The Five Keys to Choosing a Cloud Security Provider

Originally published by Tenable.

Written by Shai Morag.

 

Multi-cloud and hybrid environments, on the rise in recent years, have increased the complexity of security. Amid this complexity, risks have increased. But those risks don’t just come from threat actors. In fact, choosing cloud security providers with conflicting priorities can also introduce risk.

World-class cloud security requires independence and transparency — and your security needs should sit at the center. With that in mind, we collected five keys to choosing a long-term cloud security provider to protect your organization and your cloud strategy.

 

1. Insist on checks and balances

Think of a cloud security provider as a second set of eyes. So using the same organization that’s responsible for your cloud infrastructure doesn’t really make sense. If you go with the cloud provider to safeguard those assets, you’ll lose all-important checks and balances. Although a provider might tell you different, faced with policing itself, no company can be impartial. Security should be independent from infrastructure because a cloud service provider’s product roadmap, revenue model or strategic priorities might result in missed risks.

 

2. Be choosy about granting visibility

Visibility is essential for security vendors. Your configurations, vulnerabilities and even metadata about how you use various cloud services are necessary for protection. But, in the wrong hands, that kind of deep visibility can turn into competitive leverage. So, think about the vendors you’re evaluating: What other lines of business are they in that might benefit from knowing how you operate? Find out if they compete in areas such as cloud infrastructure, data services or AI/machine learning platforms. When you sign on with a cloud security provider, you should be confident that they’ll focus on protecting you rather than gathering intelligence on how to upsell additional cloud services.

 

3. Make sure your priorities remain at the center

A lot of cloud security platforms make broad promises of multi-cloud support. But, when you get security from a cloud provider, those priorities can change, with future product development favoring the home team. Where does that leave your priorities? Will integrations with your preferred platforms suffer? Will support or feature enhancements favor one cloud over another? You should ensure that your cloud security partner has a roadmap that matches your needs today and won’t shift as corporate objectives change tomorrow.

 

4. Stay portable

Change in cloud environments can be difficult and costly. But your needs can quickly evolve, so avoid vendors that try to lock you into a specific cloud ecosystem or put up barriers that can trip you up as conditions change. The right security company will help you stay flexible, ensuring you can scale, shift or change providers while maintaining your security posture and budget.

 

5. Think beyond just “cloud security”

Time is almost up for solutions solely focused on cloud security. Exposure management is coming to the fore as security threats grow quickly. Exposure management looks at business risk across an entire organization — and that should be your goal. Your security products need to fit into your broader exposure management strategy. With most large organizations operating in a hybrid cloud environment, visibility into the entire attack surface is a requirement. Threat actors don’t care about boundaries, so you need to cover all your bases, including everything from cloud and operational technology to clients and more.

 

Takeaway: Make sure your security provider has the right priorities

As you evaluate cloud security vendors, lean toward those that:

• Are really neutral, with no ownership or influence from any of the cloud providers
• Have your security as their sole focus, with no interest in selling you infrastructure
• Have a track record of providing innovative research and security
• Can protect multi-cloud and hybrid environments just as well
• Are transparent about their product roadmaps and priorities
• Commit to your ability to maintain control and stay flexible for the long-term

The security of your cloud is too important to trust to a company that doesn’t support your priorities. You should choose an independent, neutral partner with a laser focus on protecting you, no matter where your cloud strategy takes you.

 

---

About the Author

Shai Morag is Tenable’s chief product officer, with more than 25 years of experience in product management, technology leadership and senior executive roles. He was formerly CEO of Ermetic, which Tenable acquired in 2023. Before Ermetic, Shai was CEO of Secdo and Integrity-Project. He also served for 10 years as an officer in the Israeli Defense Forces Intelligence Corps Unit 8200.