Gartner defines cloud web application and API protection (WAAP) as a category of security solutions designed to protect web applications and APIs from different types of attacks, irrespective of the hosting location. Typically delivered as a service, cloud WAAP is a consolidation of multiple capabilities offered as a series of security modules and designed to protect against a broad range of runtime attacks. Core capabilities are web application firewalls (WAFs), distributed denial of service (DDoS) mitigation, protection against advanced API attacks and automated (bot) traffic management. A cloud WAAP solution must incorporate all four core capabilities within the same offering.
IT Security refers to products and services that protect digital systems and data from cyber threats and unauthorized access. This category includes markets that focus on network security, identity management, data protection, and cloud security, enabling organizations to reduce risk, ensure compliance, and operate securely in a digital world.
Gartner defines network detection and response (NDR) as products that detect abnormal network behaviors by applying behavioral analytics to network traffic data. NDR products continuously analyze raw network packets or traffic metadata within internal networks (east-west) and between internal and external networks (north-south). They include automated responses, such as host containment or traffic blocking, implemented directly or through integration with other cybersecurity products. Vendors deliver NDR as hardware or software appliances for sensors, with some supporting IaaS environments. Management and orchestration consoles are available as software or SaaS. Organizations rely on NDR to detect and contain postbreach activities such as ransomware, insider threats and lateral movements. NDR complements other technologies that primarily trigger alerts based on rules and signatures by building heuristic models of normal network behavior and detecting anomalies. Security teams commonly use NDR as a complementary detection and response technology within a broader set of security operations center (SOC) tools. These include security orchestration, automation and response (SOAR), security information and event management (SIEM), endpoint detection and response (EDR), and other detection technologies. These include security orchestration, automation and response (SOAR), security information and event management (SIEM), endpoint detection and response (EDR), and other detection technologies.
Security information and event management (SIEM) is a configurable system of record that collects, aggregates and analyzes security event data from on-premises and cloud environments. SIEM processes security event data for the purposes of threat detection, investigation and response. It natively supports data normalization and offers user-configurable detection content and reporting to orchestrate threat mitigation and satisfy compliance requirements. These solutions are delivered via a SaaS platform or client-hosted on-premises or private cloud. The security information and event management (SIEM) system must assist with: 1. Aggregating and normalizing data from various IT and operational technology (OT) environments. 2. Designing and executing near real-time monitoring and alerting content. 3. Enriching and investigating security events of interest. 4. Supporting manual and automated response actions. 5. Maintaining and reporting on current and historical event data.