In my decade-long tenure as a CISO within the Defense Industrial Base (DIB), I've witnessed firsthand the complexity of today's cybersecurity landscape, new technologies, and services focused on mitigating the ever-evolving threats we face. But amidst this sophisticated tools and technologies landscape, I've also noticed an uncomfortable truth: despite substantial investments in security tools and services, organizations often underutilize them. This is particularly evident in what I call the "20/80 Rule"—where teams tend to leverage about 20% of the features in 80% of their security tools. It's a phenomenon that introduces risk, limits return on investment, and underscores the importance of continuous tool evaluation, ensuring tool alignment and use with strategic cybersecurity goals.
It's not uncommon for organizations to purchase cutting-edge tools, each with a robust suite of features designed to provide unique defensive capabilities to counter specific threats. However, many of these tools remain underutilized for various reasons, such as lack of training, tool complexity, innovation, or even sheer feature overload. In practice, critical capabilities—capabilities that could fill gaps and mitigate threats—are often ignored or insufficiently used/implemented.
This underutilization has significant repercussions. Financially, organizations invest in high-grade solutions but fail to harness their full potential, effectively wasting resources and money. Operationally, the incomplete use of tools can create gaps in the security framework or the perception that additional tools/services are required to defend the organization. Additionally, security teams often flip from tool vendor to tool vendor they don't fully understand, leading to even more inefficiencies in capital and labor due to onboarding, migrations, and more.
A more subtle challenge in cybersecurity is the human element. People naturally gravitate toward tasks within their comfort zone or that align with their interests. This behavioral tendency can result in significant blind spots, as security practitioners focus on tools and features they find engaging, while other equally critical components are neglected.
At SCYTHE, we recognize that this human element plays a significant role in cybersecurity effectiveness. Our platform is designed to combat these human biases by providing adversarial emulation and validation capabilities. SCYTHE empowers security teams to test (or perform head-to-head comparisons) their tools in real-world attack scenarios, making it easier to identify which features are working and which aren't, fostering a comprehensive understanding across the toolset. This approach also creates an objective way to measure the effectiveness of tools under evaluation, enabling teams to pick the tools that perform the best.
Addressing the 20/80 tool utilization challenge requires a structured approach. Here are several recommended steps to maximize your toolset's potential and some insights into an organization's everyday challenges:
Reflecting on the journey, it has been both challenging and profoundly rewarding, filled with valuable lessons that go far beyond simply deploying cybersecurity tools. The dual focus on maximizing the potential of our tools and addressing the human elements of cybersecurity has had a transformative impact on our defensive capabilities. This process has taught us that effective cybersecurity is not merely about having the latest technology but about utilizing it to its fullest potential.
Our experience has taught us that even the most advanced tools can fall short if not aligned with a strategy that accounts for human behavior, skill gaps, and operational workflows. Building a resilient defense required us to equip our team with powerful technology and foster a mindset of continuous learning, curiosity, and adaptability. It was about creating an environment where every team member understands how to leverage our tools to their fullest and recognizes their role in the broader security posture of the organization.
By prioritizing both capability (technology/service) and people, we cultivated a team that is technically skilled, deeply engaged, and prepared to respond to emerging threats. This comprehensive approach has proven essential, reminding us that a truly effective cybersecurity strategy is a balanced mix of the right tools, the right mindset, and a culture of proactive security.
Cybersecurity teams today should prioritize adversarial threat emulation and validation for many reasons: better insight and understanding of today's threats, their defensive efficacy, and, yes, tool utilization, moving beyond basic tool deployment and services adoption. By actively testing tools against simulated adversarial tactics, organizations gain a clear understanding of their security stack's true capabilities, from endpoint defenses to network monitoring.
Ultimately, SCYTHE helps bridge the gap between what tools can do and what they are doing, transforming underutilized features into active defenses. For organizations facing today's complex threat landscape, that difference is invaluable.