Role of security vendors in the ever growing cyber threat landscape

In today’s world, technology has become more integral to our daily lives than ever before. We enjoy numerous advantages, such as instant access to online information, the convenience of smart home automation, and innovations like the Internet of Things (IoT). Despite these benefits, the pervasive presence of technology also means potential threats are ever-present across devices and platforms.

As our dependence on technology increases, so too does the need for strong cybersecurity measures to protect our digital lives. This is where cybersecurity vendors and solution providers play a crucial role, identifying potential security risks long before hackers have a chance to exploit them.

In the ever-growing cybersecurity landscape, security vendors indeed play a very vital role. They offer a wide range of security solutions, from firewalls to threat intelligence platforms. Their offerings complement each other, which further helps organizations to build a robust defense strategy.

Security vendors also provide specialized expertise and dedicated teams to monitor and understand new and evolving threats. Unlike in-house teams, which may be stretched thin, vendors focus solely on cybersecurity. They contribute in a big way to enhance cyber resilience by providing expertise, tools, and collaborative solutions.

VARINDIA spoke to a few cybersecurity companies and vendors to have a clear understanding of the technologies and techniques used in their products for threat detection and response - 

Juniper Networks believes in extending security to every point of connection  

Pankaj Kitchlu   
Sales Engineering Director (India-Saarc) - Pre Sales, Juniper Networks  

“At Juniper Networks, our approach to threat detection and response is built on a comprehensive and integrated security framework that ensures robust protection across all points of connection. We leverage several key technologies and strategies -

SRX Platform: Our SRX platform is a critical component of our security architecture. It includes advanced hardware and software solutions designed to protect the network edge, data centers, and cloud applications.
Juniper Advanced Threat Prevention (Cloud ATP): Juniper ATP serves as our central threat intelligence hub. It uses artificial intelligence and machine learning to detect and respond to sophisticated threats.
Connected Security Approach: We integrate security directly into the network infrastructure, ensuring that protection is not limited to traditional perimeter defenses.

SASE Architecture: Our Secure Access Service Edge (SASE) architecture combines networking and security functions to deliver secure access to cloud applications.

Cloud-Delivered Solutions: We offer our security solutions as both cloud services and on-premises appliances. This flexibility allows organizations to choose the deployment model that best suits their needs while benefiting from the ease of management and scalability provided by our cloud-delivered services.

Juniper Networks believes that extending security to every point of connection, from client to cloud, across the entire network can build a safe and secure IT infrastructure across any business organization. Our security solutions utilize AI and automation to ensure that every single touch point is properly evaluated and secured, full proofing the entire network, while accurately predicting attacks.”

The strategic focus of ManageEngine is on continuous monitoring and alerting   

Ram Vaidyanathan      
 IT Security Evangelist, ManageEngine   

“ManageEngine continuously prioritises threat detection and response in our comprehensive digital enterprise management platform. Through a variety of integrated technologies, our platform offers centralized log and event management, employing SIEM capabilities to gather and analyse logs from multiple sources for real-time detection and correlation of security events. ManageEngine Log360, a unified SIEM solution, assesses traffic patterns to identify unusual activities that might indicate security breaches.

With real-time surveillance of networks, systems, and endpoints, our security solutions generate immediate alerts for quick incident response. Automated response capabilities leverage predefined rules and workflows to address specific security threats rapidly. We also facilitate compliance and reporting with solutions that produce detailed reports and maintain audit trails for regulatory and internal auditing needs. Our forensic analysis tools help in investigating and managing security incidents, while automated patch management and vulnerability remediation features address and prevent security vulnerabilities.

An integration with Constella, a leading dark web threat intelligence provider, Log360's threat investigation workbench leverages user analytics, threat intelligence, and process analytics to investigate alerts and add evidence to existing cases. ManageEngine has also helped organizations meet regulatory compliance requirements through tools that enforce security policies and generate compliance reports. For example, if a customer needs to comply with the PCI DSS or HIPAA, Log360 offers continuous monitoring and auditing of their IT environment to ensure adherence to security policies while generating reports needed for compliance audits.”

Barracuda ensures robust threat detection by leveraging cutting-edge technologies 

Pranay Manek   
Manager, System Engineering, Barracuda Networks   

“At Barracuda, we leverage cutting-edge technologies and strategies to ensure robust threat detection and response capabilities in our security products. Our approach is heavily centered on artificial intelligence and machine learning algorithms, which allow us to analyze vast amounts of data in real-time and identify potential threats with high accuracy. Additionally, we have developed a multi-layered defense strategy, combining network security, email and application protection, and endpoint security to provide comprehensive coverage. Our threat intelligence network gathers data from millions of data points globally, allowing us to stay ahead of evolving cyber threats.

With the increasing frequency and variety of cyberattacks, the need for comprehensive security measures has never been greater. Barracuda XDR’s Security Operations Center (SOC) team sees first-hand how attackers try to target and exploit any security blind spots. A recent example is an attempted ransomware attack on a company that had deployed security on most, but not all its devices. Unsecured endpoints are easier to breach and keep attack activity hidden from security monitoring tools due to lack of visibility. 

In this instance the attackers successfully targeted unprotected machines to secure a foothold in the network and launch the next phase of the attack. However, as soon as they hit devices and systems that were protected, the security tools started detecting and blocking any further malicious activity: killing, quarantining, and remediating the threat files. Following clean up and restoration, the victim was advised to extend security to all devices to prevent and remediate any future attacks.”

Kaspersky committed to building a safer and secured world 

Jaydeep Singh  
General Manager for India Region, Kaspersky 

“Kaspersky has been focusing on threat research for over two decades. With petabytes of rich threat data, advanced machine learning technologies and a unique pool of global experts we work to support customers with the latest threat intelligence from all over the world. Artificial intelligence, machine learning, behavioural analysis, graphic visualization tools and signature-based detection are the technologies that play a major role in Kaspersky products and solutions. Kaspersky Threat Intelligence is a service that provides evidence-based knowledge, context and actionable recommendations about cyber threats.

One example of how we use behavioural analysis to detect threats is the Kaspersky Managed Detection and Response (MDR) solution which uses telemetry data from endpoints and machine learning to automatically detect and analyse security incidents.

Another strategy is the use of KSN, Kaspersky Security Network, a complex distributed infrastructure developed by Kaspersky Lab. It is one of the most important components of our multi-layered, next generation approach to protection.

Kaspersky has been joining hands with international organisations and global IT security vendors to fight against cybercrime. We collaborate with law enforcement agencies and CERTs all over the world, and take part in cyber threat investigations and conduct training for cybersecurity specialists and for international police organizations. Our collaboration with the Dutch police led to the arrest of suspects behind the Coinvault ransomware attacks. We also assisted INTERPOL in the Africa Cyber Surge operation to disrupt cybercrime in African countries, which resulted in the arrest of 14 perpetrators.”   

SonicWall time and again reiterates its commitment to protecting customer networks  

Debasish Mukherjee   
Vice President, Regional Sales, Asia Pacific Japan, SonicWall  

“SonicWall products integrate a range of advanced technologies and strategies to deliver effective threat detection and response. Central to their approach is Real-Time Deep Packet Inspection (DPI), which scrutinizes network traffic for malicious content and anomalies at a granular level. SonicWall's solutions leverage the Capture Advanced Threat Protection (ATP) service, which utilizes cloud-based sandboxing to analyze and identify sophisticated threats, including zero-day attacks, in a secure environment before they can impact the network.

Additionally, SonicWall employs machine learning and behavioral analysis to detect deviations from normal network patterns, enhancing their ability to spot previously unknown threats. A key component of our strategy is Zero Trust Network Access (ZTNA), which enforces strict access controls and continuously verifies the identity and integrity of users and devices, ensuring that only authorized entities can access network resources.

SonicWall has a history of effectively managing and mitigating cybersecurity incidents and vulnerabilities for their customers. For example, SonicWall is quick to roll out updates and patches to address any vulnerabilities identified in their products. We also provide comprehensive guidance and support to help affected customers secure their networks and recover from any attack. A notable instance was with SonicWall’s VPN appliances, which were exploited. SonicWall promptly issued a series of security advisories and patches to address the vulnerability, working closely with affected customers to mitigate the risk. Our rapid response and transparent communication during such incidents reiterates our commitment to protecting customer networks and maintaining trust.” 

Securonix uses advanced technology to combat the power of AI-driven threats  

Ajay Biyani 
Vice President, APJ, India, Middle East & Africa, Securonix 

“At Securonix, we use advanced technology and techniques to improve threat detection and response like our AI-reinforced Securonix EON suite which specializes in predictive threat detection. There are two main innovations -

•    Cyber Data Fabric: This modular architecture enables security analysts to classify and organize data smartly, so that only the required subset of data i.e., most relevant data is analyzed in real-time or stored for forensic and compliance requirements.
•        Noise Canceling SIEM: AI-powered feature that filters up to 50% of irrelevant alerts so that our CyberOps team can focus on the most critical threats. It identifies obscure data patterns, decreasing false positives, and increasing analyst effectiveness. Also, it uses SOAR LITE to orchestrate investigations and remediation, enabling faster response with less impact.

Technologies like these help security teams save time, lower costs, and work more efficiently, helping to turn CyberOps into a force that can stand up against the growing power of AI-driven threats.

We have deployed our SIEM solution to effectively mitigate various cybersecurity vulnerabilities, addressing both external and internal threats for our customers. For example, Persistent Systems, a global services company, struggled with security management across on-premises and cloud workloads due to their legacy SIEM, which caused scalability issues and limited detection capabilities. By adopting Securonix's next-generation SIEM, Persistent Systems achieved comprehensive coverage, eliminating blind spots and enabling real-time visibility. We also partnered with India’s largest financial bank, serving nearly 50 million customers, to enhance data security during their digital transformation journey.”

Synechron boasts of a comprehensive cyber incident response Plan   

Umesh Bhapkar    
Senior Director, IT & Information Security, Synechron  

“At Synechron, we employ a layered defence approach which comprises a set of technologies and strategies for threat detection and response such as advanced threat detection, intrusion prevention, threat intelligence and hunting.  These are designed to provide early warning of potential threats, enable rapid response to incidents, and ensure that our cybersecurity posture remains robust against evolving threats.

When addressing past cybersecurity incidents or vulnerabilities, it's important to manage crises effectively, learn from experiences, and improve the overall security posture of the organisation. At Synechron, we have a comprehensive and well thought out cyber incident response Plan that covers play books created to cover various cyber-attack scenarios and the same is tested through a proper tabletop exercise. Maintaining effective communication with channel partners is crucial for aligning them with your cybersecurity goals and strategies. At Synechron, we recognize that strong, collaborative relationships with our vendor partners are key to ensuring a unified approach to cybersecurity. By maintaining open, transparent, and proactive communication with our vendor partners, we ensure that they are fully aligned with our cybersecurity goals and strategies.” 

Check Point ensures its customers are protected from sophisticated cyber attacks   

Manish Alshi     
Senior Director, Channels & Alliances, Check Point Software Technologies India & SAARC   

“At Check Point, our approach to threat detection and response is grounded in a comprehensive, multi-layered security architecture that ensures robust protection against both known and unknown threats, leveraging the intelligence of our Check Point ThreatCloud AI solutions.

1. 
   1.    Threat Intelligence and Prevention Framework:
   •    ThreatCloudAI: We leverage ThreatCloudAI, Check Point’s collaborative threat intelligence platform, which aggregates data from millions of sensors globally. This platform analyzes and shares real-time threat information to block potential attacks before they can impact your systems.
   •    Advanced Threat Prevention: Our products are equipped with multiple threat prevention engines, such as antivirus, anti-bot, URL filtering, and anti-ransomware, to safeguard your network. These engines work in harmony to detect and mitigate threats across all attack vectors.
2. 
   2.    Advanced Detection and Response Technologies:
   •    Threat Emulation and Threat Extraction: These technologies are key components of our Check Point SandBlast Zero-Day Protection suite. Threat Emulation (sandboxing) proactively detects and blocks unknown threats by executing suspicious files in a virtual environment, while Threat Extraction removes potential threats by delivering clean, reconstructed files in real-time.
   •    Behavioral Analysis and AI & Machine Learning: Our solutions employ advanced behavioral analysis and machine learning algorithms to identify and respond to anomalies that could indicate an emerging threat.
   
   3.    Automated Response and Remediation:
   Automation and Orchestration: Our products feature automation and orchestration capabilities that enable quick, coordinated responses to threats. This minimizes the time between detection and remediation, significantly reducing the risk of damage from attacks.
   
   4.    Comprehensive Reporting and Analytics:
   Centralized Management: Through Check Point’s SmartConsole, security teams can manage threat detection and response from a single pane of glass. This centralized platform provides detailed reports, analytics, and insights, enabling teams to make informed decisions and improve their security posture continuously.”

Tenable successfully plugs vulnerabilities found across critical assets of businesses 

Scott Caveza   
Staff Research Engineer, Tenable 

“Tenable One, the exposure management platform, unifies security visibility, insight, and action across the attack surface. The platform’s active scanning, passive monitoring of OT and IoT networks, external attack surface management, and CMDB integrations help organisations gain the visibility they need to reveal impactful vulnerabilities across the environment. This aids security teams in taking rapid, decisive action as the Tenable Predictive Prioritization technology brings together vulnerability data, threat intelligence, and data science to close critical exposures and execute remediations.

When news of the log4j vulnerability became public, Tenable provided complimentary access to Tenable Web App Scanning. It enabled organisations to thoroughly test web servers and identify the risk of exploitation from a hacker’s perspective. As Tenable Web App Scanning complements other vulnerability detections in Tenable Vulnerability Management, it provides organisations with full visibility across the attack surface, helping them plug the vulnerability across assets that are most critical to business continuity.

Tenable’s log4j local detection plugin was released to perform additional checks on Windows, Linux, Unix, and Mac OS systems, where the running processes on machines are inspected for any references of a log4j archive. Once Tenable scans identified as many log4j archives as possible on the targets, their locations and versions were logged to the scanner’s knowledgebase. This data was passed to dependent plugins that use a variety of methods to determine if the application code is vulnerable.” 

Skybox committed to safeguarding customer environments through proactive security measures  

Aftab Syed    
Country Manager, Skybox Security   

“Skybox employs a robust threat detection and response strategy centered on advanced vulnerability prioritization and threat intelligence. By meticulously evaluating vulnerabilities based on severity, importance, exploitability, and network exposure, Skybox empowers security teams to focus on the most critical risks. Leveraging internal and external threat intelligence, Skybox constructs a comprehensive attack surface map, surpassing industry standards. 

To stay ahead of the evolving threat landscape, Skybox continuously invests in R&D, incorporating customer feedback and industry trends. Advanced AI and machine learning techniques, such as Random Forest, Bayesian algorithms, and NLP, are employed to rapidly process vast amounts of data, ensuring no vulnerabilities slip through the cracks. Additionally, Skybox's adoption of CVSS 4.0 scoring provides customers with an even more accurate assessment of risk. 

Our global teams excel at identifying and addressing potential vulnerabilities, often going above and beyond to mitigate risks inherited from previous security solutions. By tailoring risk scoring to align with each customer's unique business needs, we empower organizations to prioritize vulnerabilities effectively.

For example, when a major customer faced a critical vulnerability in their network, our team rapidly mobilized to assess the situation, develop a tailored remediation plan, and provide ongoing support to ensure the issue was resolved effectively. This proactive approach, combined with our deep technical expertise, enabled the customer to mitigate the risk and prevent a potential breach. Our customer success managers also foster strong relationships with clients, providing ongoing support and guidance.”

Offering unmatched visibility into threats through diverse sources   

Jyothi Prakash  
India Head, Google Cloud Security   

“Google Threat Intelligence combines the unmatched depth of our Mandiant frontline expertise, the global reach of the VirusTotal community, and the breadth of visibility only Google can deliver in a single offering. By combining our comprehensive view into the global threat landscape with Gemini, we have supercharged the threat search processes, augmented defense capabilities, and reduced the time it takes to identify and protect against novel threats. Google Threat Intelligence offers unmatched visibility into threats through a diverse set of sources including Google threat insights, Frontline intelligence, Human-curated threat intelligence, Crowdsourced threat intelligence and Open-source threat intelligence.

Google Threat Intelligence infuses our threat research with AI to increase coverage, proactively mitigate risk and reduce the time it takes to protect against new and novel threats. We use machine learning algorithms, natural language processing, foundation models, and advanced analytics to harness AI-driven automation. These capabilities can help organizations with some of the more challenging manual threat intelligence tasks and enables automated data fusion and enrichment, anticipatory actionable warnings, semi-autonomous malware analysis, adaptive rule generation, intelligent report generation and vertebral threat dissemination.

Google Security Operations, an intelligence-driven and AI-powered platform that empowers security teams to better defend their organizations by effectively detecting, investigating, and responding to cyber threats. Formerly known as Chronicle, we have introduced new innovations designed to reduce the do-it-yourself complexity of SecOps and enhance the productivity of the entire Security Operations Center.”

ESET uses technology that goes far beyond the capabilities of basic antivirus  

Pamela Ong    
Sales Director - APAC at ESET  

“ESET adopts a prevention-first approach which mitigates the risks posed by advanced threats, and minimises the time security teams have to spend on incident response and remediation. The best strategy for countering the ever-evolving attacks starts with shrinking the attack surface. It requires robust protection across email, endpoints, cloud applications, mobile devices and entire networks.

In terms of technology, a single layer of defense is not enough in today’s constantly evolving threat landscape. We employ a multitude of proprietary, layered technologies and human expertise working together as ESET LiveSense, that goes far beyond the capabilities of basic antivirus. This includes advanced machine learning and 110 million sensors worldwide to enable us to react immediately to the needs of our customers and keep ESET responsive to the latest threats.

Some of ESET’s core technologies that work together as ESET LiveSense are –
•    At the pre-execution level, the core technologies used are – Reputation and Cache, Network Attack Protection, UEFI Scanner, Advanced Machine Learning, Device Control, DNA Detections, Brute-Force Attack Protection, and In-product Sandbox.
•    At the execution level, technologies like Ransomware Shield, Script Scanner & AMSI, Advanced Memory Scanner, Exploit Blocker, and Deep Behavioural Inspection are used.
•    At the post-execution level, technologies used are – LiveGrid Protection, Secure Browser and Botnet Protection.”

Aligning cybersecurity goals and partner strategy

The Global Cyber Security Market size is expected to be worth around USD 533.9 Billion by 2032 from USD 193 Billion in 2023, growing at a CAGR of 11% during the forecast period from 2022 to 2032.

Cybersecurity is essential in our digital age, aimed at safeguarding sensitive information and digital assets from cyber threats. It involves a range of measures, technologies, and practices to ensure data confidentiality, integrity, and availability. As our reliance on technology and the internet grows, having strong cybersecurity solutions and most importantly a strong cybersecurity strategy and goal is becoming more critical than ever.

Aligning cybersecurity goals with your partner strategy is crucial for creating a robust and resilient security posture. Ensuring that partners follow the cybersecurity best practices set by the organization also becomes essential for maintaining a secure ecosystem. This can be achieved by setting clear goals and expectations, providing training and resources, sharing best practices and case studies, conducting regular audits and fostering open communication.

Jaydeep Singh says that Kaspersky provides a dedicated portal for our partners, in which they can access and learn about new products, maintain their customer database and subscriptions, and manage orders. “We regularly communicate with our partners and provide them training to help them learn about new solutions and upgrade their skills so that they can optimise on upselling opportunities,” he says.

According to Pankaj Kitchlu, maintaining effective communication with its partners is crucial for aligning Juniper’s cybersecurity goals and strategies. “We employ several strategies to ensure this alignment like Regular Updates and Training, Collaborative Engagement, Shared Resources and Tools, Feedback Mechanisms and Alignment of Goals and Objectives. We work closely with our partners to align our cybersecurity goals with their business objectives. By focusing on these strategies, we ensure that our channel partners are well-equipped to contribute to our cybersecurity goals, ultimately enhancing the effectiveness of our solutions and supporting our shared success in the market,” he explains.

SonicWall maintains effective communication with its channel partners through a variety of structured and strategic methods that align with our cybersecurity goals and strategies. “Regular and transparent communications are facilitated through dedicated partner portals, newsletters, emails and webinars, which keep partners informed about new product releases, security advisories, and best practices. SonicWall also organizes periodic partner events and forums where they share insights on emerging threats and strategic direction, fostering a collaborative environment. This proactive approach helps align partners with SonicWall's cybersecurity objectives and ensures a unified strategy in addressing evolving security challenges,” contends Debasish Mukherjee.

As a 100% channel-first company, Tenable is committed to collaborating with channel partners including leading security technology resellers, managed service providers, distributors, and ecosystem partners worldwide. “We invest in equipping channel partners with the training, certification, and collaboration necessary to deliver Tenable’s industry-leading vulnerability management solutions and custom services to customers everywhere,” says Scott Caveza.

“As a 100% channel-driven company, Check Point recognizes that our partners are integral to our success, and thus, we view them as an extension of our team,” opines Manish Alshi. “Through initiatives like regular partner engagement, providing comprehensive training and enablement, and adopting a collaborative and an adaptive approach, Check Point ensures that our communication with channel partners is not just effective but also strategically aligned with our overarching goal of delivering the finest cybersecurity solutions globally. This collaboration ensures that our initiatives are not only top-down but also reflective of partner insights, making our communication and strategies both adaptive and aligned with real-world needs.”

“At Securonix, 70% of our business transactions take place through the channel route showcasing our commitment to working with partners,” says Ajay Biyani. “We work hand in hand with our partners to create tailored services that meet the needs of their clients while aligning with our cybersecurity objectives. Our approach is adaptable to cater to the varying requirements of partner types ensuring targeted communication, for achieving collective cybersecurity goals.”

As a channel-focused business, ESET prioritises partner enablement and collaboration to help them grow their business alongside the company’s. “We ensure that our partners are well-informed about emerging threats, product updates, and best practices. 

We host regular training sessions, webinars, and workshops to keep our partners up-to-date on the latest developments in cybersecurity,” says Pamela. “Additionally, we provide them with access to our comprehensive partner portal, where they can find resources, technical support, and marketing materials that align with our shared cybersecurity goals.”

Moreover, maintaining effective communication with the partner ecosystem also helps in promoting engagement with a global community of cybersecurity experts. It also becomes equally important for security vendors to equip their partners with innovative security products, solutions and services that sets them apart in the market, which in turn helps them in differentiating business, maximizing opportunities and accelerating profitability.

By fostering strong relationships and open lines of communication, a company’s partners are equipped to deliver the highest level of protection to its customers.