Gartner defines the application programming interface (API) management market as the market for software to manage, govern and secure APIs. Organizations use APIs to modernize their architectures; APIs provide access to systems, services, partners and data services. API management software enables organizations to plan, deploy, secure, operate, version control and retire APIs, regardless of their size, region or industry.
Gartner defines access management (AM) as platforms that include an identity provider (IdP) and establish, manage and enforce runtime access controls to at least cloud, modern standards-based web and classic web applications. AM’s purpose is to enable single sign-on (SSO) access for people (workforce, consumer and other users) and machines into protected applications in a streamlined and consistent way that enhances user experience. AM is also responsible for providing security controls to protect the user session in runtime, enforcing authentication (with multifactor authentication [MFA]) and authorization using adaptive access. Lastly, AM can provide identity context for other cybersecurity tools to enable identity-first security.
The application development life cycle management (ADLM) tool market focuses on the planning and governance activities of the software development life cycle (SDLC). ADLM products focus on the 'development' portion of an application's life. Key elements of an ADLM solution include: software requirements definition and management, software change and configuration management, software project planning, with a current focus on agile planning, work item management, quality management, including defect management. Other key capabilities include: reporting, workflow, integration to version management, support for wikis and collaboration, strong facilities for integration to other ADLM tools.
Cloud-native application protection platforms (CNAPPs) are a unified and tightly integrated set of security and compliance capabilities, designed to protect cloud-native infrastructure and applications. CNAPPs incorporate an integrated set of proactive and reactive security capabilities, including artifact scanning, security guardrails, configuration and compliance management, risk detection and prioritization, and behavioral analytics, providing visibility, governance and control from code creation to production runtime. CNAPP solutions use a combination of API integrations with leading cloud platform providers, continuous integration/continuous development (CI/CD) pipeline integrations, and agent and agentless workload integration to offer combined development and runtime security coverage.
Data center infrastructure management (DCIM) tools monitor, measure, manage and/or control data center resources and energy consumption of both IT-related equipment (such as servers, storage and network switches) and facilities infrastructure components (such as power distribution units and computer room air conditioners). They are data-center-specific (they are designed for data center use), rather than general building management system tools, and are used to optimize data center power, cooling and physical space. Solutions do not have to be sensor-based, but they do have to be designed to accommodate real-time power and temperature/environmental monitoring. They must also support resource management, which Gartner defines as going beyond typical IT asset management to include the location and interrelationships between assets.
The market for DLP technology includes offerings that provide visibility into data usage and movement across an organization. It also involves dynamic enforcement of security policies based on content and context for data in use, data in motion and data at rest. DLP technology seeks to address data-related threats, including the risks of inadvertent or accidental data loss and the exposure of sensitive data, using monitoring, alerting, warning, blocking, quarantining and other remediation features.
Data masking is based on the premise that sensitive data can be transformed into less sensitive but still useful data. This is necessary to satisfy application testing use cases that require representative and coherent data, as well as analytics that involve the use of aggregate data for scoring, model building and statistical reporting. The market for data protection, DM included, continues to evolve with technologies designed to redact, anonymize, pseudonymize, or in some way deidentify data in order to protect it against confidentiality or privacy risk.
Gartner defines DevOps platforms as those that provide fully integrated capabilities to enable continuous delivery of software using Agile and DevOps practices. The capabilities span the development and delivery life cycle built around the continuous integration/continuous delivery (CI/CD) pipeline and include aspects such as versioning, testing, security, documentation and compliance. DevOps platforms support team collaboration, consistency, tool simplification and measurement of software delivery metrics. DevOps platforms simplify the creation, maintenance and management of the components required for the delivery of modern software applications. Platforms create common workflows and data models, simplify user access, and provide a consistent user experience (UX) to reduce cognitive load. They lead to improved visibility, auditability and traceability into the software development value stream. This end-to-end view encourages a systems-thinking mindset and accelerates feedback loops.
Gartner defines digital experience monitoring (DEM) tools as those that measure the availability, performance and quality of the user experience (human user or digital agent) of critical applications. This can include internal users (employees and contractors), external users (customers and partners) or a digital agent connecting to an API. In addition to performance, DEM technologies enable observability of user behavior and journey based on their interaction with applications.
Email security refers collectively to the prediction, prevention, detection and response framework used to provide attack protection and access protection for email. Email security spans gateways, email systems, user behavior, content security, and various supporting processes, services and adjacent security architecture. Effective email security requires not only the selection of the correct products, with the required capabilities and configurations, but also having the right operational procedures in place.
The Endpoint Detection and Response Solutions (EDR) market is defined as solutions that record and store endpoint-system-level behaviors, use various data analytics techniques to detect suspicious system behavior, provide contextual information, block malicious activity, and provide remediation suggestions to restore affected systems. EDR solutions must provide the following four primary capabilities: • Detect security incidents • Contain the incident at the endpoint • Investigate security incidents • Provide remediation guidance
Gartner defines an endpoint protection platform (EPP) as security software designed to protect managed endpoints — including desktop PCs, laptop PCs, mobile devices and, in some cases, server endpoints — against known and unknown malicious attacks. EPPs provide capabilities for security teams to investigate and remediate incidents that evade prevention controls. EPP products are delivered as software agents, deployed to endpoints, and connected to centralized security analytics and management consoles. EPPs provide a defensive security control to protect end-user endpoints against known and unknown malware infections using a combination of security techniques (such as static and behavioral analysis) and system controls (such as device control and host firewall management). EPP prevention and protection capabilities are deployed as a part of a defense-in-depth strategy to help reduce the attack surface and minimize the risk of endpoint compromise. EPP detection and response capabilities are used to uncover, investigate, and respond to endpoint threats that evade security prevention, often as a part of broader security operations platforms.
Gartner defines enterprise agile planning (EAP) tools as products that enable organizations to scale their agile practices to support a holistic enterprise view. These tools act as a hub for defining, planning, managing and deploying work. They also serve as an information hub for the disparate islands of metrics from the full life cycle. Just as agile is an evolution of development methodologies, EAP tools are an evolution of project-/team-centric tools. They support a business-outcome-driven approach to managing the full life cycle of agile product delivery at scale. EAP tools in this market combine data from multiple sources to enable: - Monthly, weekly and even daily incremental value delivery based on business outcomes - Support for enterprise agile frameworks like Scaled Agile Framework (SAFe) - Product roadmapping - Management of strategy, investments and objectives - Increased visibility into the flow of work - Management of work backlogs - Collaboration capabilities for individuals and teams - Management of cross-team dependencies - Release planning and forecasting - Visibility into the financial aspects of the work being done
Reviews for 'IT Infrastructure and Operations Management - Others'
IT Resilience Orchestration (ITRO) solutions are chiefly aimed at helping to improve the reliability, speed and granularity of workload recovery due to unplanned outages by automating disaster recovery (DR) processes while lowering costs of DR exercising and DR operations staff. Gartner’s ITRO definition focuses on tools that support a majority of these capabilities: • Automated failover, failback and availability/continuity management • Replication and orchestration • Discovery, dependency mapping and workload analysis • DR management and run book creation • Reporting and validation of recovery capability
Gartner defines IT service management (ITSM) platforms as software that offers workflow management that enables organizations to design, automate, plan, manage, report on and deliver integrated IT services and related digital experiences. Supported practices include request, incident, problem, change, knowledge and configuration management, and case management, as well as interfaces for non-IT business needs. ITSM platforms are typically acquired as SaaS; however, they are also sold as on-premises deployments. I&O leaders select these solutions to be consumed by service desks and service operations, and are identifying opportunities for business workflows in other IT-adjacent departments.
Gartner defines identity governance and administration (IGA) as the solution to manage the identity life cycle and govern access across on-premises and cloud environments. To accomplish this, IGA tools aggregate and correlate disparate identity and access rights data, and provide full capability controls over accounts and associated access. IGA solutions also fulfill the purpose of unifying and correlating identity data for organizations with multiple person and machine identity authoritative sources. This is done to provide a single view of identity (system of record) for their dependent processes and systems
Information-centric security products focus on content, more than device, and apply encryption and authentication to block file access and movement from unauthorized people or circumstances. Endpoint systems are porous, mistakenly sharing data is easy, and users can be careless. Information-centric security is the last line of defense for data when firewalls, anti-malware tools, best practices and other traditional defenses fail. The scope of this market is the protection of stored information, commonly referred to as data at rest. The protection of data at rest in some ways takes precedence, because the interconnectedness of today’s systems often undermines network protections. In other words, high-value information should be protected “at rest” to prevent the risk of a breach caused by an unexpected data in motion event.
Infrastructure monitoring tools capture the health and resource utilization of IT infrastructure components, no matter where they reside (e.g., in a data center, at the edge, infrastructure as a service [IaaS] or platform as a service [PaaS] in the cloud). This enables I&O leaders to monitor and collate the availability and resource utilization data of physical and virtual entities — including servers, containers, network devices, database instances, hypervisors and storage. These tools collect data in real time and perform historical data analysis or trending of the elements they monitor.
MSSs provide organizations with a variety of management and operational services specific to security technologies and business outcomes for security. Capabilities include security monitoring, detection and response, exposure assessment and management as well as security consulting and security technology implementation. MSSs are delivered in a variety of modes, in the providers’ cloud infrastructure, as consultative engagements or through staff augmentation and on-premises. MSS providers offer a variety of different engagement models. These include heavily customized and consultancy-led models and commoditized technology management-driven experiences.
Gartner defines mobile data protection (MDP) products and services as software security methods that enforce confidentiality policies by encrypting data, and then defending access to that encrypted data on the mass storage systems of end-user workstations. These storage systems include the primary boot drive of a workstation, additional system drives and removable devices used for portability. Storage technologies affected by MDP include magnetic hard-disk drives (HDDs), solid-state drives (SSDs), self-encrypting drives (SEDs), flash drives and optical media. Several methods allow MDP products to delegate all or part of the encryption process to be accomplished by hardware elements, including the CPU and drive controller, and to native capabilities in the OS. Some vendors also have protection capabilities for network storage, and a few also support cloud-based storage environments as an extension to the desktop.
Mobile threat defense (MTD) products protect organizations from malicious threats on iOS and Android devices, at the device, network and application levels. To successfully attack a mobile device, mobile malware must circumvent the controls built into mobile OSs, such as those for app store curation and native mobile OS hardening. MTD products tend to focus on preventing and detecting anomalous behavior by collecting and analyzing indicators of compromise, as well as expected behavior. MTD products gather threat intelligence from the devices they support, as well as from external sources, and use an analysis engine that resides in the cloud, on-premises or on an MTD app installed on devices.
Network detection and response (NDR) products detect abnormal system behaviors by applying behavioral analytics to network traffic data. They continuously analyze raw network packets or traffic metadata within internal networks (east-west) and between internal and external networks (north-south). NDR products include automated responses, such as host containment or traffic blocking, directly or through integration with other cybersecurity tools. NDR can be delivered as a combination of hardware and software appliances for sensors, some with IaaS support. Management and orchestration consoles can be software or SaaS.
Network-based sandboxing is a proven technique for detecting malware and targeted attacks. Network sandboxes monitor network traffic for suspicious objects and automatically submit them to the sandbox environment, where they are analyzed and assigned malware probability scores and severity ratings. Sandboxing technology has been used for years by malware researchers at security companies and even in some large enterprises that are highly security conscious. Traditionally, using a sandbox has been an intensive effort requiring advanced skills. The malware researcher manually submits a suspicious object into the sandbox and analyzes it before flagging it as malware or not. By adding automated features to sandboxing technology (automatically submitting suspicious objects and automatically generating alerts).
Gartner defines observability platforms as products that ingest telemetry (operational data) from a variety of sources including, but not limited to, logs, metrics, events and traces. They are used to understand the health, performance and behavior of applications, services and infrastructure. Observability platforms enable an analysis of the telemetry, either via human operator or machine intelligence, to determine changes in system behavior that impact end-user experience such as outages or performance degradation. This allows for early, and even preemptive, problem remediation. Observability solutions are used by IT operations, site reliability engineers, cloud and platform teams, application developers, and product owners. Observability platforms are used by organizations to understand and improve the availability, performance and resilience of these critical applications and services. Investment in and successful deployment of observability platforms leads to revenue loss avoidance and enables faster product development cycles and improvements in brand perception.
Gartner defines operational technology (OT) as “hardware and software that detects or causes a change, through direct monitoring and/or control of industrial equipment, assets, processes and events”. OT security includes practices and technologies used to protect them, but these practices and technologies are now evolving into distinct categories to address the growing threats, security practices and vendor dynamics.
Gartner defines privileged access management (PAM) as tools that provide an elevated level of technical access through the management and protection of accounts, credentials and commands, which are used to administer or configure systems and applications. PAM tools — available as software, SaaS or hardware appliances — manage privileged access for both people (system administrators and others) and machines (systems or applications). Gartner defines four distinct tool categories for PAM tools: privileged account and session management (PASM), privilege elevation and delegation management (PEDM), secrets management, and cloud infrastructure entitlement management (CIEM).
Product roadmapping tools for software engineering have simplified product-related communication and streamlined product management and development efforts. This document profiles selected vendors and tools that can assist with: Management of software product vision and strategy alignment Communication of ideas and requirements Decision making through an understanding of user behavior, data and analytics, priorities, and consequences Defining software features and business capabilities, and handling backlogs Planning and tracking software development releases Financial and budget management Collaboration on timelines Communication, negotiation and updates Integration planning and resource tracking Report generation and notifications Managing feedback from developers, teams and users Support for continuous development and continuous integration
PPM software providers covered under this market definition aim to support the selection, planning and execution of a variety of different work packages or containers, including, but not limited to, traditional projects. They often fold in collaboration and communication capabilities and allow work teams and project offices to report, monitor and identify course correction in resource-intensive project and work environments. Providers included in this market offer these capabilities directly through their own products, but frequently recognize that specific integration points may also be needed to connect niche tools or data sources. The PPM capabilities identified as essential or critical include: • Project demand management • Project planning and management • Time management • Resource management • Resource capacity planning • Project portfolio management • Project collaboration • Program management • Reporting services • Security and user management • Integration • Usability
The SACBT market is characterized by vendor offerings that include one or more of the following capabilities: Ready-to-use training and educational content; Employee testing and knowledge checks; Availability in multiple languages, natively or through subtitling or partial translation (in many cases, language support is diverse and localized); Phishing and other social engineering attack simulations; Platform and awareness analytics to help measure the efficacy of the awareness program. Training modules are available as cloud-hosted SaaS applications or on-premises deployments via client-managed learning management systems (LMSs), and also support the Sharable Content Object Reference Model (SCORM) standard, enabling integration with corporate LMSs.
Gartner defines security service edge (SSE) as a solution that secures access to the web, cloud services and private applications regardless of the location of the user or the device they are using or where that application is hosted. SSE protects users from malicious and inappropriate content on the web and provides enhanced security and visibility for the SaaS and private applications accessed by end users. Security service edge provides a primarily cloud-delivered solution to control access from end users and edge devices to applications (private or delivered via SaaS) as well as websites (and to a lesser extent general internet traffic). It enables a hybrid workforce more efficiently than traditional on-premises solutions. Capabilities integrated across multiple traffic types and destinations allow a more seamless experience for both users and admins while maintaining a consistent security stance.
Reviews for 'Security Solutions - Others'
The security threat intelligence products and services market refers to the combination of products and services that deliver knowledge (context, mechanisms, indicators, implications and action-oriented advice), information and data about cybersecurity threats, threat actors and other cybersecurity-related issues. The output of these products and services aims to provide or assist in the curation of information about the identities, motivations, characteristics and methods of threats, commonly referred to as tactics, techniques and procedures (TTPs). The intent is to enable better decision making and improve security technology capabilities to reduce the likelihood and impact of a potential compromise. Threat intelligence (TI) products and services support the different stages of a TI process life cycle. In particular, this involves defining the aims and objectives, collecting and processing intelligence originating from various sources, analyzing and disseminating it to different stakeholders within the organization, and regularly providing feedback on the entire process. These products and services support ongoing security investigations and assist in preventing future breaches by prioritizing infrastructure hardening. TI tools and services are most commonly cloud-based products and services, but can also be delivered “as a service.”
Gartner defines the service orchestration and automation platform (SOAP) market as encompassing solution suites that deliver capabilities enabling organizations to manage workloads, workflows, resource provisioning and data pipelines across their technology landscapes. SOAPs enable infrastructure and operations (I&O) leaders to design and implement business services. These platforms combine workflow orchestration, workload automation and resource provisioning across an organization’s hybrid digital infrastructure. Increasingly, they are central to an organization’s ability to deploy workloads and to optimize deployments as a part of cost and availability initiatives. SOAPs expand the role of traditional workload automation by adapting to use cases that deliver and extend into data pipelines, cloud-native infrastructures and application architectures. These tools complement and integrate with DevOps toolchains to provide customer-focused agility, cost savings, operational efficiency and process standardization.
The market for social software in the workplace includes software products that support people working together in teams, communities or networks. These products can be tailored to support a variety of collaborative activities. Buyers are looking for virtual environments that can engage participants to create, organize and share information, and encourage them to find, connect and interact with each other. Business use of these products ranges from project coordination within small teams or homogeneous groups, to information exchange between employees across an entire organization.
Software asset management (SAM) tools are solutions that provide automation to support tasks required to produce and maintain compliance with independent software vendor (ISV) license use rights, while improving an organization’s ability to proactively identify and optimize software risk and spend. SAM tools provide in-depth software asset analysis through: - Conducting discovery - Analyzing software license entitlements - Automating the collection of software consumption data - Establishing ISV effective license position (ELP) - Governing software assets - Optimizing software value delivery - Sharing information with other tools and stakeholders
Gartner defines strategic portfolio management (SPM) as a set of business capabilities, processes and supporting portfolio management technology. Business leaders, enterprise portfolio management office (EPMO) leaders and IT leaders require SPM to support enterprisewide strategy-to-execution alignment and adaptation. The SPM market addresses the integrated portfolio management technology needs of business leaders, EPMO leaders and IT leaders. SPM technology supports clear definition of key business strategies and desired business outcomes, and the formulation and mapping of these with key portfolio elements, such as business capabilities, investments, programs, digital and physical products, applications and projects. SPM technology allows users to create multiple portfolio and subportfolio types with focused themes, such as programs, digital products, physical products, business or IT services, projects and applications. It allows users to link and cross-reference elements in the different portfolios and subportfolios to support integrated portfolio analysis and tracking.
Gartner defines a unified endpoint management (UEM) tool as a software-based tool that provides agent and agentless management of computers and mobile devices through a single console. Modern UEM tools: Provide a user-centric view of devices across device platforms; Offer agent and/or agentless management through native Windows endpoint, macOS, Linux and Chrome OS controls. Offer agentless mobile management through native Apple iOS/iPad OS and Google Android controls; Aggregate telemetry and signals from identities, apps, connectivity and devices to inform policy and related actions; Aggregate and analyze technology performance and employee experience data; Integrate with identity, security and remote access tools to support zero-trust access and contextual authentication, vulnerability, policy, and configuration and data management; Manage nontraditional devices, including Internet of Things (IoT) devices, wearables and rugged handhelds.
Gartner defines user authentication as the journey-time process that provides credence in a claim to an identity established for a person for access to digital assets. User authentication is delivered by some combination of (a) an authenticator, (b) signals evaluation and (c) an authentication decision point, which may be from different vendors. User authentication is used to provide credence in an identity claim for a person already known to an organization. The credence must be sufficient to bring account takeover (ATO) risks within the organization’s risk tolerance. User authentication is foundational to and protects the value of other functions with an organization’s identity fabric, namely: runtime authorization, especially segregation of duties (SOD); audit (individual accountability); and identity analytics.
Value stream management platforms enable organizations to optimize end-to-end product delivery and improve business outcomes. VSMPs are tool-agnostic; they connect to existing tools and ingest data from all phases of software product delivery all the way from customer need to value delivery. They help software engineering leaders identify and quantify opportunities to improve software product performance by optimizing cost, operating models, technology and processes. VSMPs use AI-/machine learning (ML)-powered analytics and insights to surface constraints, detect bottlenecks and improve flow. This enables stakeholders to take actions that improve throughput and align to business priorities and objectives.
Gartner defines WAN optimization tools as products that improve the performance of applications running across the WAN as well as reduce WAN service expenses. WAN optimization solutions continue to evolve, and now support four high-level needs: improving the response times for users of business-critical applications over WAN links or mobile connections; assisting in maximizing ROI for WAN bandwidth; optimizing data-center-to-data-center (DC-to-DC) traffic for faster storage replication and synchronization; and assisting in directing traffic across multiple WANS, such as a hybrid WAN or public cloud connectivity.
Gartner defines zero trust network access (ZTNA) as products and services that create an identity and context-based, logical-access boundary that encompasses an enterprise user and an internally hosted application or set of applications. The applications are hidden from discovery, and access is restricted via a trust broker to a collection of named entities, which limits lateral movement within a network.