What tools does the average security operations centre (SOC) use in 2024? What gets in the way when they deploy a new tool? And how stressed are security pros really? These were just some of the questions we wanted to find out the answer to when we partnered with OnePoll at the end of 2023/the start of 2024. Together, we surveyed 250 British and Irish Heads of IT at companies with 500+ employees. Here’s what they said.

The Digital Operations Resilience Act (DORA) is an EU regulation that comes into force in January 2025, but it also impacts UK companies. DORA’s remit will likely cover any UK financial firm that works with EU customers or does business with EU financial firms.

With EDR, like other security tool types, effective performance always comes at a cost. Even if you use an EDR tool that is open source or free, your organisation will still need to invest time to configure, maintain and operate it on an ongoing basis. Sometimes, as we explain in this blog, these costs can dwarf the initial spend in getting an EDR licence in the first place. But, paying high EDR costs is not the only way to get EDR capabilities.

A SIEM’s price can be a bit of a shock. As we’ve covered in another blog, the price of a security information and event management (SIEM) solution is never just about licensing (or whatever you initially agree to pay a vendor for data processing). Even though SIEM licensing costs can easily be tens of thousands of pounds for a small organisation with less than 20 GB of monthly data flow.

As we’ve covered before, SIEMs are an expensive tool. The average enterprise-level SIEM deployment costs over £15 million a year, and operating a small, 100 to 1000-seat SIEM will still run up bills of over £10k monthly. SIEMs create spiralling costs that eat security budgets. Without a skilled team operating them, they can also make organisations less secure despite receiving more information about their digital estates. But where do these SIEM costs come from?

Staff time, log processing, and legacy issues can turn free, open-source or low-cost SIEMs into one of your organisation’s most expensive investments. You’re not alone if you’re baulking at the idea of paying upwards of tens of thousands of pounds for a new or renewed SIEM licence. Many security decision-makers feel the same way. One survey showed that almost half (40%) of existing SIEM users feel like they are overpaying for their SIEM.

MITRE ATT&CK Reconnaissance (TA0043) techniques section maps out how threat actors gather information about potential targets. Like other ATT&CK tactics (like initial access and lateral movement), reconnaissance provides useful threat intelligence on adversary tactics, techniques, and procedures (TTPs). It is a realistic approximation of what will happen if you become a target.

Why do 67% of SOC analysts feel like a new job or even a new career sounds like a good idea right now? The reason: alerts. Or, to be more specific, the fact that the time it takes for SOC analysts to deal with security alerts and tickets exceeds the amount of time they have available. The name for this phenomenon is alert fatigue.

How well do you sleep at night? Odds are you would sleep better if you could wake up to Zero Trust Architecture (ZTA). A true ZTA network makes incident response wake-up calls far less likely by shutting down data breaches, ransomware threats or any kind of unauthorised network access. It would also save your organisation at least £500,000 over a four-year period, making your security efforts much easier to advocate for. That’s the dream anyway.