Demand for business agility and uptime have accelerated the rapid modernisation of IT, which is now highly dynamic and distributed - from the data centre, to cloud infrastructure and SaaS, to remote sites and device edges. These changes introduce complexity and expand the attack surface, contributing to high rates of false positives and obscuring true threats. Analysts constantly waste time, through no fault of their own, working to validate the constant flow of alerts to determine if investigation is warranted.

The Winter 2019 release of Extrahop Reveal(x) improves SOC and NOC analyst productivity through contextual discovery of the enterprise attack surface, full-spectrum detection, and one-click guided investigation for incident response. Advanced detections incorporate device and user context to identify known and unknown threats using an array of machine learning, rule-based, and custom techniques. Detections incorporate suggested next steps and are made actionable through clear evidence, enabling front-line analysts to validate, close, or escalate prioritised events with confidence. Senior analysts get timely detail on users and devices to support rogue device detection, insider threat investigations, threat hunting, and forensics.

“Forcing analysts to switch between tools or manually pull together disparate data for an investigation increases cognitive load, delay, and the chance of missing a critical piece of evidence,” said Jesse Rothstein, CTO and Co-Founder, Extrahop. “Our focus in this release is to bring authoritative data about every device's communications, OS, users, and network behaviour into a contextual workflow that guides analysts to the right answer immediately.”

With Extrahop, according to the company, security and IT teams can detect threats up to 95 percent faster, reduce resolution time by nearly 60 percent, and decrease unplanned downtime by as much as 86 percent.