Cybersecurity Modernization in Hybrid Cloud
Key Points
- The shift to hybrid‑cloud environments and wider AI adoption is reshaping cybersecurity programs, compelling security teams to modernize their approaches.
- Modern threat management now expands beyond traditional log collection, normalization, and correlation to include real‑time network‑flow analytics (NDR) and user‑behavior analytics for faster detection.
- Anomalies such as a sudden spike in a contractor’s data downloads can be identified instantly via flow analytics, enabling security operations centers (SOCs) to respond to threats in near real‑time.
- Most breaches stem from the actions of a single user, so modernized security stacks focus on identity‑centric monitoring and the ability to sift through massive data “needle stacks” to isolate the true threats.
Sections
- Cybersecurity Modernization Fueled by Cloud and AI - Bob Kalka explains how hybrid cloud and AI are compelling cyber teams to update threat management and SOC practices.
- Missing Incident Response Playbooks - The speaker highlights that most organizations lack defined and tested incident response playbooks, urging broader security awareness, use of cyber ranges, and automation, especially as they adopt hybrid cloud and AI.
- Stealthy AI-Powered Threat Management - The speaker explains that traditional EDR tools are vulnerable to smart malware, advocating for hypervisor‑based, AI‑enhanced, proactive security and open‑platform approaches to modernize threat management.
- Modernizing Cyber Teams with Microservices - The speaker outlines how adopting microservices, open platforms, and unified workflows on an elastic cloud infrastructure accelerates security analysts and tackles the operational challenges of hybrid‑cloud deployments.
- Federated Investigation Drives Unified Workflow - By employing federated search to query data directly in the cloud, organizations avoid costly data egress, accelerate real‑time investigations, and integrate detection, confirmation, and playbooks into a single, unified console for modern cyber threat management.
- Hybrid Cloud Data Visibility Gap - The speaker notes that merely 7‑30% of organizations are confident they know the location of their sensitive data, and as they transition to hybrid cloud environments, traditional controls diminish, driving a need for coordinated IAM and data protection innovations.
- Adaptive Access: MFA on Steroids - The speaker explains that adaptive access augments traditional multi‑factor authentication with real‑time behavioral and fraud‑detection analytics—such as typing patterns—to dynamically assess risk and trigger step‑up authentication when needed.
- Data Security Posture & Insider Threat - The speaker stresses the surge in data security posture management, calling for robust encryption and access controls, long‑term monitoring of sensitive data access, and leveraging that visibility to detect insider threats.
- Modernizing Proactive Threat Management - The speaker outlines a shift to an open, integrated security platform that proactively maps attack surfaces, unifies analyst workflows, secures data through identity, encryption and access controls, and automates compliance and insider‑threat detection.
- Building a Unified Cyber Defense Platform - The speaker explains how acquiring Ran Dory for attack‑surface management, integrating React’s hypervisor‑based Q Radar EDR, leveraging a cyber range, and launching Hue Radar Log Insights on an open‑source ClickHouse backend together create an integrated, proactive security ecosystem.
- Polar‑Powered Guardian Insights Overview - The speaker explains how Polar’s multi‑layer posture management and long‑term sensitive‑data monitoring are integrated into IBM’s cloud‑native Guardian Insights, helping analysts adapt to hybrid‑cloud, AI‑driven security challenges.
Full Transcript
# Cybersecurity Modernization in Hybrid Cloud **Source:** [https://www.youtube.com/watch?v=ObeUOeh1eck](https://www.youtube.com/watch?v=ObeUOeh1eck) **Duration:** 00:38:36 ## Summary - The shift to hybrid‑cloud environments and wider AI adoption is reshaping cybersecurity programs, compelling security teams to modernize their approaches. - Modern threat management now expands beyond traditional log collection, normalization, and correlation to include real‑time network‑flow analytics (NDR) and user‑behavior analytics for faster detection. - Anomalies such as a sudden spike in a contractor’s data downloads can be identified instantly via flow analytics, enabling security operations centers (SOCs) to respond to threats in near real‑time. - Most breaches stem from the actions of a single user, so modernized security stacks focus on identity‑centric monitoring and the ability to sift through massive data “needle stacks” to isolate the true threats. ## Sections - [00:00:00](https://www.youtube.com/watch?v=ObeUOeh1eck&t=0s) **Cybersecurity Modernization Fueled by Cloud and AI** - Bob Kalka explains how hybrid cloud and AI are compelling cyber teams to update threat management and SOC practices. - [00:03:09](https://www.youtube.com/watch?v=ObeUOeh1eck&t=189s) **Missing Incident Response Playbooks** - The speaker highlights that most organizations lack defined and tested incident response playbooks, urging broader security awareness, use of cyber ranges, and automation, especially as they adopt hybrid cloud and AI. - [00:06:20](https://www.youtube.com/watch?v=ObeUOeh1eck&t=380s) **Stealthy AI-Powered Threat Management** - The speaker explains that traditional EDR tools are vulnerable to smart malware, advocating for hypervisor‑based, AI‑enhanced, proactive security and open‑platform approaches to modernize threat management. - [00:09:30](https://www.youtube.com/watch?v=ObeUOeh1eck&t=570s) **Modernizing Cyber Teams with Microservices** - The speaker outlines how adopting microservices, open platforms, and unified workflows on an elastic cloud infrastructure accelerates security analysts and tackles the operational challenges of hybrid‑cloud deployments. - [00:12:32](https://www.youtube.com/watch?v=ObeUOeh1eck&t=752s) **Federated Investigation Drives Unified Workflow** - By employing federated search to query data directly in the cloud, organizations avoid costly data egress, accelerate real‑time investigations, and integrate detection, confirmation, and playbooks into a single, unified console for modern cyber threat management. - [00:15:38](https://www.youtube.com/watch?v=ObeUOeh1eck&t=938s) **Hybrid Cloud Data Visibility Gap** - The speaker notes that merely 7‑30% of organizations are confident they know the location of their sensitive data, and as they transition to hybrid cloud environments, traditional controls diminish, driving a need for coordinated IAM and data protection innovations. - [00:18:46](https://www.youtube.com/watch?v=ObeUOeh1eck&t=1126s) **Adaptive Access: MFA on Steroids** - The speaker explains that adaptive access augments traditional multi‑factor authentication with real‑time behavioral and fraud‑detection analytics—such as typing patterns—to dynamically assess risk and trigger step‑up authentication when needed. - [00:21:53](https://www.youtube.com/watch?v=ObeUOeh1eck&t=1313s) **Data Security Posture & Insider Threat** - The speaker stresses the surge in data security posture management, calling for robust encryption and access controls, long‑term monitoring of sensitive data access, and leveraging that visibility to detect insider threats. - [00:25:01](https://www.youtube.com/watch?v=ObeUOeh1eck&t=1501s) **Modernizing Proactive Threat Management** - The speaker outlines a shift to an open, integrated security platform that proactively maps attack surfaces, unifies analyst workflows, secures data through identity, encryption and access controls, and automates compliance and insider‑threat detection. - [00:34:18](https://www.youtube.com/watch?v=ObeUOeh1eck&t=2058s) **Building a Unified Cyber Defense Platform** - The speaker explains how acquiring Ran Dory for attack‑surface management, integrating React’s hypervisor‑based Q Radar EDR, leveraging a cyber range, and launching Hue Radar Log Insights on an open‑source ClickHouse backend together create an integrated, proactive security ecosystem. - [00:37:32](https://www.youtube.com/watch?v=ObeUOeh1eck&t=2252s) **Polar‑Powered Guardian Insights Overview** - The speaker explains how Polar’s multi‑layer posture management and long‑term sensitive‑data monitoring are integrated into IBM’s cloud‑native Guardian Insights, helping analysts adapt to hybrid‑cloud, AI‑driven security challenges. ## Full Transcript
Hi, I'm Bob Kalka with IBM Security, and I'd like to talk to you today
about a fascinating topic.
And that is how cybersecurity programs are modernizing.
I think it's stating the obvious to point out that most organizations
and their IT
investments are migrating towards hybrid cloud and leveraging AI
more, and that is creating some essential physics in the industry
that are forcing cyber teams to modernize as well.
So what we're going to talk about today is what exactly is going on
with cyber modernization, because cyber modernization
is really occurring across two major areas right now.
The first one is how do you actually do threat management?
So for most organizations, that would be
how do you run your security operations center or SOC?
And the way most organizations do that today, it's it's pretty straightforward.
It's not easy, of course, but it's pretty straightforward where everybody starts...
is that you start by making sure
that you can detect threats
and then that you can respond to threats.
I used to say, you know, you'd have to find the needles
in the haystack of what looks suspicious and then go fix what you find.
And I had a client somewhat politely inform me
that he said, well, you're not really trying to find needles in a haystack.
You're trying to find needles in the needle stack because everything looks bad.
I said touche, exactly right.
So how do organizations do this today?
And this is just table stakes, right?
This isn't the modernization part of it.
So the way everybody does this today is you start by collecting,
normalizing, correlating reporting and monitoring on logs.
Right..and so we pull all that data together.
There's lots of different sources that are being pulled in here,
and we cross-reference and normalize and see what's going on.
Now, logs are just the starting point, though,
because, of course, that's just looking at stuff
that's already happened to somewhere out there.
So where almost every organization then migrates
is also looking at real time network flow analytics.
And some people even go as far as calling this network detection response or NDR.
So you can see that, for example, if you have a contractor
and your typical contractor downloads three
confidential documents a week and all of a sudden you have a contractor
downloading 300 confidential documents, Flow analytics
allows you to get there and figure out that that's happening in real time.
And they were most organizations then as go up their user
behavior analytics because that's where you get that.
Then add in what are actual people and what are specific identities doing.
And our 95% of our problems coming from the actions of a single user, for example.
And then as it is transforming,
we essentially get into hybrid cloud.
And this is the source of some of the physics issues
that I was referring to, and I'll get to that in a moment now.
So once an organization works on
being able to process all of these things for finding the needles
in the needle stack, then of course, where we go is
how do you actually respond to those threats?
And unfortunately, most studies still show that the vast majority of organizations
still have not defined and tested incident response playbooks
or run books for the major events they're worried about.
So I'm going to write the default state as a null said,
I was a math minor in college and I like math symbols.
That means that most organizations are making up their incident
response playbooks
after something happens and it doesn't take a social psychologist
to point out that the worst time to come up with a collaborative
plan is when everybody's running around pointing fingers at each other.
So the way to improve that is first to grow awareness
outside of just the cyber team that security really is everyone's job.
And that's where things like cyber ranges come in really handy.
And then ultimately, not only defining, but automating
the incident response playbooks.
Okay.
That's how the typical threat management organization works today
and what they seek to do is
how do we continually get more mature of how we're doing this.
Okay, so that's just the way it exists today.
However, when an organization is migrating to hybrid cloud and leveraging A.I.
more, as I said, there's some physics issues that cause
cybersecurity teams to have to modernize.
And in threat management, the first of the two use cases
I'm going to take you through.
There are three ways this cyber teams are modernizing.
The first one is based on the stark reality, and it's amazing that nobody
was really thinking about this until about a year and a half or two years ago.
But all of our threat detection activities are generally reactive.
What I mean by that is that all these different sources right
coming into our detector are generally sent technology
to to do security analytics is responding to signals of things
happening to us right now.
So in other words, bluntly, we're not really looking for attack
able surfaces until they're getting attacked,
and then we're trying to find out as quick as possible what's going on.
So there are obviously two leads to the obvious question, which is
why don't we get proactive about looking for attack able surfaces
and then protecting those surfaces before anyone does attack?
So that's the first of the three trends in cyber modernization
for threat management is the fact that what we're realizing
that we need to do now is not only do it the way we've been doing it,
but we also need to identify
the attack surface proactively.
So we go from reactive only into proactive
and with the term everybody to use in these days
is attack surface management for the right reasons, right.
And then lockdown and protect
the most attacked surfaces, starting with endpoints.
And of course, most organizations
will have some kind of EDR tooling in place today.
But what we're finding is there's some Achilles heels
to most of those tools, such as the fact that the malware is getting smarter.
And if it sees it's being watched, then what it will do
is it won't fire right while it's being watched by the EDR tool.
So what we see is the need for greater stealth.
For example, running EDR as a hypervisor as opposed in the operating system.
And then this is one of many, many areas where A.I.
is a huge plus because, for example,
a lot of EDR tools essentially operate on signatures.
And of course the malware is constantly evolving.
And so if you as an air engine, then you can actually detect new
strains, live and protect a live, right?
So this ability to get proactive about finding the attack surface
and about protecting the surfaces, not only endpoints, also transactions,
devices and stuff like that,
that is the first of three ways
that cyber teams are modernizing the threat management.
You have to get proactive.
The second way cyber teams are modernizing is literally following
the lead of what I.T in our Agile DevOps teams and organizations are doing,
and that's building cyber on an open platform.
Now what do I mean by that?
So let me show you this because this is actually pretty dramatic.
What I mean by that
is that when you look at the typical cyber
tools today,
every cyber tool has functionality that, you know,
you use to do this cool cyber protection stuff, whatever happens to be.
And then underneath that tool is some kind of built in infrastructure
that the vendor had to build in, you know, like a data store and stuff like that.
So as you grow and perform and do more with it, it grows and performs with you.
And so development shops have to not only build the functionality
that you care about, but it also has to build and maintain that infrastructure
code in each and every solution that you use.
So when you think of the terms technical debt, the typical organization
has dozens of cyber tools
that has this functionality you want and this infrastructure underneath
that has to be improved and updated
and stuff as usage grows, etc..
So what we realized a couple of years ago is that as organizations
move to hybrid cloud and kind of have a greater focus
is that we really we should really be building new cyber functionality
on top of the open platform of, of course, Docker and Kubernetes.
In our case, of course for us,
starting with Red Hat, OpenShift, since it's Enterprise Grade Kubernetes,
and being able
to actually get rid of having to write that code underneath each app
and what it does is it frees development shops to innovate a lot faster
and what it allows our clients to do is that instead of when there's
a new functionality coming in, instead of putting
in another thing of technical debt, instead you just turn it on and off.
Microservices, right?
Leveraging the scalable elastic platform underneath it.
So open platform building this stuff on an open platform
has become an absolutely huge thing, not only writing
cyber as microservices, running on Docker and Kubernetes,
but also leveraging all other open standards such as Click House
for Scalable Elastic database underneath the solutions.
Right?
So that's the second way Cyber teams are modernizing is shifting
towards microservices, which are just far easier to consume
and far easier to innovate on faster.
Now that's the second one.
So it's getting proactive and secondly, moving to an open platform.
And then the third one is kind of the, you know, icing on the cake.
It's the big thing.
And the big thing is, is that as cyber teams
start modernizing by getting proactive and building in an open platform,
then there is some net benefit which is very measurable
to our security analysts.
In particular, we see analyst acceleration, meaning
security analysts are able to do things
much faster than they've done before.
And there's two particular innovations in the industry
that we've helped steer spearhead that have had a dramatic impact.
The first one is called Federation
and the second one is a unified workflow.
What are these things?
Well, remember I said at the beginning there's some physics problems
as you move to hybrid cloud.
Here's one of the fundamental ones, is that as your organization starts
deploying workloads in one or more cloud providers,
then obviously you're going to start generating cyber relevant,
relevant information in one or more clouds.
And as you do that, of course, what everybody says is,
I know what to do with that data.
I'm going to go over here to the tech bubble
and I'm just going to constantly pull that data into whatever right.
I'm using for Syn to evaluate that stuff.
The problem there, of course, is twofold.
Number one is that the cloud business model is to
have you move more to it, not take off of it.
So the cloud providers charge you an egress charge to pull that data
off of the cloud, to pull it into your local tooling and depend.
Then depending on what local tooling you're using, you have to pay
and pay an integral charge, right, to ingest that data.
So in essence, to do what we've done for the last 20 years
in the cyber industry, which is pull everything into that one place,
is that you're signing up for potentially a double tax
that's only going to get larger and larger, right?
I've heard CFO say to assist CISOs in the past,
you're not really thinking clearly.
I'm not going to give you approval to do that.
And so what happens is the physics of it
is you start to do some unnatural acts.
We see some clients
that will say, Well,
I'm just not going to collect all that data
because I don't want to pay that egress charge.
Or they'll say, I'll pre process on the cloud platform and then send it down.
But then you lose a lot of the richness of the data that the SIM tool is.
It's a good one right.
Can do a lot of of of analysis on
so that's causing a serious problem across the industry right now.
What federation means is Federated Search and Federated investigation.
When you see an indicator of compromised, what you're able to do is instead of
having to pull that data from the cloud, instead you can just query it.
You don't have to move it, and then you do a real time investigation.
So your investigations are faster and you completely eliminate.
Those were basically permanent taxes, the egress and just charge it.
And so that's federation.
So that's one radical thing that is all about cyber modernization.
The second one is unified workflow.
One of the things we discovered is that when you start doing Federated
Investigations, you're able to actually build a workflow
from proactive detection
confirmation kicking off playbooks.
You can all do that as a unified workflow.
And because you're able to query what other tools are seeing instead
of having to run around and check each tool for what
they're seeing and something you see it all on a single console.
So you have a unified workflow
and a unified gully by which you can see what all the tools are saying.
All right.
So that's the first of the two major parts of what
we're going to share cyber modernization and threat management.
It's all about getting proactive about attack, surface management and protection.
Secondly, is going to an open platform.
So you shift from building technical debt constantly enough to integrate stuff
all the time
to just going to turning it on and off microservices on an elastic platform.
And then finally is we're able to literally accelerate
how the analysts do their job through federation and unified workflow.
So that's the first of the two.
Now let's talk about the second
major area that is seeing big changes
from cyber modernization, and that is data protection.
You know,
oftentimes our conversations with cyber organizations is data security
is always important, but it's usually kind of a 20% discussion, maybe 30%.
And 6070 is under threat management.
And we've seen a big change in part because of increased
regulations in part because there's a lot of war stories out there.
Right.
Of data getting compromised across hybrid cloud and stuff like that.
So data protection, we're also seeing a massive change
because as organizations go to hybrid cloud, what it's doing
is essentially accentuating problems that were already there.
But we had figured out in the past organizations had figured out in the past
how to put in compensating controls to address the problem.
You know, a big example of this is that I've seen a couple of studies
on what percentage of organizations are confident
they know where all their sensitive data is in a hybrid cloud deployment.
And in the numbers that I've seen are between seven and 30%
feel confident they know where all their sensitive data is.
And my typical conversation with a, you know, CISO
or a CISO is whenever I share that statistic,
they'll laugh and say, yeah, and that 7 to 30% are lying.
All right. We know it's an ongoing issue.
So once you go to hybrid cloud, where as you may have been able
to put compensating controls before around data protection, it was all on prem.
Once you go to hybrid cloud, you kind of lose
that control, especially if you have agile DevOps teams putting out workloads.
Sometimes you're not even fully aware of, Right.
So what is happening there?
Well, what we're seeing is the way cyber teams are modernizing
their data protection is by focus,
sitting on a discrete set of controls
that allow them to do the following.
How do you make sure
that only the right users
have only the right access
to only the right data
for only the right reason?
And all the projects that we're doing with clients?
What we're seeing is that there is a coordinated set of controls
for hybrid hybrid cloud data protection with some cool innovation
that I'm going to share with you here of making sure that you have both the IAM
the identity and access management system as well as the data protection
beyond it all working together to do this well.
So let me take you briefly through what are the controls that we see
most organizations focused on and what are the innovations
that are essentially the modernized way of doing data protection?
So first of all, how do you make sure that only the right users can come in?
What everybody starts with is governance,
identity, governance, who has access to what?
Because, look,
if you don't know who has access to what, I can do anything else, right?
The second thing that we see everybody focused on right now
is privileged account management.
You know, somehow 20 years after Sarbanes-Oxley, this is still a
major problem, but it comes from the fact that Pan is not simple.
The technologies are really good out there to do it, but
getting the processes and getting a whole organization to work together
well to implement it across the board has always been a tough out.
And so the typical shop we walk into will have
some privileged account management but spotty deployment.
But now that we're seeing like cyber insurance providers, a lot of them now
will not reissue or renew a policy if you don't have pan across the board.
That's driving a ton of the tension here. Right.
And then ultimately, where you want to get to here is identity analytics.
And what this means is it's kind of like an identity posture thing.
You say who has access to what, but does that really make sense?
Right?
So we see a lot of activity of focusing on controls to be able to do this.
Then the next thing is I'm letting the right users
in how to make sure they only get the right access.
Of course, I mean, for 20 plus years. Right.
And the whole idea of access management
has been fundamental and continues to be in the industry.
But the white hot piece for modernizing
this part of it is what a lot of people are calling adaptive
access and what is adaptive access.
It essentially is multifactor authentication, MFA on steroids, right?
What do I mean by that?
So typical MFA tool bobs on the same
laptop, configured in the same way from the same location
that is connected to me the last 250 times.
So when he goes comes in for the 251st time, that sounds like a low risk thing.
However,
if you pull in a lot of fraud detection algorithms
that have been developed over the years,
especially in the financial services industry, you can detect that.
Well, you know, but if you look at Bob's typing rate
and his error rate and his typing,
you know, Bob, that might not be Bob,
we need to do some quick, you know, step up authentication.
So adaptive access is all about
essentially advanced ways of applying MFA.
So you start looking behaviorally at what's going on out there in real time.
And so that's really cool.
Then once we've got the right users getting the right access,
then we get to the right data and remember the seven or 30%, are they lying?
They actually are confident.
They know where all their sensitive data is.
There's three
pieces that have gotten white hot very quickly here.
The first, which has been around a while,
is how do you identify
sensitive data across a hybrid cloud environment?
Right?
So it's discovering classification, but it's doing it consistently,
including reaching into not only on prem and hybrid cloud environments,
but also into cloud native apps.
This has been a blindspot for everybody for a while.
It's how do you detect it?
Someone's taken a copy
because they had legitimate access to a piece of sensitive data,
but then they put it, for example, in a Slack message
and send it to some people who weren't supposed to have access to it.
Nobody said visibility to that.
So the ability to do identification
of sensitive data, even into SAS apps has become huge.
And then the second piece, which is also gotten huge very quickly, is posture.
What does this mean?
What does data security posture mean?
There's a new term that's being bandied about a lot and rightfully
so, called DSP and data security posture management.
And what DSP is all about is not only do
I know where the sensitive data is, but then
who can access that data if,
regardless if they're accessing it yet, who can actually look at that data?
And does that make sense?
And then third is who's actually looking at it.
So once again, find the sensitive data
anywhere, including in apps.
Look at who can get access to it.
The posture essentially is that good or bad
or do we have to make changes and then who's actually looking at it?
So this whole idea of data security posture management
once again has gotten hot very, very quickly for obvious reasons.
And then once you find it, you've got to protect it.
All right.
So let's protect that
sensitive data that includes data level access control.
It includes data encryption, of course.
Right. Etc., etc..
So being able to do this one,
this one is so white hot right now, it's not even funny.
So that's a huge one.
And then let's get to the last piece.
Make sure the right users get only
the right access to only data for only the right reason.
What does that mean?
Well, I've seen for decades I've been doing cyber for almost three decades now.
And as I've worked with clients on this, everybody would like to look at access
to sensitive data over long periods of time,
but most don't because it takes a lot of storage space
and they don't have the algorithms really to check it.
But looking at access to sensitive data over a long period of time has always been
something that people have wanted to do and yet few do.
And so I'm going to start with another null set here because few people do this.
What we see people wanting to do is
look at things like, how can I detect insider threat activity
by looking at what's happening with access to sensitive data?
And then ultimately, because we're seeing this acute problem
in most shops with increasing regs, the amount of time that the teams
are having to spending to prove compliance, adherence to regulations
is starting to get out of control in some places.
And so not only being able to detect things like insider threat,
but then also being until automatically generate compliance
reporting and stuff like that. Right.
So that has become a big deal.
So this is what's happening out there on modernizing data protection.
It's around getting our act together on identity management better.
It's getting into looking at the data security posture,
not only protecting it, but also including that obviously,
and then looking at access to sensitive data over long periods of time.
So you can find things that frankly, you missed the first time.
Okay.
So at IBM, we have been investing around addressing this stuff for three
or four years because we saw this coming rate, IBM as a hybrid cloud in a company.
So not only how are we addressing the hybrid cloud
stuff that comes
up, but we're also infusing a AI, right?
We made our major announcement of our Watson X platform
and we are infusing AI across almost every piece
that you see up here in our technologies that we've done to do this.
so that's what we're seeing happening to cybersecurity programs,
how they're really being driven to modernize
as the organizations around them are modernizing the hybrid cloud
and leveraging A.I. much more.
So it's modernizing how we do threat management,
getting proactive about finding the attack surface
and protecting the surfaces rather than wait till someone attacks them.
And then secondly, is moving to an open platform.
So you get all the advantages of innovation
and integration and scalability and performance,
and then ultimately enable your security analysts to accelerate
what they do through Federated search and Investigation,
as well as a unified workflow.
And then on data protection, making sure that you have an integrated view
of both identity and access management, as well as data security,
including proactively and constantly identifying,
discovering the sensitive data, checking its posture, who can get access to it?
Does it make sense? Who's accessing it?
Does it make sense? Right.
Protecting that data through encryption and data level, access control, etc.
And then also looking at data usage over long periods of time
to be able to detect problems like insider threat and ultimately
being able to automate compliance reporting as much as possible.
So our teams aren't just stuck on that all the time.
That's what's going on with cyber today.
That's something
that we're very passionate about that we've invested a lot in to address.
And so thank you for your time.
If you like this video and want to see more like it, please like and subscribe.
If you have questions, please drop them in the comments below.
So what I'm going to close with is just show you a quick mapping
of what we're actually doing across these things.
So what we've done for proactive
identification of the attack surface is we acquired about a year and a half ago
a company called Ran Dory out of Cambridge, Massachusetts.
They were the leader in the very young,
fresh space of attack surface management and ran.
Dory is now part of us for protect for endpoint management.
We went out and find this and
found this incredibly innovative company called React to about two years ago.
A lot of the Netherlands and we now call that Q radar EDR
and that is an incredible tool
that does run as a hypervisor and has an air engine attached to it.
And so it addresses the Achilles heels that I mentioned
that a lot of EDR tools out then for detect and respond.
Most people are well aware of our cue radar platform and this is our key radar SIM
and Q Radar saw,
and most people are also aware
that we have a credible cyber range
that help that, you know, hundreds of clients have used
to help the organization all realize that, yes, cyber is everybody's job
and how do we work together better for the open platform?
We have gone all in on this and we announced something
just recently called Hue Radar Log Insights.
And what curator log insights gives us
is essentially going to open standards,
open source for the back end for our capabilities based on Click house.
Right.
And one of the if not the leading elastic databases that's cloud native.
And so we're essentially providing the ability to have this elastic back end.
So the discussion around having to build infrastructure in our solutions,
which is used as the infrastructure, right?
So very powerful.
And then this analyst acceleration piece, this federated search and investigation,
as well as a unified workflow, we announced just recently our Q
radar suite, which gives us the ability to do those things.
And to be honest with you,
we've actually had the federated support for a couple of years now.
It's just people are realizing
how powerful it is of getting rid of those egress charges and stuff like that.
So that's the threat management side of things.
And then on the data protection side of things for user
and access management, that of course is our verified portfolio.
And we also
have our Z secure portfolio extending that to the mainframe.
So we also have that.
And then for data protection for for identifying the data,
for doing the posture management and then actually protecting the data.
It is our Guardian platform.
We have Guardian
data protection, we have Guardian data encryption
number one product in the market, and then we also,
for the posture management just announced just recently
our acquisition of an Israeli company called Polar Security.
So Polar gives us the ability to do that posture management that I mentioned,
the three layers of it, including seeing the data in the SAS apps,
incredibly powerful, a great addition for us.
And then the final piece of being able to look at sensitive data
access over long periods of time and seeing trends, etc..
That is our cloud native extension to Guardian, that's called Guardian Insights
and that
includes the polar capability as well.
That helps as well.
And you'll see us integrate that stuff together.
So that's what's going on with cyber cyber modernization
as organizations are going to hybrid cloud and leveraging A.I.
more, it's causing those physics such as those egress
charges and stuff that we in the cyber space have to adapt to.
And what we've done in IBM security have been investing for several years now
to allow you to do those things, to ultimately deliver that increased value
of being able to get the analyst to do their job much better as being
able to innovate for you far