Security Automation Cuts Breach Costs in Half, New Research Shows

A growing divide in breach costs separates businesses that implement advanced security technologies from laggards, according to a new report.

Announcing the results of a global study examining the financial impact of data breaches, IBM researchers revealed last week that companies with fully deployed security automation are saving an average $3.58 million per breach compared to those that have yet to deploy this type of technology. The cost gap has grown by $2 million, or 29 percent, from a difference of $1.55 million in 2018, IBM researchers said.

“Companies studied who had fully deployed security automation technologies (which leverage AI, analytics and automated orchestration to identify and respond to security events) experienced less than half the data breach costs compared to those who didn't have these tools deployed – $2.45 million vs. $6.03 million on average,” according to the report.

The research reveals a clear advantage by companies that have invested in security automation, especially as the industry's talent shortage persists. And while this has been true for years, it is beginning to sting even more for companies lagging behind the times.

Advanced attacks are difficult to detect because those that carry them out employ tools, techniques and procedures (TTPs) that individually make the behavior seem normal. An advanced attack can go undetected for days, weeks, even months, significantly increasing the risk of a costly breach. One culprit is that analysts cannot assess every single alert manually and determine the priorities for further investigation.

Bitdefender GravityZoneUltra Plus is equipped with specialized machine learning and event correlation models that enable the detection of soft indicators typically missed by overburdened staff or ill-fated security tools, providing early attacks detection. Automatic alerts triage presents a clear story that analysts can easily read and understand. It reduces the time spent triaging alerts and enables faster incident response.

As cybersecurity architectures become complex and skilled security staff become scarce and costly, decision makers should seek solutions that offer integrated prevention, detection and response across endpoint, network and cloud to reduce security architecture complexity, operational effort and skills level required.