In 2017, Frost & Sullivan published an analysis titled “Leveraging Vulnerability Management for Enhanced Security”. It argued that vulnerability management (VM) had become a core part of business cyber security defence. The firm’s network security industry analyst, Christopher Kissel, made prevention the central point: in his view, finding and fixing weaknesses before attackers use them was a better posture than relying on detecting and responding to incidents.
The question behind the analysis
The analysis began with the breach record of the preceding years. Frost & Sullivan noted that the number and scale of breaches had risen steadily. Institutions of all sizes, public and private, had disclosed that databases holding customer identities and other private data had been exposed.
The question was how organisations could make attacks harder as security grew more complex. Frost & Sullivan’s answer was a layered set of tools and safeguards that add friction for attackers and discourage some of them. VM was presented as one of the most important of these.
What Frost & Sullivan found
On the market, Frost & Sullivan reported that North America accounted for 76.8 percent of VM sales in 2016. It projected that the share would rise to 77.8 percent by 2021. The figures show a market concentrated in one region, though the analysis did not break out Asia-Pacific in the material available.
Kissel described vulnerability assessment scanning as essential. His reasoning was that incident detection, response and other mitigation techniques all act after a weakness already exists, while scanning aims to remove it first.
Accuracy and scanning methods
Much of the analysis dealt with measurement. Frost & Sullivan said data accuracy is a major difficulty in dynamic network environments, and that it matters most when scan results are shared between teams. A specific problem it named was scan-to-scan host correlation: matching a device seen in one scan with the same device in the next, even as addresses and configurations change.
Organisations also face a choice of scanning technologies. A common one is unauthenticated network scanning. The scanner sits remote from the devices and sends network messages, then infers what is present from how each device responds. This method can map devices and open ports. It can also flag configuration problems and other vulnerabilities.
Usability and the mid-sized company
Kissel argued that VM tools had to be easy and intuitive. For smaller and mid-sized companies in particular, he said they needed a way to fit into everyday IT workflow rather than sit as a separate specialist exercise.
He cited Digital Defense, Inc. as an example. In his assessment, its VM product’s strength was that it tracked host controls accurately across a network. That meant the host environment was well understood, which he said greatly reduced false positives from endpoint scan data.
What happened to Digital Defense
The vendor Frost & Sullivan highlighted later changed hands. On 3 February 2021, HelpSystems announced that it had acquired Digital Defense, describing it as a provider of vulnerability management and threat assessment. Digital Defense’s cloud-native scanning engine was folded into a security assessment toolkit that already included Core Security and Cobalt Strike. Financial terms were not disclosed, according to MSSP Alert.
HelpSystems has since rebranded as Fortra. Fortra’s own pages still describe Digital Defense’s vulnerability management technology as part of its portfolio. At the time of the deal, Digital Defense chief executive Larry Hurtado said the business would keep protecting thousands of organisations as part of the larger company.
The deal was one of several vulnerability and security-assessment acquisitions by the company. MSSP Alert listed Vera in 2021, Cobalt Strike in 2020 and Core Security in 2019 among its earlier purchases. A later acquisition, Beyond Security in May 2021, added further vulnerability assessment software to the same suite, according to PrivSource.