Softcat Overcomes the Cybersecurity Labor Shortage with Swimlane

Background

The cybersecurity labor shortage is felt across the globe by all industries. This challenge is compounded by sheer volume of different tools in use impacting teams across enterprises, not the least of which are security teams. By automating repetitive processes like Phishing or SIEM alert triage Softcat enables their talent to spend their time on more critical work, and in return retains their talent.Swimlane’s low-code security automation helped Softcat gain operational efficiencies and retain talent, which were key drivers for building out their cyber services offerings.

No Company is Immune to the Cybersecurity Skills Shortage

Matt Helling, Softcat’s head of Cyber Services business, shares, “As clients continue to mature their cybersecurity practice internally, they are having to adopt more platforms. To manage these platforms they need more staff. To grow their staff, they need to find and recruit qualified people and then continuously nurture and develop them. It’s very difficult. We built our services to try and eradicate some of those issues, to essentially take the platform problem and people problem away from our customers and take it on ourselves.”

Softcat realized early on that the same cybersecurity labor shortage felt by their customer would affect them, too. Even though their location in Marlow, just outside of London, provides high availability to talent, it’s also hyper-competitive and expensive to hire headcount. In order to build out Softcat’s service offering, they needed to hire, train, develop, and retain a core group of security analysts to support their customers.

To keep this group of top, hard to recruit, analysts engaged Softcat needed to limit the amount of tedious alert management they were requiring analysts to do. Mundane or overly repetitive work is not a good use of a senior analyst’s time. The dilemma is compounded by the fact that it cannot be solved by passing manual alert triage off to junior analysts who are not skilled enough to handle high-volumes of alerts. This is how threats get buried in noise, and mistakes are made. Although 99.9% of alerts are very low risk, it only takes missing a tiny percentage of high-risk alerts to put both Softcat, and their customers, in a vulnerable position.

Softcat knew that automation was the only way to truly solve this complex problem. They needed a robust automation platform that would take the manual labor of trafficking every alert off the staff and allow them to free their time for critical events and analytical work.

Managed service providers (MSPs) oversee multiple clients’ infrastructures and this leads to thousands, if not tens of thousands, of incoming alerts that all need some level of action. Without automation, this requires a human to investigate each alert and go from platform to platform to platform to close a ticket. With that volume of alerts, it’s inevitable that something critical will be missed.

Analysts also get burned out on monotonous work, like constantly triaging low-fidelity alerts. They didn’t become a forensic analyst or security analyst to just sit and close out tickets all day. They’d rather be doing strategic work, and their skills are in high demand so it is not hard for analysts to find opportunities to grow, develop, and build out their skills.

Outside of London, provides high availability to talent, it’s also hyper-competitive and expensive to hire headcount. In order to build out Softcat’s service offering, they needed to hire, train, develop, and retain a core group of security analysts to support their customers.

To keep this group of top, hard to recruit, analysts engaged Softcat needed to limit the amount of tedious alert management they were requiring analysts to do. Mundane or overly repetitive work is not a good use of a senior analyst’s time. The dilemma is compounded by the fact that it cannot be solved by passing manual alert triage off to junior analysts who are not skilled enough to handle high-volumes of alerts. This is how threats get buried in noise, and mistakes are made. Although 99.9% of alerts are very low risk, it only takes missing a tiny percentage of high-risk alerts to put both Softcat, and their customers, in a vulnerable position.

Softcat knew that automation was the only way to truly solve this complex problem.. They needed a robust automation platform that would take the manual labor of trafficking every alert off the staff and allow them to free their time for critical events and analytical work.

Quick Wins with Automation

When employees incorrectly enter a password too many times, they get locked out. As innocent as this is, it was the number one use case for Softcat to solve because it would create thousands of tickets each month. This would require analysts to spend anywhere from three and eight minutes to resolve, while the employee remains locked out and unproductive.

At an average of five and a half minutes per ticket this low-risk use case would have demanded more headcount or automation. After the quick fix of automating this use case, Softcat built out additional use cases covering a variety of areas, such as custom reporting.

30% Growth in Customer Acquisition: Return on Investment (ROI) on technology investments is critical. Swimlane makes it easy to track ROI through intuitive dashboards and reporting. One of the biggest impacts noted by Softcat is around the costs associated with adding each new customer. So far, Softcat has automated 14 use cases through Swimlane’s platform, enabling them to onboard 30% more customers with no headcount increase. And their team still has bandwidth to increase capacity beyond this.

System of Record for Security: A major benefit of Swimlane’s integrations with other solutions in Softcat’s environment is that their analysts can use Swimlane as their primary interface to interact with these solutions. When they deployed a new SIEM after implementing Swimlane, they realized early on that it would be much easier to integrate through Swimlane rather than try and train people to use yet another platform.
Retain and Grow Security Talent: Swimlane has also allowed Softcat to invest in and promote their staff. The level-one analysts they brought in originally to handle the high volume of alerts have now had their time freed up. This has allowed Softcat to further train and develop these analysts and promote them into more senior positions. As Helling pointed out, “This investment in our people allows us to retain those people.”