4 ms·
Been in the space about a decade. Hope this helps. 1. Pain points: most corps already have tons of agents running everywhere, usually with one or more inventor
by infotogivenm 3y ago
Been in the space about a decade. Hope this helps.
1. Pain points: most corps already have tons of agents running everywhere, usually with one or more inventory management systems already. You would have to add a ton of new value to warrant another agent install. More agents = more ways in, which can weaken the system’s security. Discovering “unknown” network assets is also a constant struggle (qualys, rumble). Plenty of vendor apps and quite a few elastic search dashboards. Agent-based asset management is a very crowded space already.
- SBOMs: rarely see it, never seen it in third parties
- antivirus: rarely see it on linux servers outside of perhaps clamav scanning user uploads. You call monitoring systems for servers “IDS” intrusion detection systems. These are different from virus scanning and usually allow for runtime detection and alerting of anomalous behaviors.
- golang malware: all malware (shellcode included) must make syscalls to use system resources from userland. Your IDS should monitors syscalls. There’s no issue here.
- every medium to huge company I’ve been at has run Linux servers for everything, with AD boxes being the rare exception when the company uses windows clients.