The cybersecurity industry is flooded with acronyms and product categories. While intentions are good in terms of grouping related products and shortening product descriptions, having so many acronyms and categories brings more confusion than utility for building effective cloud-native application security strategies.
When cybersecurity categories worked
Market categories are meant to validate the need and opportunity to sell products with certain characteristics to solve customer problems. For vendors, they validate that a market exists for their products, helps them forecast sales opportunities and determines marketing investments based on whether they can capture a portion of the total addressable market for a category.
Ideally, categories should align with customer needs and budget line items. If a product category solves a problem, it justifies budget allocation. Think of going to a store with a shopping list of items you need, then selecting the products that deliver value and meet your needs at a fair price.
In technology business-to-business industries, categories were useful when software product development cycles were longer. Back in the day, vendors had long cycles to develop and release products. This included product development, testing, marketing development, naming the product, planning pricing and packaging a physical product to ship.
Vendors had the opportunity to build and define categories, with the goal of being the only vendor to meet the required needs for features and functions in their category. Then it was exciting to see if category leaders could stay ahead as newer companies tried to unseat them.
Category sprawl for software products and services
The pace of software releases and innovation is much faster today. Instead of designing physical products, we have cloud services that provide platforms and infrastructure to streamline development processes.
A huge benefit to this model is that users don’t have to wait for long periods of time for new products and updates. Developers can use continuous integration and continuous delivery pipelines for efficient collaboration to rapidly build new products and release updates. Newer technologies and their rapid evolution, including low- and no-code development and assistive technologies such as generative AI, will continue to make it easier to produce software.
But that creates a problem, too. Companies rapidly create, release and update new types of products that provide value by solving key problems for customers, which creates category sprawl.
Categories align with vendor products, not customer needs
Having spent most of my career in marketing, I admit responsibility in this area. I spent years at vendors briefing industry analysts and influencers about the unique qualities of each product I was marketing. Part of the driver was to not compete with existing products in established categories. If my product’s features wouldn’t stack up against other vendors in an existing category, the plan was to create a new category.
Let’s face it: Categories aren’t aligning with customer needs to release secure applications and protect their workloads from attacks and threats.
The problem is that categories have emerged when vendors released new products addressing gaps, but adding multiple products doesn’t help organizations protect their cloud applications against threats and attacks.
Let’s face it: Categories aren’t aligning with customer needs to release secure applications and protect their workloads from attacks and threats. The real problem is that hackers don’t think in terms of product categories either — they just look for vulnerabilities they can exploit.
My TechTarget Enterprise Strategy Group research on cloud security posture management showed that while most organizations say they have strong products and services in place, a vast majority (94%) have faced security incidents in the past 12 months. These incidents resulted in the introduction of cryptojacking malware to mine cryptocurrency, remediation steps that affected service level agreements, unauthorized access to applications, regulatory fines and data loss.
Our latest research, “The Life and Times of Cybersecurity Professionals Volume VI, 2023,” found the biggest cybersecurity skills gaps are in application security and cloud computing security. Selecting, deploying, managing and using tools takes time, and manual, tedious processes can burn out staff. Adding more security tools that generate more alerts simply doesn’t scale.
Solving problems with tool consolidation and integrations
How can organizations address this? Look for products that effectively address your top challenges while enabling your teams to work efficiently. Organizations are moving to platform approaches and tighter product integrations to pull data together to reduce the work of using multiple siloed tools.
Consider the following key considerations for an effective cloud application security strategy:
Collaborate with and support development. I’ve written previously about opportunities to incorporate security into cloud-native development processes. The first step is to talk to developers and align on goals, such as deploying secure applications, optimizing remediation workflows, etc. Then, collaborate to automate the right security processes and tools to ensure consistency across development teams. This includes testing and setting policies as guardrails, increasing developer efficiency in releasing software that is secure and tested, and remediating issues quickly when they are found in runtime.
Use cloud service provider (CSP) security features and integrations. Each CSP is architected differently with security features and capabilities in its cloud platform, but each also provides capabilities and features to help its customers secure what they put in the cloud. Using the CSP’s features or their integrations with third-party security tools can optimize efficiency compared to needing multiple point tools from separate vendors.
Focus on gaining context for efficiency for rapid remediation and faster response. A lot of elements scale rapidly with modern software development, including access and permissions, APIs, infrastructure as code and open source software. While these are valuable tools for faster development, they add risk and attack surfaces that need to be addressed. It can be tempting to add more tools in these areas, but if they all generate alerts, separate reports or dashboards, it will take manual work to review their output, and you won’t be able to remediate issues in time to avoid incidents. Look for products that can give you context to prioritize what has the highest impact on reducing risk or that can help you rapidly respond to threats and attacks.
Stop the acronym madness
How often do you see new acronyms and have to look them up? And what is included in each category when many seem to overlap? Start with the following:
Static application security testing (SAST).
Dynamic application security testing (DAST) in application security.
Stop the acronym madness. Instead of building a security strategy around shopping with a list of acronyms or categories, look for tool consolidation and integrations to efficiently solve the problems.
Enterprise Strategy Group is a division of TechTarget. Its analysts have business relationships with technology vendors.
This website uses cookies. By continuing to use this site, you accept our use of cookies.
Manage Consent
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
