally signing software to verify the author's identity and ensure that the code has not been altered or corrupted since it was signed.

Example(s): PrimeKey Code Signing, Sigstore, SignPath

Dependency Scanning

The process of analyzing dependencies for known vulnerabilities and security issues to ensure the security and integrity of an application's third-party components.

Example(s): Retire.js, OWASP Dependency-Check, GitLab Dependency Scanning

License Compliance

Ensuring the use of software within an organization adheres to the terms and conditions outlined in its licensing agreements.

Example(s): Flexera FlexNet Manager, Snow License Manager, USU License Management

Software Bill of Materials (SBOM)

A comprehensive inventory of all components, libraries, and modules used in an application, detailing their versions, licenses, and dependencies.

Example(s): Finite State, FOSSA, Anchore

Software Composition Analysis (SCA)

Processes to identify use of open source software in a codebase to evaluate security, quality, licensing, and other software supply chain risks.

Example(s): Synopsys Black Duck, Mend.io

Blockchain and Web3

Tools for securing and managing risks on blockchain and Web3 platforms.

Example(s): StarkWare, Fireblocks, Aleo, Chainalysis, CertiK, Ledger

Capital Markets

Financial markets where equity and debt are traded, facilitating capital raises by companies, investments by individuals and institutions, and mergers and acquisitions by strategic buyers and institutional investors. Angel and Seed Investors Independent individual investors or a group of individual investors who invest capital in early stage cybersecurity companies.

Example(s): Silicon Valley CISO Investments, Boldstart, Team8, Cyberstarts

Certifications and Training

Comprehensive cybersecurity awareness, education, and credentialing organizations covering one or more major cybersecurity domains.

Example(s): SANS Institute, ISC2, OffSec

Consumer Security and Privacy

Practices and countermeasures to protect personal data and ensure the digital safety of consumers against unauthorized access, misuse, and threats.

Example(s): Gen, Proton, Aura

Cyber Crime

Illegal activities conducted online, including offenses like hacking, identity theft, and online fraud. Advanced Persistent Threats (APT) Organized groups of threat actors who gain unauthorized access to networks for political or economic reasons.

Example(s): Double Dragon, Cozy Bear

Data Security

Data Protection

Data Security Posture Management (DSPM)

A comprehensive approach to continuously identify, assess, and manage the security of data across an organization's entire digital landscape.

Example(s): Reco, Cyberhaven, Normalyze, Metomic, Cyera

Database Security

Tools, controls, and processes to protect databases from compromise.

Example(s): Baffle, JumpWire, Fortinet FortiGuard Database Security

e-Discovery

Identification, collection, and storage of electronic information for investigations and legal requests.

Example(s): Relativity, Logicube, Nuix

Insider Threat Detection

Identifying and mitigating risks posed by individuals within an organization who might misuse access to harm the organization or its data.

Example(s): Veriato, Code42

Public Key Infrastructure

Infrastructure to establish and manage public key encryption for user identities, device identities, and secure end-to-end communications.

Example(s): Keyfactor, Entrust, Let's Encrypt

Rights Management

Software to help companies protect digital content (videos, images, files, etc.) from unauthorized distribution and duplication.

Example(s): Seclore EDRM, Vera

Data Resilience

Backup and Recovery

Processes and tools for creating, storing, and restoring copies of data to protect against data loss.

Example(s): Hewlett Packard Enterprise Data Protection, Veritas, Rewind

Secure Storage

Processes, hardware, and facilities for maintaining data security and integrity.

Example(s): Commvault, Iron Mountain

Privacy

Data Deidentification and Pseudonymity

Tools to redact and deidentify data for use by researchers, data scientists, and other parties without compromising the privacy of people in the dataset.

Example(s): Blyss, Hazy, Sarus

Data Discovery and Classification

The process of scanning data sources to find and classify structured and unstructured data, with a focus on sensitive and/or regulated data.

Example(s): ActiveNav, Tanium Reveal, Varonis Data Classification Engine

Encryption and Tokenization

Processes and tools for transforming sensitive data into an encrypted or masked value.

Example(s): Very Good Security, Evervault, Skyflow

Enterprise Communication

Messaging solutions to help employees and partners within an organization communicate securely.

Example(s): Silent Circle, Mattermost

Fraud and Transaction Security

Measures and technologies to protect financial transactions and sensitive data from fraudulent activities and unauthorized access.

Example(s): Forter, Riskified, Sift, Alloy

Governance, Risk, and Compliance

Compliance

Auditors and Assessors

Firms authorized to conduct independent reviews and certify compliance with regulations and standards.

Example(s): PwC – Trust Solutions, EY – Assurance, Coalfire, KPMG – Audit, Deloitte – Audit & Assurance

Compliance Automation

Tools for automating compliance processes and continuous controls monitoring.

Example(s): Very Good Security, Tugboat Logic, RegScale, AuditCue

Regulations

Official rules to enforce laws created by governments. Implemented and maintained by authorized government agencies.

Example(s): General Data Protection Regulation (GDPR), Sarbanes-Oxley (SOX), HIPAA

Third Party Assurance

An examination of a service provider's services, internal controls, and risks conducted by a third party on behalf of customers. Results are documented in a compliance report.

Example(s): ISO 27001, SOC 2

Governance

GRC

Systems to automate and integrate enterprise, operational, and IT risk management processes and data.

Example(s): Onspring, AuditBoard, Camms, LogicGate

Metrics and Dashboards

Tools used to track and display key performance indicators to measure cybersecurity risk and effectiveness.

Example(s): ArmorPoint Unified Security Dashboard, ServiceNow CISO Dashboard, Infosys Cyber Gaze

Policies and Procedures

Written documents and tools for managing rules for individuals accessing an organization's systems and data.

Example(s): FreePrivacyPolicy, Comprose, SANS Security Policy Templates

Security Architecture

A core information security function that defines and guides architectural requirements and design of security-relevant elements within an organization.

Example(s): Privacy by Design, Zero Trust Architecture (ZTA), Software Defined Perimeter (SDP)

Security Awareness

Materials and products to measure and improve the knowledge and understanding individuals have about cyber threats and the best practices to safeguard against them.

Example(s): Living Security, CybSafe, Riot, KnowBe4

Segregation of Duties (SOD)

Automated enforcement of shared responsibilities among multiple people for execution of critical processes. Reduces fraud and errors.

Example(s): Pathlock, SAP Access Control

Standards and Frameworks

Documented guidance for policies and controls to systematically manage security and risk.

Example(s): ISACA COBIT, NIST Special Publication 800-53, MITRE ATT&CK, ISO 27002

Privacy Program Management

Assessment Managers

Workflows and automation for various functions of a privacy program.

Example(s): BigID Privacy Impact Assessment App, OneTrust Privacy Management

Consent Management

Systems and processes for notifying users about personal data collection and collecting explicit consent.

Example(s): Osano, CookieYes, Enzuzo, UserCentrics

Data Mapping

Tools to help organizations map data flows across the enterprise.

Example(s): BigID Data Mapping, DataGrail

Data Subject Request Automation

Processes and tools to support individual requests for personal data and use under data privacy laws.

Example(s): MineOS, Transcend, Ethyca, Ketch Data Subject Rights Fulfillment

Privacy Information Managers

Information and updates for understanding global privacy laws and regulations.

Example(s): OneTrust DataGuidance

Website Scanning

Tools to check websites to identify which cookies, beacons, and trackers are in use.

Example(s): Blacklight, Sovy GDPR Scan, PrivacyScore

Risk

Cyber Insurance

Specialty business insurance for protection against cybersecurity-related losses, including data breaches, ransomware, and other incidents.

Example(s): Liberty Mutual Cyber Liability, Chubb Cyber Insurance, AIG Cyber Insurance

Cyber Risk Quantification

Assessment and quantification an organization's cybersecurity risk level.

Example(s): Balbix, Axio

Enterprise Risk Management

Identification, management, and remediation of company-wide risk at an executive level.

Example(s): ISO 31000, COSO Enterprise Risk Management Framework

Third-Party Risk Management (TPRM)

Identifying, assessing, and mitigating risks associated with external entities like vendors, suppliers, and partners that an organization engages with.

Example(s): Black Kite, UpGuard, Interos

Trust and Safety

Business practices, workflows, and tools used by online platforms to reduce the risk of users experiencing harm, fraud, abuse, and other negative behaviors.

Example(s): Sero AI, SafetyKit, Cinder, Trustpage

Government and NGOs

Public and not-for-profit entities responsible for researching, creating, enforcing, and promoting policies, regulations, standards and initiatives to protect digital information and infrastructure from cyber threats and ensure data privacy. Agencies Government agencies specializing in cybersecurity policy, research, and protection.

Example(s): Cybersecurity & Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), National Institute of Standards and Technology (NIST), National Security Agency (NSA), Unit 8200

Identity Security

Authentication

Access Management

Platforms for identifying, tracking, controlling, and managing user access to applications and infrastructure.

Example(s): Okta Single Sign-On, Ping Identity Single Sign-On, ForgeRock Access Management

Biometrics

Use of physical or behavioral traits to authenticate and verify identity.

Example(s): Prove, Clear, Keyless

Customer Identity (CIAM)

Systems for controlling customer access to applications and managing customer profile information.

Example(s): Auth0, Descope, FusionAuth

Electronic Identification

Government systems for digital proof of identity for citizens and organizations.

Example(s): Aadhaar, Israeli ID

Identity Graphing and Resolution

Services that correlate online and offline identifiers with consumer identities to create an accurate view of customers.

Example(s): Amperity Identity Resolution, LiveRamp Identity Resolution

Identity Proofing

A service used for verifying a user's identity based on life history or other data aggregated from public and proprietary data sources.

Example(s): Trulioo, Persona, Socure, Jumio, Veriff

Know Your Business (KYB)

The process of verifying the identity and assessing the legitimacy of businesses, typically for compliance and risk management purposes.

Example(s): Sumsub, Middesk

Multi-Factor Authentication (MFA)

Authentication that replaces traditional passwords or combines two or more authentication requirements (e.g. password and one-time token) for increased security.

Example(s): Yubico, Authy, Duo Security

Password Managers

Tools to help users generate, store, and use secure passwords.

Example(s): 1Password, LastPass, Dashlane

Passwordless

Verification of identities without the use of traditional passwords, instead relying on methods like biometrics, tokens, or cryptographic keys.

Example(s): HYPR, Passage, Trusona, Beyond Identity

SaaS Identity Risk Management

Assessing, monitoring, and mitigating risks associated with user access and authentication in unmanaged SaaS applications.

Example(s): Grip, Cerby

Secrets Management

Securely handling, storing, and accessing sensitive information like tokens and encryption keys for protecting access to applications and services.

Example(s): CyberArk Conjur, HashiCorp Vault, Truffle Security, GitGuardian

Self-Service Password Reset (SSPR)

Toos that allow users to reset their passwords independently, typically through a series of authentication steps.

Example(s): Quest Password Manager, FastPass

Social Login

Example(s): Sign in with Slack, Facebook Login, Google Sign-In

Web3 Authentication

Decentralized and user-centric identification systems in the blockchain and cryptocurrency space, enabling users to own and control their digital identities without relying on central authorities.

Example(s): NuID, Dock, Dynamic, Fractal ID, Polygon ID, Privy

Authorization

Background Screening

Services that compile and help verify employment, criminal, financial, and other records for people and organizations.

Example(s): HireRight, Checkr, Truework

Centralized Authorization

A security approach where access control decisions for multiple systems or applications are managed from a single, unified point of policy enforcement and management.

Example(s): Axiomatics, Oso, SGNL

Data Access Governance

Systems for gaining visibility and enforcing access control policies on unstructured data (spreadsheets, documents, PDFs, etc.).

Example(s): SailPoint File Access Manager, Saviynt Data Access Governance, Immuta

Directory Services

A repository for collecting information about users, devices, and resources for authentication and authorization. LDAP is a common standard for directory services.

Example(s): ForgeRock Directory Services, JumpCloud, Microsoft Entra ID

Identity Governance and Administration (IGA)

Systems for administering accounts and credentials, access provisioning, and access reviews.

Example(s): Entitle, SailPoint, Saviynt, BalkanID, ConductorOne, Veza, Opal

Identity Threat Detection and Response (IDTR)

Identifying, investigating, and mitigating malicious activities targeting user identities and credentials.

Example(s): Authomize, Spera, Semperis

Identity Wallets

Identity stores that allow users to manage and share their digital identity credentials and data.

Example(s): Auth0 Sign In With Ethereum (SIWE), Spruce

Physical Access Control

Solutions that manage physical identities and access to physical locations and spaces.

Example(s): Envoy, Honeywell Forge, Kisi, Avigilon

Privileged Access Management (PAM)

Systems for managing privileged (elevated) access for users, shared accounts, secrets, keys, and other high risk credentials.

Example(s): BeyondTrust, Delinea, Teleport

Web3 Authorization

The decentralized process of granting or restricting access to resources and actions in blockchain and decentralized applications, based on verified digital identities and smart contracts.

Example(s): Gatekeeper

Infrastructure Security

Cloud Security

Cloud Infrastructure Entitlements Management (CIEM)

Tools to help companies manage permissions and detect excessive or risky access in cloud environments.

Example(s): Sonrai, K9 Security

Cloud Security Posture Management (CSPM)

Continuous management, monitoring, policy enforcement, and compliance for cloud environment configurations.

Example(s): CrowdStrike Falcon Horizon, Microsoft Defender for Cloud, Cloudanix

Cloud Workload Protection Platforms (CWPP)

Processes and tools for securing containers and workloads within different cloud environments.

Example(s): Amazon GuardDuty, Zscaler Cloud Protection, Intezer Protect

Cloud-Native Application Protection Platforms (CNAPP)

Integrated security solutions designed to protect cloud-native applications by combining capabilities like workload protection, cloud security posture management, and application security.

Example(s): PingSafe, Uptycs, Sysdig

Container Security

Measures and practices to protect containerized applications and their underlying infrastructure from threats and vulnerabilities throughout the container lifecycle.

Example(s): Portainer, Fairwinds, Red Hat Advanced Cluster Security

SaaS Security

Strategies and measures implemented to protect data, applications, and services hosted on Software as a Service (SaaS) platforms.

Example(s): Nudge Security, Push Security, Obsidian, AppOmni

Email Security

Anti-Spam and Anti-Phishing

Security measures designed to detect, block, and prevent unwanted or deceptive emails, such as spam and phishing attempts, from reaching users.

Example(s): Avanan, MX Layer, GreatHorn, Cloudflare Area 1 Email Security

Email Archiving

Storing, preserving, and organizing email communications for long-term retention, easy retrieval, and compliance purposes.

Example(s): Smarsh, ArcTitan, Global Relay

Email Encryption

Encrypting email messages in transit and/or at rest to protect their content from being read by anyone other than the intended recipients.

Example(s): Mailfence, Paubox, Proton Mail

Phishing Simulation

A training tool that sends simulated phishing emails to users, testing their ability to recognize and respond to phishing attacks.

Example(s): Cofense, Phished, Hook Security

Secure Email Gateways (SEGs)

Security solutions that monitor and filter incoming and outgoing emails to protect against spam, viruses, phishing attacks, and other email-based threats.

Example(s): Proofpoint Email Protection, Cisco Secure Email Threat Defense, Microsoft Exchange Online Protection

Endpoint Security

Endpoint Detection and Response (EDR)

Tools installed on endpoints to record key activity for monitoring and threat investigations.

Example(s): SentinelOne Singularity Endpoint, Trend Vision One, CrowdStrike Falcon

Endpoint Privilege Management (EPM)

Approach and tools for protecting against execution of malware and unapproved applications on endpoints.

Example(s): Delinea Privilege Manager, VMware Carbon Black App Control, CyberArk Endpoint Privilege Manager

Endpoint Protection Platforms (EPP)

Software to protect endpoints from threats, including malware, ransomware, phishing, and data theft.

Example(s): SparkCognition EPP, Deep Instinct, WithSecure

File Integrity Monitoring

Solutions to monitor changes in operating system, database, and application files.

Example(s): Tripwire File Integrity Manager, CrowdStrike Falcon FileVantage, Qualys File Integrity Monitoring

Host Encryption

The process of encrypting the data stored on a host, such as a server or a computer, to protect it against unauthorized access and ensure its confidentiality.

Example(s): Microsoft BitLocker, Symantec Encryption, Apple FileVault

Host Intrusion Prevention System (HIPS)

Endpoint-based intrusion detection and prevention system to monitor and analyze internals and network traffic on the endpoint for prevention and detection of threats.

Example(s): ManageEngine EventLog Analyzer, SolarWinds Security Event Manager, OSSEC

Mobile Device Management (MDM)

Technology used to secure, monitor, manage, and support mobile devices deployed across mobile operators, service providers, and enterprises.

Example(s): Kandji, Absolute, NinjaOne

Mobile Security

Tools protect sensitive information stored on mobile devices, including smartphones, tablets, and wearables.

Example(s): Lookout Mobile Endpoint Security, Jamf Protect, Deep Instinct Mobile Security

Network Security

DDoS Mitigation

Services to throttle and prevent distributed denial of service attack disruptions.

Example(s): Radware Cloud DDoS Protection Service, Cloudflare DDoS Protection, Akamai Prolexic

DNS Security

Protecting the Domain Name System (DNS) from threats and ensuring the integrity and availability of DNS queries and responses.

Example(s): HYAS, Cloudflare DNS, OpenDNS

Firewalls

Network security devices to regulate network traffic based on rules.

Example(s): CheckPoint Firewall, Palo Alto Networks Next-Generation Firewall, Fortinet Next Generation Firewall (NGFW), Cisco Secure Firewall

Microsegmentation

Techniques and tools to logically divide networks into security segments with specific controls based on the risk and requirements of each segment.

Example(s): Illumio, Akamai Guardicore, Elisity

Network Access Control (NAC)

Systems that provide visibility and control of devices accessing a network.

Example(s): Portnox, Aruba Secure Network Access Control

Network Detection and Response (NDR)

Solutions that continuously monitor network traffic for malicious activities and anomalies, facilitating rapid detection and response to threats.

Example(s): Darktrace DETECT, ExtraHop, Vectra AI

SSL Visibility

Tools that provide visibility into encrypted network traffic for monitoring and threat analysis.

Example(s): Broadcom SSL Visibility Appliance, F5 SSL Orchestrator

Wireless Security

Prevention of damage and unauthorized access via wireless networks.

Example(s): Plume, WatchGuard Secure Wi-Fi, Aruba Wireless, 7SIGNAL

Secure Access Service Edge (SASE)

Cloud Access Security Brokers (CASB)

Platforms to help secure and manage use of cloud-based SaaS applications and infrastructure.

Example(s): Netskope Cloud Access Security Broker, Axis Atmos CASB, Forcepoint Cloud Access Security Broker

Data Loss/Leakage Prevention (DLP)

Systems to detect and prevent transmission of sensitive data.

Example(s): Forcepoint Data Loss Prevention, Symantec Data Loss Prevention, Proofpoint Enterprise Data Loss Prevention

Device Trust

A security approach that evaluates and verifies the trustworthiness of a device based on its attributes and configuration before granting it access.

Example(s): Kolide

Remote Browser Isolation (RBI)

Technology that executes web browsing sessions in a remote, isolated environment, protecting the user's device from direct exposure to potential internet threats.

Example(s): Citrix Remote Browser Isolation, Zscaler Browser Isolation, Menlo Security Remote Browser Isolation

Secure Web Browsers

Security-focused web browsers and isolation for enterprises.

Example(s): SURF, Island, Talon

Secure Web Gateway (SWG)

Systems to filter user-initiated internet traffic and enforce corporate and regulatory content policies.

Example(s): dope.security, Forcepoint Secure Web Gateway, Lookout Secure Web Gateway, Menlo Secure Web Gateway

Software-Defined Wide Area Network (SD-WAN)

A networking approach that uses software to control, optimize, and secure traffic routing across wide area networks.

Example(s): HPE Aruba EdgeConnect SD-WAN, Nuage Networks, Versa Networks

Virtual Private Networks (VPN)

Systems that enable users to securely and privately browse public internet sites and access private networks across a public network.

Example(s): Ivanti Connect Secure, NordVPN, ProtonVPN

Zero Trust Network Access (ZTNA)

Products that broker access to applications and network resources based on identity and context.

Example(s): Palo Alto Networks Prisma Access, Appgate SDP, Cloudflare Access, Zscaler Private Access

Media

Organizations providing broad industry coverage, including analysis, events, news, and more.

Example(s): Information Security Media Group (ISMG), Gartner, Forrester, Omdia

Physical Security

Measures and controls to protect people, assets, and facilities from physical actions and events that could cause serious loss or damage.

Example(s): Claroty, Armis, Dragos

Security Operations

Digital Forensics and Incident Response (DFIR)

Cloud Investigationand Response Automation (CIRA)

Automated data collection and analysis across multi-cloud environments for cloud incident investigations.

Example(s): Cado, Gem, Mitiga

Deception

Tools and techniques to deceive and catch attackers by imitating real assets as traps and decoys.

Example(s): Illusive Attack Detection System

Forensics

Tracking and analysis of data on networks, mobile devices, computers, and storage devices for cybercrime investigations.

Example(s): AccessData, The Sleuth Kit, EnCase

Intelligence

Open Source Intelligence (OSINT)

Collection of publicly available data and information sources to provide actionable intelligence.

Example(s): Maltego, Shodan

Threat Intelligence

Collection of intelligence used to understand current or future threats to an organization.

Example(s): SpyCloud, Cybersixgill, Flashpoint, GreyNoise

Intrusion Detection and Prevention

Canaries

Decoy data or systems strategically placed within a network to detect and alert on unauthorized access or malicious activity, functioning as an early warning system.

Example(s): Thinkst Canary

Honeypots

Decoy servers, systems, or data to attract and analyze attacks, helping to understand threat tactics and enhance network defenses.

Example(s): KFSensor, Honeyd, Glastopf

Intrusion Detection System (IDS)/Intrusion Prevention System (IPS)

Systems to monitor and prevent network traffic using recognized security threat profiles.

Example(s): CheckPoint Intrusion Prevention System, Cisco Secure IPS

Monitoring and Operations

Analytics

Data analytics platforms to proactively monitor and analyze security data.

Example(s): Darktrace, Exabeam, Awake

Cybersecurity ETL

Processes and tools to extract, normalize, and enrich security data from multiple tools.

Example(s): Monad, Avalor, Synqly, Tarsal

Employee Monitoring

Monitoring tools for logging and measuring employee activity and productivity.

Example(s): TeraMind, Controlio

Extended Detection and Response (XDR)

Systems to aggregate and analyze data to improve threat detection and incident response.

Example(s): Cynet, Sophos XDR, Palo Alto Networks Cortex XDR, CrowdStrike Falcon XDR

Network Performance Monitoring

Platforms to visualize, monitor, optimize, troubleshoot, and report on the health and availability of networks.

Example(s): NetScout, SolarWinds Network Performance Monitor

Observability

Software for application and infrastructure monitoring, tracing, diagnostics, performance, and security.

Example(s): Sentry, Cribl, Axiom, Datadog, New Relic

Security Data Lakes

A centralized repository that stores large volumes of raw security data from various sources within commercial cloud data platforms, enabling advanced analytics and threat detection.

Example(s): Elysium Analytics, Hunters, Panther

Security Information and Event Management (SIEM)

Tools to consolidate and correlate log data for identification of security incidents.

Example(s): Sumo Logic Cloud SIEM, Devo, Securonix, Elastic SIEM, Splunk Enterprise Security

Security Orchestration, Automation, and Response (SOAR)

Automation to increase the speed, reliability, and accuracy of security operations workflows.

Example(s): Torq, Tines, Revelstoke, Cyware, Swimlane

User and Entity Behavior Analytics (UEBA)

Processes and tools to detect threats based on patterns in user behavior.

Example(s): Securonix UEBA, Exabeam Behavioral Analytics, Gurucul

Service Management

Asset Management

Processes and tools for identifying and managing IT assets and their potential security risks.

Example(s): Axonius, Armis

Configuration Management Database (CMDB)

A database for storing information about hardware and software assets. CMDBs are primarily used for IT Service Management; however, much of the data is applicable to security operations.

Example(s): ServiceNow CMDB, Solarwinds CMDB

Patch and System Management

Processes and tools for keeping applications and infrastructure up to date with patches to address bugs and vulnerabilities.

Example(s): Tanium Patch, Solarwinds Patch Manager, ManageEngine Patch Manager

Vulnerability Assessment and Management

Attack Surface Management (ASM)

The continuous process of identifying, cataloging, monitoring, and minimizing exposed and potentially exploitable points in an organization's environment.

Example(s): Balbix, JupiterOne, Upguard, NMAP

Cyber Range

Platforms for hands-on cybersecurity attack training and practice.

Example(s): Hack the Box, Cyberbit Cyber Range

External Attack Surface Management (EASM)

Identifying, analyzing, and securing an organization's publicly exposed systems, services, and data to mitigate risks from external threats.

Example(s): Detectify, CyCognito, Sevco

Penetration Testing

Intentional attacks on applications, networks, and infrastructure to identify exploitable vulnerabilities.

Example(s): Praetorian Chariot, Wireshark, Metasploit

Social Engineering

Techniques to manipulate people into exposing confidential information, allowing unauthorized access, and other human-exploitable vulnerabilities.

Example(s): Cofense

Vulnerability Management and Testing

Processes and tools for discovering, classifying, prioritizing, and remediating software and infrastructure vulnerabilities.

Example(s): Vulcan, ThreadFix, Nucleus

Services

Managed Services

Incident Response (IR)

specialized assistance from external experts to effectively manage and mitigate the impact of cybersecurity incidents to recover and minimize damage.

Example(s): CrowdStrike Incident Response Services, Kroll Incident Response and Litigation Support, Binary Defense

Managed Detection and Response (MDR)

Outsourced management and monitoring for advanced cybersecurity functions and systems, including threat intelligence, threat hunting, and incident response.

Example(s): Arctic Wolf, Red Canary, eSentire, BlueVoyant, Deepwatch, Sophos

Managed Security Service Provider (MSSP)

Outsourced management and monitoring for basic cybersecurity functions and systems.

Example(s): IBM, Verizon, Optiv

Outsourcing

External management of specific cybersecurity functions (typically operational tasks).

Example(s): TCS, Infosys, Wipro

Professional Services

Boutique

Specialized cybersecurity, privacy, or risk consulting practices within small professional services firms.

Example(s): NetSPI, Cyderes, BeyondID, Praetorian

Large

Cybersecurity, privacy, and risk consulting practices within large professional services firms.

Example(s): Optiv, Deloitte, PwC

Talent Marketplaces

Crowdsourcing

Public platforms for specific cybersecurity services, such as bug bounties.

Example(s): HackerOne, Synack, BugCrowd

Freelance Consulting

Platforms for short-term cybersecurity gigs or contracts for 1099 workers through an employer.

Example(s): EY GigNow, Toptal, Accenture Contractor Exchange, PwC Talent Exchange

The Ecosystem, Explained

Subscribe

Table of Contents