StealthDEFEND®

Detecting and managing cyber-attacks remains difficult because adversaries increasingly rely on sophisticated, multi-step methods—often blending social engineering with compromised credentials—to bypass traditional perimeter defenses. Although firewalls, IDS, and IPS are widely deployed and effective for known threats and signatures, they generate overwhelming volumes of alerts and fail to reliably detect credential misuse, insider threats, data exfiltration, access misuse, and zero-day attacks. SIEM tools are frequently positioned as the answer, but in practice they primarily support after-the-fact analysis, reporting, auditing, and compliance; they have not consistently delivered actionable intelligence quickly enough to prevent loss or damage. As identity and access have become the “new perimeter,” monitoring user identity, access, and activity is positioned as the most effective way to detect illegitimate data access, while stronger access governance is necessary to reduce theft risk.

The text argues for integrating identity, access, and activity analytics into cyber-defense using big data infrastructure and machine learning to analyze large, varied data streams and raise alarms only when anomaly-driven confidence is high. A central challenge is calibrating “normal” behavior to reduce noise and avoid both false positives and missed real threats; rule-based tuning is skill-intensive, so organizations should favor solutions that embed community knowledge through preconfigured analytics and managed services.

STEALTHbits Technologies, a privately held company headquartered in Hawthorne, New Jersey, provides a suite focused on credential and data protection. StealthDEFEND is described as a real-time threat analytics product using STEALTHbits Activity Monitor data and unsupervised machine learning to baseline user behavior, prioritize sensitive data, detect common attack patterns (including ransomware indicators), provide investigation workflows and real-time visualizations, and integrate with SIEMs. Strengths include suite integration and real-time alerting; challenges include proving effectiveness across broad use cases and achieving best results alongside other STEALTHbits products.

• Most data breaches are detected by agents outside the organization rather than internal security tools.
• Firewalls, IDS, and IPS are widely deployed and generate alerts when suspicious events occur.
• Traditional perimeter tools are not able to detect compromised credential use, insider threats, data exfiltration, access misuse, and zero-day attacks.
• SIEM solutions can be configured to analyze event data after the fact and produce auditing and compliance reports.
• External attacks often include social engineering and exploit compromised or illicit user credentials to gain access to data.
• STEALTHbits Technologies is a privately held software company headquartered in Hawthorne, New Jersey, USA.
• StealthDEFEND uses STEALTHbits Activity Monitor data and unsupervised machine learning to detect threats to files and data as they occur.
• StealthDEFEND includes predefined threat models for patterns such as ransomware-related file system threats and unusual processes.
• StealthDEFEND can send identified threat data to SIEM solutions in real time to support consolidated alerting.
• StealthDEFEND includes an incident detection and response workflow to coordinate the threat response team.

• “For these reasons identity and access controls have become the new perimeter.”
• “The most effective way of detecting illegitimate access to data is through the monitoring of user identity, access and activity.”
• “While SIEM is a core security technology it has not been successful at providing actionable security intelligence in time to avert loss or damage.”
• “What is needed is the integration of user identity, access and activity analysis into cyber-defence to enhance threat prediction and detection as well as to enable remedial action to be taken before damage is done.”
• “The need to calibrate what is normal to reduce the signal-to-noise ratio in order to detect anomalies remains a challenge…”
• “End user organizations should always opt for solutions that include managed services and pre-configured analytics, not just bare tools.”
• “Unlike other solutions that focus on network traffic or on technical vulnerabilities this solution focuses on file access activity to detect and prioritize risk.”
• “Often the first sign of a cyber-attack is abnormal user behaviour.”
• “StealthDEFEND employs unsupervised Machine Learning technology that can detect patterns not discernible through summary statistical analysis.”
• “The extent to which this can replace professional services and deep knowledge of the tools, tactics and procedures used by cyber-security teams remains to be seen.”