Realizing ROI in Risk Detection and Compliance with Threat Stack

This is a guest blog written by IT Central Station

Many organizations view security operations as a cost center. There is some justification for this, but a more in-depth look at the issue will reveal that an investment in security and compliance can yield a significant return. This article explores how a cloud security platform can generate a return on investment (ROI). Based on real user reviews of Threat Stack on IT Central Station, we will discuss how a security platform can help save you time and increase productivity, both of which contribute to ROI. The article will also share insights from users about how better security and compliance can add to your company’s profitability. 

Saving Time

IT Central Station members highlight their use of Threat  Stack to reduce time spent investigating threats and assigning resources to remediate attacks. For instance, a Director of Information Security at a consumer goods company with more than 500 employees sees ROI from having data available in a single pane of glass. This saves his team valuable time when having to investigate potential attacks. They appreciate not having to jump over to Amazon Web Services (AWS). Instead, they have all the information they need in one place with Threat Stack.

“When an attack compromises a system, it changes the configuration of that system. Being able to immediately detect the incident and take action on it in an extremely short period of time is unbelievably valuable and essential to our company,” noted Kevin J., a Lead Security SRE at InVision, a small tech vendor. They have used Threat Stack as part of their SOC 2 audit for two years and, as he put it, “it has saved us a drastic amount of time. When we had previous security incidents, if we could even detect them – ‘if’ because we did not have the same level of visibility – the remediation cycles could last weeks.”

Kevin added that “before Threat Stack, collecting endpoint AWS configuration evidence would necessitate designating a team of three employees over an entire calendar month. Now we can provide that evidence within one hour. Incredibly, there has been a measurable 95 percent decrease in the mean-time-to- response (MTTR). We could not be more satisfied in our investment with Threat Stack.”

Eric C., a Senior Director of Information and Security for PureCloud at Genesys Telecommunications Laboratories, similarly explained, “Threat Stack has cut down on valuable time needed to investigate potential attacks by about 75 percent. It’s much faster now.”

A common, positive theme among Threat Stack users relates to how they had been previously unable to detect security breaches at all. “It’s really hard to quantify because we didn’t have a good process,” said Skyler C., a Software Development Manager at Rent Dynamics, a small real estate firm. “We were oblivious to vulnerabilities. Before, we never would have known, so that’s quite the improvement. Quantifying was problematic because we didn’t have a good process and were oblivious to vulnerabilities. Digging through the servers and finding all the logs would take at least 45 minutes to two hours per incident, depending on how impactful the breach.” With Threat Stack, they have seen a measurable decrease in MTTK and MTTR.

Increasing Productivity

Saving time and enabling employees to be more productive allows organizations to increase the amount and quality of their output for the same compensation. This drives a more significant ROI. For example, Threat Stack improved audit tracking for Sarbanes-Oxley compliance at Younique Products, a consumer goods company with more than 500 employees. According to Vincent R., their Director of Information Security, “This year is a dramatic change from last year. That’s a key win. Productivity is up because we are not bogged down in old systems. Threat Stack certainly contributed to paying for itself there.”

For Skyler C, productivity gains came from better management of password authentication. He said that “when we first signed up with Threat Stack, we were managing 70 servers with passwords, and it was cumbersome. We collaborated with the Threat Stack team to start automating a percentage of our logins and were given direction to control access to the box. In this case, we needed to disable password authentication, streamlining search certificates. Sometimes, it takes a new set of eyes to help untangle a full workload, making us more efficient.”

Increasing Revenue

Improving security can lead to a faster sales cycle; according to Kevin J., revenue can be part of the “R” in ROI, after all. In Kevin’s case, Threat Stack has enabled a faster conversion process for signing new contracts with clients. He shared that “having Threat Stack in place and being able to provide meaningful artifacts to our customers has definitely shortened our sale cycles. Now we don’t have to abstract ten different sets of data to create an artifact for an audit or customer review. We can easily demonstrate our security controls and have landed multi-million dollar accounts from very large technology companies with extremely strict security requirements. This is a win-win. What a great tool!”

Skyler C. has also seen his business grow since starting with Threat Stack. Although ROI can sometimes be difficult to quantify, he said, “it is apparent that by checking some boxes and introducing an intrusion-detection service, we’ve seen the biggest increase in revenue.” He added that “we are now invited to the party. Our company can be proactive about security because we have a better security posture. We can start that conversation rather than being embarrassed. Had we not had Threat Stack, we could have been eliminated from many conversations. It’s just hard to say exactly how many of them.”

Improving Security

It’s important to note that improving security and compliance also makes an intangible contribution to ROI. Likewise, IT Central Station members cited how Threat Stack helps them bolster their security postures. Being less exposed to threats and more prepared for compliance leads to smoother business operations and fewer disruptions. This is a fundamental but ambiguous driver of return on investment.