Use of IT security automation tools 2020

According to a 2020 global security automation survey, the most widely used tool for security automation was IPS/IDS/ firewall/ unified threat management (UTM) alerts as of then, with 89.4 percent of respondents reporting the use of these to different degrees.

Tools included in automated IT security environment in global organizations as of 2020

Characteristic	Share of respondents
IPS/IDS/Firewall/Unified threat management (UTM) alerts	89.4%
SIEM correlation and analysis	88.6%
Endpoint detection and response (EDR) capabilities	87.2%
Vulnerability management tools	85%
Log analyisis	84.8%
Endpoint controls (e.g., network access control [NAC] or MDM)	83%
Identity management	81.8%
Host-based intrusion detection system (HIDS) agent alerts	79.9%
Services availability monitoring	79.6%
Network-based scanning agents for signatures and detected behavior	79.1%
Secure web gateway (on-premises and/or cloud proxy)	78.9%
Network flow and anomaly detection tools	76.9%
IR and ticketing	76%
Intelligence and analytics tools or services	74.6%
User activity monitoring tools	74.2%
Third-party notifications and intelligence	72.6%
SSL visibility (encryption/decryption) at the network boundary	69.3%
Security case management systems	68.9%
Homegrown tools for our specific environment (e.g., playbooks)	68.1%
Network packet capture or sniffer tools	67.4%
Sandboxing	65.8%
Network traffic archival and analysis tools	65.5%
Malware analysis	65.4%
File integrity monitoring (FIM)	62.5%
Behavioral monitoring (profiling)	62.5%
User notifications or complaints	61.9%
Visibility infrastructure to optimize connected security systems	59.1%
Browser and screen-capture tools	51.2%
Third-party tools specifically used for legal digital forensics	50.7%
Other	21.9%