Using situational awareness to improve threat response effectiveness

Every organization wants to improve its cyber-defenses. But doing so requires continuous adaptation to ensure that the security operations (SecOps) team is equipped to respond to evolving threats. Finding new ways to defend the organization from a security incident is an unending task. According to a recent Forbes study, 68 percent of organizations are actively planning to improve their incident response capabilities in the next 12 months.

One of the most effective approaches to enhancing incident response capabilities is improving situational awareness by incorporating threat intelligence.

Improving situational awareness with threat intelligence

In a lot of ways, daily cybersecurity work is similar to a speed chess game, where the board is changing rapidly and understanding the strategic context about what is happening at each moment is the key to winning. In military terms this called “situational awareness.” Reaching this level of understanding with better threat intelligence is essential to improving the metrics on threat response. The threat landscape will constantly change, so the ability to integrate and use threat intelligence may be the difference between success and failure.

In a recent Ponemon report, 78 percent of security practitioners said that threat intelligence is now a critical part of achieving a strong security posture. But based on the actual use of the technology, it’s clear there’s a long way to go. According to a McAfee study, only 42 percent of organizations are currently using threat intelligence. The lag between identifying the need and deploying threat intelligence leaves most organizations less equipped to deal with the broad spectrum of threats.

Challenges to implementing threat intelligence

The biggest challenge organizations face when implementing threat intelligence is how to integrate it into their current security infrastructure. To be effective, it needs to be incorporated into the incident response and remediation process. Swimlane delivers a comprehensive automated incident response and security orchestration platform that effectively leverages threat intelligence to enable a SecOps team to react faster and more intelligently.