Silverfort's new incident response solution prioritizes identity security for faster attack containment

Unified identity security company Silverfort Inc. today announced its “identity-first” incident response solution, designed to reduce attack remediation time by complementing existing incident response tools and IR processes be optimized.

The new service is touted as “flipping the script” on traditional IR playbooks by allowing teams to begin their investigation with the discovery and suspension of compromised accounts before moving on to identifying infected computers and malicious network traffic.

According to Silverfort, traditional IR processes start with searching for infected computers or monitoring network logs to detect anomalous traffic, with locating stolen identities – whether human or not – usually the final piece of the puzzle. The company argues that the delay in identification gives malicious actors time and space to spread further through the network during an investigation.

The new solution changes the paradigm by enabling IR teams to initiate an investigation by first identifying and containing compromised accounts, effectively freezing malicious activity. This is done through a combination of machine learning and artificial intelligence to give IR practitioners access to highly actionable information that indicates which accounts and users need to be suspended and which accounts can remain operational.

Silverfort's Identity-First IR solution puts identity at the forefront by freezing stolen accounts and stopping lateral movements to reduce the impact of an incident while accelerating resolution time. The service can be deployed in less than 12 hours to an organization with 50,000 users to detect and contain compromised accounts and identify which systems, users or other assets in the environment have been compromised.

Key benefits of Silverfort's Identity-First Incident Response solution include allowing security teams to immediately suspend compromised accounts and trigger multi-factor authentication to provide real-time protection and actionable forensic data. The service automatically flags risky users and computers, giving teams full visibility into at-risk assets, while its authentication firewall enables rapid access restriction to limit the spread of an incident.

Additionally, the solution integrates with existing security operations by integrating identity protection measures into automated playbooks and providing advanced detection and response systems with identity-related threat signals. The service covers both on-premises and cloud environments and monitors every authentication attempt to ensure comprehensive identity protection across hybrid infrastructures.

“With the rapidly changing threat landscape and sophisticated AI-powered threat actors, security teams cannot afford to look for an anomaly when potential attacks occur or systems fail,” said Chief Strategy Officer Ron Rasin. “Although there is an established IR playbook for dealing with malware and network aspects of cyberattacks, the identity aspect is still a challenge.”

“Silverfort’s IR solution complements existing tools by immediately blocking compromised identities and neighboring machines and providing instant visibility into those machines,” Rasin added. “We are stopping the bleeding to ensure a safe recovery.”

The venture capital-backed startup has raised $222 million in funding, including $65 million in April 2022 and $116 million in January. The company's investors include Brighton Park Capital Management LP, Citi Ventures Inc., GM Ventures, Greenfield Partners, Acrew Capital Management and Vintage Investment Partners Ltd.

Image: SiliconANGLE/Ideogram