Like any chief information security officer (CISO), Elastic’s Mandy Andress has had to grapple with a fast-changing threat landscape that could affect its business, which provides search, observability and security offerings used by organisations across industries such as government, healthcare and financial services.

The stakes of a cyber breach are high, particularly for customers in regulated industries, which makes Andress’s job all the more crucial to defend its services and assets from nefarious actors.

“From a threat landscape perspective, we focus on understanding the overall activities that are happening, the TTPs [tactics, techniques and procedures] we need to be looking for, and then building our programme to ensure we are defending and getting the best visibility we can for our organisation,” Andress told Computer Weekly on a recent visit to Singapore.

That includes a recent move to implement phishing-resistant multifactor authentication for every employee amid efforts by threat actors to leverage social engineering to access employee credentials and compromise targeted systems. “That’s an example of what we’re looking at holistically that can have a real impact on security,” she said.

Elastic’s security team also conducts regular threat hunting as well as red-teaming exercises, penetration testing and code reviews to ensure nothing falls through the cracks. “My biggest concern as CISO is what am I missing? So, we always have multiple activities to bring in different insights, perspectives and experiences to help us see what’s there and what we could be doing better,” she said.

Being a supplier of a security platform that provides visibility into the attack surface, supports incident response and threat hunting among other security capabilities has been helpful. Andress said her security team ingests about 150TB of data daily to monitor and analyse threats.

“I’ve been in security for a long time and used a number of analytics tools. If I didn’t work for Elastic, I would still be using it as my analytics tool of choice because it can really provide insights quickly on your data,” she added.

Elastic’s security team also works…