The Diana Initiative 2022

There have been profound changes in security as a result of industry shifts toward cloud-native development, resilient architecture, and microservices adoption. My analysis of 372 million cyber assets, findings, and policies at 1270 organizations reveals just how significant the changes in the average asset inventory have been, and the profound impact on security teams.

This talk will share original, peer-reviewed research on the state of asset inventories and attack surface management at contemporary organizations and analysis of what it means for security teams, providing insight and advice for blue teamers, security leaders, and cloud engineers.

In particular, research will cover the industry average (mean) of 120,561 findings in backlog means for security team burnout and how the ratio of cyber assets to practitioners has reached dire levels. The talk will also cover how current security skills training does not reflect the realities of our cloud-native asset architectures, and why ultra-reliable network architecture demands new approaches to security.

Finally, the talk will provide original research and analysis of supply chain risk, as well as insight into the most common blind spots for security practitioners - based on analysis of asset inventories compared to practitioner queries of their environments.