Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

Database Security

Prevent unauthorized access and exceed compliance requirements.

Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

Why SIEM Has Failed So Many – And What You Can Do About It

Organizations worldwide are well past the point of believing that perimeter-based defenses are all one needs to ensure the protection of confidential data. Mainstay prevention technologies have been around for years and remain vital, yet they struggle to fully safeguard a company's most sensitive assets. A cursory glance of the headlines reveals that attackers are finding great success infiltrating even the most security-mature of businesses.

And why wouldn't they? Between the automation, specialization and professionalization of the criminal underground, the expansion of the attack surface, the erosion of the traditional perimeter, and the lax and inconsistent adherence by employees to security policies and processes, many organizations are prey for even the most rudimentary of adversaries.

That's where security information and event management (SIEM) solutions come in. SIEM has been a logical solution for businesses to equip themselves with technology that alerts them when risky activity has occurred in their environment. Organizations need to know as early as possible to limit the damage and losses. After being alerted, they must quickly understand what the intruders have accomplished, which systems they have compromised and how to halt them in their tracks before they can impart any further damage. In addition, companies must be able to respond - both faster and in a more informed way - so they can assist law enforcement when circumstances require.

This has been the promise of SIEM for many years. Sounds easy enough, right? But we all know things are not as easy as we're told.

While the latest SIEM systems are more capable than their predecessors, they come with a Catch-22. Their effectiveness and sophistication bring a special requirement: The need for skilled professionals to run them. SIEMs not only require basic system administration to perform tasks like running health checks on software, hardware and storage - but also more seasoned skillsets, including the ability to examine data, knowledge of systems across the IT infrastructure, experience with nearly all security point solutions, and the ability to define and analyze threat correlations.

That last skillset is an advanced discipline that requires a deeper knowledge of math, data and the broader IT infrastructure. Picture someone with a computer science, or similar, degree and at least five years of hands-on IT security experience. Most companies simply lack these operational capabilities in the form of human talent - and as a result, a disproportionate number of SIEM deployments have failed to meet their goals.

Companies are searching for, but apparently not finding, many suitable candidates. The skill level of the security workforce is dismal and shows no imminent signs of turning around, but we were stunned by its extent after perusing the notable online job boards hawking available SIEM positions.

We scoured: 

  •, and found 441 postings with "SIEM" in title or description in the past week,
  •, and found 1,000+ postings for "SIEM security" in the past two weeks,
  •, and found 395 postings with "SIEM security analyst" in the past week,
  •, and found 331 postings with "SIEM analyst in past two weeks, with more than 150 new postings every week for nearly two months.

So, what do these numbers really mean? Let's compare them to numbers around more common IT positions, such as IT data analyst, desktop support analyst and business intelligence analyst. Organizations will have many positions with these general titles, in the neighborhood of three to five times as many compared to a single, niche application like SIEM. So you'd expect to see openings for these positions far outstripping those for SIEM positions.

But that wasn't what we found. Not even close. Sure, there were more openings for generalist IT positions than specifically for SIEM, but not on the scale you'd expect. For example, we found: 

  • On, 971 postings for the past week for general IT data analyst
  • On, 237 postings in past two weeks for desktop support positions

The demand for SIEM expertise is far outpacing the supply, which means organizations have to get creative in how they fill their skills void to achieve satisfaction. Otherwise, they may never have enough of the right people to utilize their investment.

One option is to offload the work to an established partner that is well versed in advanced correlation and threat management, deep forensics and Big Data, and offers round-the-clock support, integrated threat intelligence and compliance assistance. Trustwave offers a flexible Managed SIEM service that enables the customer to select the services they need to best fit their strategy, objectives and organizational resources.

With a managed services approach, you don't have to fight for talent on the job boards to make your SIEM successful.

Thomas Savage is a product marketing manager at Trustwave.

Latest Trustwave Blogs

Defending Healthcare Databases: Strategies to Safeguard Critical Information

The healthcare sector continues to be a primary target for threat actors, with 2023 seeing a record number of data breaches and compromised records. While successful attacks are inevitable, it’s...

Read More

Trustwave SpiderLabs: Ransomware Gangs Dominate 2024 Education Threat Landscape

The security teams manning the defenses at the higher education and primary school system levels often find themselves being tested by threat actors taking advantage of the sector's inherent cyber...

Read More

LockBit Takedown: Law Enforcement Disrupts Operations, but Ransomware Threats Likely to Persist

The news that US, UK, and other international law enforcement agencies disrupted LockBit is welcome, as stopping any threat group activity is always a positive. The unfortunate aspect is this blow...

Read More