Carlo embarked on the journey to globalize the service he had created. What he discovered over the next three years amazed him. In fact, it really got him worried. On the front lines, engaging with hundreds of organizations worldwide, something was terribly wrong. Instead of getting more secure, companies and organizations were more vulnerable than ever.
What Carlo learned next is the reason LMNTRIX exists.
Only one percent of all attacks are detected through logs. This is an astounding number and SIEM has proven to be a particular failure. Interviews with IT teams delivered this frustrated indictment of SIEM: “Stupidly Irrelevant Electronic Messaging” (actually they called it something a whole lot worse, but we’re too polite to say that here). They said SIEMs produced too many alarms. MSSPs aren’t doing much better for those who depend on them
The boy had cried wolf too many times. Now the wolf was freely roaming these networks devouring whatever it wanted.
So what did these three facts really mean? They meant almost everyone had things inside out.
With the median number of days before a breach was detected at 229 and 67% of companies only learning of a breach when an external entity told them, it was obvious that organizations had to make a mental shift.
They needed to stop fixating on the perimeter and start looking at their network more like an obstacle course where hackers could be deceived, worn down, paralyzed and ultimately thwarted. You protect what matters; they go away empty handed. This was about changing the economics of hacking. Make the cost of the hack impossible for the hackers to justify and you win
From the instant an attacker penetrates your network, all they can see is an elusive mirage where every single data packet is unreliable. This deceptive environment immobilizes attackers as they are unable to make decisions if the data they’ve gathered is unreliable.
The LMNTRIX Active Defense is a validated and integrated threat detection and response architecture for addressing advanced and unknown threats that bypass an organizations perimeter controls.
We use a combination of advanced network and endpoint threat detection, deception everywhere, analytics, and global threat intelligence technology. These are complemented with continuous monitoring together with threat hunting both internally as well as on the deep and dark web. It is a fully managed, security analyst delivered service that defends against zero-day attacks, and advanced persistent threats from our cyber defense center, 24 hours a day, 7 days a week.
