The Total Economic Impact™ Of Lacework

Increased Productivity From Reduction Of Alert Investigations

• Evidence and data.

  The deployment of Lacework prioritized curated alerts, reducing alert noise and fatigue for interviewees. Additionally, findings revealed that Lacework provided greater context for faster, and more effective investigations by aggregating related security event information into alert dossiers, eliminating manual burden on staff.

  • One interviewee told Forrester, “We rely on the alerting and anomaly detection of Lacework to flag areas of concern that require additional dedicated investigation.”
  • The interviews for this study found that the percent reduction in alerts curated for security teams by Lacework was 86%, which is higher than 80% — the midpoint of a range Forrester has found via custom research.

• Modeling and assumptions.

  To calculate the value of this benefit, Forrester assumes the following:

  • Forrester has found security operations teams in a wide range of businesses, including but not limited to those with 1,000 or more employees, receive more than 11,000 security alerts per day across the business. These events could come from numerous sources, including but not limited to endpoint, network, cloud, and security information and event management (SIEM). Such events comprise all potential threats including legitimate ones as well as a high proportion of false positives, collectively known as “noise.”
  • Of these 11,000 events, about 5% (550) are related to cloud accounts and workloads and processed by Lacework. Lacework then reduces an average of 86% of these events to 79 medium-to-critical security alerts with context to aid further investigation.
  • This focused investigation is done by often-overloaded or scarce security professionals at interviewees’ organizations to perform tasks such as resolution of the most critical incidents and threat monitoring.
  • It takes an average of 5 minutes for a security analyst to investigate each alert.
  • The average fully burdened hourly salary of a security analyst is $65.

• Risks.

  The value of this benefit can vary across organizations due to differences in:

  • The complexity of IT security environments.
  • The proliferation of security alert noise, which can vary depending on organizations’ systems, technologies, tools, and processes.
  • The levels and associated compensation of FTEs involved in investigating security alerts.

• Results.

  To account for these risks, Forrester adjusted this benefit downward by 20%, yielding a three-year, risk-adjusted total present value (PV) of nearly $1.8 million.

Reduction In Cost Of Licenses For Legacy Tools

• Evidence and data.

  Lacework’s functionality provided composite organizations with the ability to reduce their spend on related tools.

  • One interviewee said, “We eliminated $185,000 in annual spend from three disparate tools.”
  • Another interviewee told Forrester, “We are decommissioning [a major security solution] and replacing its functionality with Lacework.” This contract is worth $125,000 per year.
  • A third interviewee told Forrester that they dropped a contract with a similar solution provider worth approximately $18,000 per year.

• Modeling and assumptions.

  To value this benefit, Forrester calculated the average of the above-mentioned three customers’ reduction in their annual license costs for related tools.

• Risks.

  The value of this benefit can vary across organizations due to differences in organizations’ previous investment in tools related to or having functionality that may be replaced by that of Lacework.

• Results.

  To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV of $230,000.

Avoidance Of Additional Security Compliance Professional

• Evidence and data.

  Forrester discovered through customer interviews that Lacework’s governance and compliance capabilities allowed the composite organization to avoid the need for one FTE to review compliance configurations within their cloud environment. One interviewee told Forrester, “We would need to have a full-time employee review and maintain knowledge around benchmarks, and they would need to review the current configurations and flag any noncompliance issues.”

• Modeling and assumptions.

  To value this benefit, Forrester included in its model the fully loaded salary of a security compliance professional, using TEI standard methodology, who would be required to fulfill the governance and compliance duties in a business with the characteristics of the composite organization.

• Risks.

  The value of this benefit can vary across organizations due to differences in:

  • The complexity of organizations’ compliance requirements.
  • The existing internal audit and compliance capabilities within organizations, which may vary by sector and size of the organization.
  • The ranges in compensation for security compliance professionals, which may vary based on factors such as local and market-based compensation requirements.

• Results.

  To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV of nearly $291,000

Unquantified Benefits

Additional benefits that customers experienced but were not able to quantify include:

• Compliance readiness to win contracts.

  A theme throughout Forrester’s interviews with Lacework’s stakeholders and the decision-makers at seven of its customers was the readiness that Lacework enables around compliance, which is required for renewing existing and winning new contracts. One study participant said their organization “achieved the necessary compliance to win more than $10 million in new business.” Another interviewee said that without the Lacework solution, they would need to “have someone, such as a HIPAA specialist, review and maintain knowledge around benchmarks. They would review current configurations and flag any noncompliance issues.” Understanding such benchmarks would be an ongoing education investment as the standards changed and thus could be an activity that could take as much as 30 days.

• Speed of deployment, time-to-value.

  Interviewees praised Lacework’s rapid time-to-value for the solution. One decision-maker mentioned that it typically takes six to 12 months to tune incoming signals, whereas Lacework takes one to two weeks to learn their environment. Another interview participant told Forrester, “The solution was deployed over [their organization’s] entire technology stack within a couple of hours over the course of a few days.”

• Integration optimization.

  While the study’s quantified benefits include the reduction of related tools, Lacework also contributed value to the composite organization from the standpoint of integration with complementary or existing tools at customer organizations. One interview participant was particularly excited about the platform’s capability of integrating with Slack, which together provided an alternative to an investment in potentially higher-cost logging and managed cloud service providers’ solutions.

• Comprehensive nature of analysis.

  Interviewees shared with Forrester that Lacework satisfied a key criterion they had for a unified way to evaluate what they were deploying across all their services. One interviewee said that they wanted “visibility over everything,” and Lacework provided that. Another interviewee said that Lacework was the tool that “offered visibility to see where risk was across the entire organization in a single pane of glass and [allowed them to] be able to share that information back with [their] teams.”

Flexibility

The composite organization experienced increased agility due to Lacework’s built-in flexibility.

• Interviewees discussed the platform’s capability to do much more with fewer personnel. Several interview participants said they would need two to four more FTEs to do the job they are currently doing with Lacework’s Polygraph machine learning models and only one or two individuals.
• Forrester also learned from Lacework customers that they appreciated that they were able to be more strategic or work on other tasks, away from the day-to-day “information security and alert madness.” One participant told Forrester, “[We] can even be educators and teachers in secure coding,” while another participant said they could work on other activities such as threat hunting and resolving severe security incidents.