Combine multiple security controls from a single vendor

Some vendors sell packages of standalone products and services that they erroneously market as "platforms," the Forrester analysts cautioned. But having fewer vendors doesn't necessarily mean having fewer tools.

According to Pollard, if a provider talks about the need for "integration" during the implementation phase, that can be a red flag -- pointing to a suite of separate products rather than a pre-integrated platform.

"Raise your eyebrows, because you might be getting sold a bill of goods," he added.

Provide a single unified UI

A platform should offer a strong security analyst experience, Pollard said. With a good UI, "your analysts are alt-tabbing less, context-switching is reduced and the information that they need to effectively disposition issues is presented to them [in one place]."

Provide a single underlying data model for all relevant data from each controller

In a single, extensible, cross-domain data model, data from diverse sources -- e.g., network devices, endpoints and cloud services -- is automatically available and useful across the platform. Customers should not need to manipulate the data or build out cross-domain functionality.

"At a minimum, it should save us from having to control-T in the different browser interfaces," Pollard said, adding that while a single underlying data model is uncommon, it is an essential part of a true platform. "At a maximum, it should be integrated together such that the data understands the rest of the data."

In the proof-of-concept phase, Burns added, make the vendor prove they have a single extensible data model, not just stitched-together schemas.

"Ask them to show you how they handle at least five different data types across the modules and tools," she said.

Enable outcomes that result in productivity gains for users

Ultimately, Pollard said, the point of a platform investment is to improve the security program's effectiveness and efficiency, thereby benefiting the business. With that end in mind, consider the following:

• Ease of deployment. A faster and easier deployment means the organization realizes value from its investment more quickly.

• Ease of use. Before committing to a new platform, have analysts with varying levels of experience -- not just senior power users -- test drive it, advised Burns.

  "Can they actually complete tasks faster? A good analyst experience means faster, more accurate decisions," she said. "It could be the difference between one compromised endpoint and a full-on data breach."

  Additionally, it should offer users the ability to easily create new automated workflows, Pollard said, based on APIs the vendor has already built under the hood.

  "Ultimately, it would be a lot better for us as practitioners if we could spend our time building workflows and not plumbing," he added, referring to under-the-hood engineering required to enable cross-platform workflows. "The plumbing stuff is really important, but if you're paying platform prices, Mario and Luigi better have already taken care of that for you."

• Built-in integrations. While standalone tools require SOAR to communicate and work cooperatively, platform tools should interconnect natively. Crucially, the Forrester analysts said, the platform model shifts the integration burden to the provider. It should enable an organization to avoid middleware costs, minimize consulting fees and reduce the maintenance and management burden on the SecOps team.

  "That's one of the biggest takeaways of this research: If you go with a platform, you should not have to burn consulting hours or development time on your platform," Pollard said. "If the vendor's done their job, all of that is happening underneath the hood. And if it's not, you're not getting a platform. You're getting messaging about a platform, which is very, very different."

• Context. Because platforms have fewer integration gaps, they should also have fewer blind spots and offer better context for understanding the security environment.

Enhance functionality and experience with third-party integrations through marketplaces and extensions

A platform should also offer third-party integrations with deep, bidirectional telemetry, Burns said.

"Ask them whether they prioritize integrations with their competitors," she added. "Because if there's just a bunch of ecosystem stuff from their own platform, that's not a platform, that's just a walled garden. They should be able to meet you where you are."

Also, be sure to research who wrote relevant modules, Pollard added. Customer-written modules might not always stay up to date.

Present financial advantages to the customer

Finally, a platform should bundle multiple security controls into a better, more useful and more cost-effective package, the analysts said. If a platform offering doesn't carry discounts or other financial incentives, it might be a marketing strategy.

"Vendors have shareholders," Pollard said. "So, the 'platform' story is not necessarily a story designed to benefit you. It might be a story designed to benefit them."

The bottom line: Proceed with healthy skepticism, the Forrester analysts urged CISOs, and hold vendors' feet to the fire.

"Simply calling something a platform does not make it so," Burns said. "So, if you're in the evaluation phase and what you're looking at lacks integrations, lacks a shared data model, lacks clear efficiency and productivity gains, then recognize it for what it is. It's just an opportunity to stamp your buzzword bingo card."

Alissa Irei is senior site editor of Informa TechTarget Security.