A Definitive Market Guide to Deception Technology

IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
Paula Musich
Research Director, Security and Risk Management
Enterprise Management Associates
pmusich@emausa.com
A Definitive Market Guide to
Deception Technology

Watch On-Demand Webinar
• A Definitive Market Guide to Deception Technology On-Demand
webinar is available here:
http://info.enterprisemanagement.com/a-definitive-market-guide-to-
deception-technology-webinar-ws
• Check out upcoming webinars from EMA here:
http://www.enterprisemanagement.com/freeResearch

Featured Speaker
Paula Musich, Research Director, Security and Risk Management
Paula brings over 30 years of experience covering the IT security and
networking technology markets. She has been an IT security analyst for
ten years, including as a research director at NSS Labs, and earlier as
the principal analyst for enterprise security for Current Analysis. As a
security technology analyst, Paula has tracked and analyzed competitive
developments in the threat management segment of the information
security market, ranging from advanced anti-malware to next-generation
firewalls and intrusion prevention systems to content security, data loss
prevention, and more.
Slide 3 © 2019 Enterprise Management Associates, Inc.

Sponsors

Agenda
• Introduction, Methodology, Demographics
• Advantages of Deception
• Application of Deception
• The who, what, how, and where of deception technology
usage
• Attitudes about deception from evaluators of the
technology

INDUSTRY ANALYSIS & CONSULTINGSlide 6 © 2019 Enterprise Management Associates, Inc.
“Successful war follows the path of
deception.”
~Sun Tzu, The Art of War

Introduction & Methodology
• Deception ≠ Honeypot
• Doesn’t draw attacker
attention
• Highly accurate
• Market populated by
small vendors
• Methodology
• 208 respondents
• 65% in IT & 6% in
cybersecurity outside IT
• 26% in IT supervisor or
above roles

Demographics
• Company size
• 50% Midsized/SME
• 48% Enterprise
• Using deception
• 55%
 24% highly familiar
 23% good familiarity
• Company size using
deception
• 82 Midsized; 32 Enterprise
• Vertical Industries
• 18% retail
• 16% finance
• 12% healthcare
• 23% other
• IT Budget
• 17% $50 - <$100 million
• 16% $25 - <$50 million
• 13% $10 - <$25 million
• Geography
• Primarily serve North America

Advantages of Deception Technology

Detection Effectiveness Compared
How would you rate your organization's ability to detect and respond to in-network
attackers early in the attack cycle?
49%
42%
7%
1%
1%
70%
30%
0%
0%
0%
0% 10% 20% 30% 40% 50% 60% 70% 80%
1- Highly effective
2- Somewhat effective
3- Neither significantly effective or
significantly ineffective
4- Somewhat ineffective
5- Highly ineffective
All Respondents Deception Users Highly Familiar with the Technology

Average Dwell Time Compared
What was the longest approximate time in days it took to detect a threat inside your
network (a.k.a. average dwell time)?
5.52
11.09
6.94
60.93
31.93
0.00 10.0020.0030.0040.0050.0060.0070.00
Deception Users with High Familiarity
Deception Users with Good Familiarity
Deception Users with Limited
Familiarity
Non-Deception Users
All Respondents
Mean Time to Detect in Days

Deception’s Unique Value
Slide 12
What unique value or benefits does your organization believe deception technology provides?
10%
12%
10%
12%
10%
12%
13%
12%
9%
0% 5% 10% 15%
Produces fewer false positives
Produces more actionable alerts
Reduces attacker dwell time
Provides intelligence on attacker movement, techniques, and
targets
Helps prioritize events in the incident queue
Provides visibility to attack paths based on credential and
asset vulnerabilities
Faster incident response
Detects basic and advanced threats regardless of technique
Provides ubiquitous detection across a wide variety of attack
surfaces
% Total Mentions (Mentions/Total Mentions)
© 2019 Enterprise Management Associates, Inc.

Application of Deception Technology in
the Enterprise

Top Ranking External Internal
Breach Attack Simulation 23% (31)* 20% (35)*
DLP/Data Classification 22% (83) 23% (84)
Deception Technology 16% (37) 30% (44)
IDS/IDP/IPS 27% (90) 13% (86)
Manual Threat Hunting Efforts 11% (36) 11% (44)
Network APT Detection Analysis 13% (61) 21% (58)
Next-Generation Endpoint Security 15% (71) 30% (77)
Next-Generation Firewall/Unified Threat
Management
18% (83) 19% (80)
Secure Web Gateway 26% (66) 20% (59)
Security Information and Event Management 23% (94) 23% (79)
User and Entity Behavior Analytics 16% (45) 24% (55)
Web Application Firewall 27% (71) 16% (63)
Top-Ranked Detection Tools
*Indicates total number of respondents for each response
© 2019 Enterprise Management Associates, Inc.Slide 14

Deception Use Cases
Slide 15
Which of the following use cases does your organization believe represent deception technology's ability to reduce
business risk?
7%
7%
7%
6%
6%
6%
6%
6%
0% 1% 2% 3% 4% 5% 6% 7% 8%
% Total Mentions
Detect ransomware Security framework risk reduction
Data loss tracking and counterintelligence Detect credential theft
Detect attacks on ICS/IoT/OT devices High-fidelity alerts to speed investigation and response
Protect sensitive data from internal/external attackers Reduce security risk in cloud infrastructure

COTS vs. Honeypots vs. Homegrown
Slide 16
Which of the following categories of deception technology does your organization use?
52%
18%
30%
Commercial deception technology
Traditional honeypot or honeynet
Open-source or homegrown deception technology

INDUSTRY ANALYSIS & CONSULTINGSlide 17
The Who, What, How, and Where of
Deception Technology Usage

Who Manages Deception?
Slide 18
Which functional group within your organization is responsible for day-to-day use and
management of your organization's deception technology?
32%
26%
19%
9%
7%
5%
2%
0% 5% 10% 15% 20% 25% 30% 35%
Security operations/SecOps/SOC
Threat detection team
Network security team/NOC
Threat hunting team
Incident response team
Vulnerability management team
It is outsourced to a security services
partner
Column %

Decoys
Slide 19
Which kinds of systems and devices have you emulated with decoys?
19%
19%
15%
14%
14%
11%
6%
1%
0% 2% 4% 6% 8% 10% 12% 14% 16% 18% 20%
% Total Mentions
IT infrastructure systems (e.g., LDAP servers, domain servers, etc.)
IT network devices (switches, routers, telecom, etc.)
Enterprise applications (CRM, ERP, etc.)
Web servers
Databases, file sharing systems, or other data repositories
Smart devices (OT/ICS/IoT)
Mainframes
Other

How extensively does your organization use deception technology?
15%
15%
14%
13%
11%
10%
7%
0% 2% 4% 6% 8% 10% 12% 14% 16%
% Total Mentions
Within our private data center(s) In OT, IoT, or other specialized infrastructure
Within a hybrid cloud environment Within public cloud environments
Remote locations (branch office, remote office, etc.) HQ offices
Research/lab environments

Deception Spending
By your best estimate, how much did your organization spend on deception technology
(including both hardware and software)?
2%
11%
32%
30%
12%
6%
0% 5% 10% 15% 20% 25% 30% 35%
Less than $50,000
$51,000 to $100,000
$101,000 to $250,000
$251,000 to $500,000
$501,000 to $1 Million
Over $1 Million
Column %

What Potential Buyers Think About
Deception Technology

Deception Evaluation Drivers
What is the primary reason your organization is considering or plans to consider
deception technology?
67%
14%
11%
8%
0% 10% 20% 30% 40% 50% 60% 70% 80%
To detect in-network attackers as early
as possible
To gather/develop threat intelligence
To delay attackers already present in
the network to prevent them from
reaching critical assets
To learn the motives and tactics of
attackers within my environment
Column %

33%
28%
25%
22%
22%
22%
17%
14%
14%
14%
0% 5% 10% 15% 20% 25% 30% 35%
It may not cover all the attack surfaces…
Our organization may not be mature…
Deception technology may not be…
It may be too costly
It may open my company to additional…
It may negatively impact employee/user…
It may be too easy for attackers to detect…
The technology might be too difficult or…
Deception may be too resource-intensive…
Deception may be too complex/our…
Most Concerned
Potential buyers’ top concerns about
deception technology
© 2019 Enterprise Management Associates, Inc.Slide 24

Questions?
Get the report:
http://bit.ly/2Z35j4c

A Definitive Market Guide to Deception Technology

More Related Content

What's hot

Similar to A Definitive Market Guide to Deception Technology

More from Enterprise Management Associates

Recently uploaded

A Definitive Market Guide to Deception Technology