Software Superman? Well not quite, but an interesting approach to 'guarantee' software functionality... [+]
Software has bugs, of course it does. Inevitably, software has bugs and this is part of the reason why a) functionality extensions and augmentations are a constant part of software application development b) patches and upgrades are an accepted part of software usage and c) why we sometimes pull our hair out when trying to use certain packages, suites, platforms and services.
This is (kind of) okay when it comes to productivity apps, database access and (to an extent) games… but it’s not okay when it comes to security software.
The software paradox
Paradoxically, although we need security software to be 100% robust, it really never can be i.e. there will always be vulnerability holes, zero-day exploits and new strains of ransomware that the security-centric developers who built the software (and continue to maintain it) never accommodated for, or foresaw.
The paradox here is that no security software developer has ever had the front to offer financial protection in the face of a ransomware attack that has been played out under the protective auspices of its product. One firm is trying to change that model. SentinelOne is claiming to deliver endpoint security protection powered by machine learning and automation under a cyber threat protection guarantee to provide customers with financial protection in the event of ransomware attacks on their networks.
The SentinelOne platform packages together what the Gartner Magic Quadrant calls, “On-device dynamic behavioral analysis to detect zero-day threats and Advanced Persistent Threats (APTs) and prevent exploitation…[providing] complete endpoint visibility for full investigative information in real time.”
The company itself was formed by a team of cyber security and defense experts from IBM, Intel, Check Point Software Technologies, McAfee, Palo Alto Networks and the Israel Defense Force. The guarantee offered here, if successful, could have an impact on the way software development products are sold outside of the security arena.
What? You mean I get my money back?
Well kind of yes, within an agreed (no doubt quite lengthy) service level agreement (SLA), so confident in its automated mitigation and remediation technologies is SentinelOne that it offers a cyber threat protection guarantee program provides its customers with financial support of US$1,000 per endpoint, or up to US$1 million per company.
The SentinelOne Cyber Guarantee is valid only for Windows-based user endpoints and servers. It does not cover Linux or Mac OS X endpoints and servers.
Co-founder and CEO of SentinelOne Tomer Weingarten spoke at an event in London this week to explain where the company gets its security swagger from.
“Going well beyond legacy methods that have relied on static, signature-based detection, SentinelOne’s machine learning technology is able to detect malicious code through the behaviours it exhibits on execution, allowing attacks to be rooted out even if the system is encountering an entirely new malware variant,” said Weingarten.
Does Weingarten expect to pay out and come to the rescue of firms that do get hacked using his firm’s software? “Yes, there will be instances where this will inevitably happen,” he concedes. But the crucial factors are that the firm’s software is good enough to make this an 'economic loss leader', so-to-speak.
A new model for the software industry?
Could this set a new economic model for the security industry?
Could this set a new ‘money back’ standard that permeates across wider transepts of the software application development industry?
“I’ve long rallied hard about the ineffective antivirus products currently on the market—which cost companies billions of dollars annually but ultimately fail to keep them secure,” said Jeremiah Grossman, chief of security strategy for SentinelOne. “The security industry is undergoing a credibility crisis, with security vendors launching product after product without specific validation of their effectiveness. But we’re headed for a major shift where security vendors will be required, not only by customers but by lawyers and insurers, to put their money where their mouth is.”
You wouldn’t purchase a car without a guarantee, obviously. Yes we have service level agreements with software application development being increasingly focused on cloud-based delivery mechanisms. But this is potentially a new development, so this is a trend to watch.
