Why is the cybersecurity industry broken?

The cyber security industry is broken. There are too few specialised people who are stretched to their limit dealing with too much data and overly complex security stacks with siloed tools that do not work intelligently together.

Designed by security professionals who have felt the pain of traditional tools, SenseOn’s vision is to remove the burden of mundane, repetitive work so security and IT professionals can enjoy more fulfilling careers by enabling an autonomous, intelligent and secure digital world.

Fight off threats faster with 40% less SOC investigation time.

SenseOn hyperautomates threat detection and response, giving you unparalleled visibility and protection.

Monitor identity, endpoint, network and cloud-based activity to stop threats as soon as they occur.

thumbnail_senseon.jpg

senseon.jpg

SenseOn

Knowing the current and potential threats that  present the greatest risk to your orgainisation, and proactively ensuring that the right people, process and technology solutions are in place to mitigate against them.

Threat intelligence is information on specific cyber threats to your organisation.  

Threat intelligence moves the goal posts: rather than responding to an attack, threat intelligence enables an attack to be prevented.  This can be anything from breaking up and arresting a cyber criminal group, to identifying the attack vectors and profiles in advance of attack,  then ensuring sufficient protections and mitigations are in place.  

Threat intelligence is gained from large data sources shared between cyber security companies, on global network and dark web activity, and also from honey pots, which are simulations of an actual company network, that then attract the attacks of criminal groups targeting the specific company.

Threat intelligence enables the delivery of ATP / Advanced Threat Protection.

Threat Intelligence

Services and solutions enabling detection of and response to cyber security breaches.   

Services include those delivered from a Cyber Security Operations Centre (SOC or CSOC) where a 24/7 team monitors for cyber breaches, and responds in real time when breaches are identified.

Solutions include technologies that firstly monitor for breaches, secondly flag when the occur, and thirdly facilitate remediation or best available response to a breach.

Managed Detection and Response (MDR) is generally the term used for the service, and Extended Detection and Response (XDR) is the term used for products or solutions used in MDR.

XDR is broken down into Network Detection and Response (NDR) - which deals with identifying threats at the network level, along with providing the appropriate response, and Endpoint Detection and Response (EDR), which deals with identifying threats at the endpoint, along with providing the appropriate response.

Managed Detection and Response  - MDR - and Extended Detection and Response - XDR

Endpoint security is providing protection against cyber attack for all an organisations' devices that exist on the edge of a corporate network. This can include servers, PCs, Macs, mobile phones, tablets, other user devices, and IoT (Internet of Things) devices. 

Endpoint security includes: 
EDR (endpoint detection and response), 
EPP (endpoint protection platforms), network firewalls 
IDPS, (intrusion detection and prevention systems), 
NDR (network detection and response), IAM (identity and access management), email security, mobile threat detection, 
SSE (security services edge), 
SIEM (Security Incident and Event Management), 
SOAR (security orchestration automation and response) 
...,all of which collectively are now known as XDR (Extended Detection and Response).

VPNs or Virtual Private Networks are an essential part of endpoint security, protecting against phishing or web-based attacks.

Endpoint Security

Providing the intelligence, insights, toolsets, and analytics, alongside best practice response preparedness, so that, in the event of a cyber breach, your company will be able to mitigate exposure, minimise business losses, and fast track recovery to normal operations.

Incident Response

Delivering technology and services that provide protection against ransomware and other categories of malware.

Ransomware is the term for the type of malicious computer code,  or 'malware', that cyber criminals use to encrypt corporate data, and then demand a ransom for unencrypting.   Paying a ransom is wrong as it finances criminals, and encourages further attacks against the same organisation.  Due to companies paying ransoms, ransomware is still one of the greatest cyber threats.  

A company can implement multiple layers of cyber defence against ransomware, and can also, in the event of a ransomware attack still being successful, ensure that its system and data backup and restore capabilities are robust and resilient, which would remove the need to pay a ransom.

Typically, encryption by Ransomware is at the end of a cyber attack cycle, which can last months, and after corporate data has already been breached and exfiltrated.

Ransomware is the most pervasive and costly form of malware. 

Malware is the broader term for any software that is used to illegally access networks, spread on networks, and damage, destroy systems and data, and / or cause that data to be leaked.

Ransomware and malware protection services

Delivering platforms, products, or services to identify, manage, and mitigate against insider threats.  Insider threats, also known as insider risks, are when a trusted insider (employee or contractor) who has authorised system access, intentionally or accidentally performs actions that damage a company's ability to operate effectively.

The damage can range from a data breach to causing corporate system shutdowns or system damage to non IT related damage, such as financial crime, violence, or physical damage.



Intentional insider threats can take the form of violence, corporate espionage (e.g. IP / trade secret theft for bad actors / foreign Govts), physical or virtual sabotage, theft. financial crime.

Unintentional insider threats are caused by system users being used by third parties, e.g. via phishing attacks, or credential breaches, to damage and encrypt systems, and steal data.

There is also the coerced insider threat, where a staff member is coerced or blackmailed by a third party. into performing damaging actions.


Insider Threats 

Systems and services related to getting value and competitive advantage from your company data.  Analytics can be descriptive, diagnostic, predictive, or prescriptive.

Data analytics applications include marketing, portfolio, risk, people, software, and digital analytics. 

**Marketing optimisation analytics**

Determining how effective marketing campaigns are and guiding marketing decisions and strategy

**People analytics**

Analysing behavioural data to understand how people are managed, how they perform, and helping improve the Human Resources function within organisations, and ultimately the overall performance of the company itself.

**Portfolio analytics**

Using analytics to understand value and risk in a portfolio - be it of lenders, stock holdings, financial holding etc. - and then drive strategy to minimise risk and optimise returns.

**Digital analytics**

Analysing "digital data" relating to computerised and internet activities.  Digital data includes user clicks, user behaviour, keyword searches, etc.

**Security analytics**

Analysing data either on premise or in the cloud to flag cyber threats, cyber threat actors, cyber attacks, and to deliver post breach forensics on an attack.

Data Analytics

Implementing people, process, and technology solutions to help companies reduce the risk of cyber attack. Providing information and consultancy services to enable companies to be cyber secure.  