Cyber asset attack surface management (CAASM) is focused on enabling security teams to overcome asset visibility and exposure challenges. It enables organizations to see all assets (internal and external), primarily through API integrations with existing tools, query consolidated data, identify the scope of vulnerabilities and gaps in security controls. These tools then continuously monitor and analyze detected vulnerabilities to drill down the most critical threats to the business and prioritize necessary remediation and mitigation actions for improved cyber security.
Exposure assessment platforms (EAPs) continuously identify and prioritize exposures, such as vulnerabilities and misconfigurations, across a broad range of asset classes. They natively deliver or integrate with discovery capabilities, such as assessment tools, that enumerate exposures, like vulnerabilities and configuration issues, to increase visibility. EAPs use techniques like threat intelligence (TI) to analyze an organization’s attack surfaces and weaknesses, and prioritize treatment efforts for high-risk exposures by incorporating threat landscape, business and existing security control context. Through prioritized visualizations and treatment recommendations, EAPs help provide direction for mobilization, identifying the various teams involved in mitigation and remediation. EAPs are primarily delivered as self-hosted software or as a cloud service, and may use agents for exposure information collection.
The IT risk management (ITRM) market focuses on solutions that support the ITRM discipline through automating common workflows and requirements. For the purposes of defining this market, IT risks are risks within the scope and responsibility of the IT department. These include IT dependencies that create uncertainty in daily tactical business activities, and IT risk events resulting from inadequate or failed internal IT processes, people or systems, or from external events.
The amount of information being transmitted from things continues to rise. Much of this data originates outside of the enterprise. The scale of security risks in the Internet of Things (IoT) era is therefore much greater than in the pre-IoT environment, and the 'attack surface' is much larger. Most sensor-based things have minimal computing resources, and the opportunities for antivirus, encryption and other forms of protection within things are more restricted. Therefore, IoT security products with a variety of capabilities emerged to help dispel some of these challenges.
The medical device security solutions market addresses software; hardware; and network and data protection requirements for IoMT devices. These solutions enable organizations to manage IoMT devices securely; ensure IoMT endpoint and data integrity; and perform asset discovery. They share many technologies and processes used in IT and cyber-physical systems (CPS) security, such as deep packet inspection and risk identification. Medical device security solutions can help CIOs engender trust and provide safe, secure and reliable digital care delivery products and services.
Gartner defines SaaS management platforms (SMPs) as software tools that aim to help organizations discover, manage, optimize and automate the SaaS application life cycle from one centralized console. Core SMP capabilities include discovery, cost optimization, employee self-service via an application store, insights to increase adoption and automation of onboarding/offboarding activities. As SaaS adoption accelerates, IT leaders will struggle to discover and support SaaS-hosted applications in accordance with company, market or geographic policies and regulations. Increased SaaS costs — combined with limited visibility into the entire SaaS portfolio (including unapproved SaaS) and high levels of overdeployed and underconsumed licenses — result in significant financial, operational and cybersecurity risk.