Zero-Day Insights

Zero-Day is a term that the security industry strives to accomplish when discussing the ability to identify and prevent a security attack or breach immediately. This is a far cry from the current industry average of 207 days. 

If fact, since IBM started tracking this mean-time-to-identify (MTTI) across the industry seven years ago, the average time has only decreased by a total of 4 days on average. What this amounts to is a bad actor having the equivalent time to loiter and dwell within an infrastructure from January 1^st to July 26^th. The problem stems from the fact that the security industry grew up on the concept of managing security by aggregating attack signatures when determined to be malicious. With almost one million variations of malware released per day and only 450k of those actually being cataloged and identified as malicious, it’s no wonder 207 days is the average MTTI.

In order to understand how to deliver a solution to this problem, you must first understand what actions and variables a bad actor can leverage to gain success for their nefarious actions. When there is an exploited vulnerability, a bad actor really only has two options 1) snoop around and try to exfiltrate data or 2) add, modify, or delete something to either create a new vulnerability or negatively impact operations.