Composable Architecture with a Security-Focused Unified API

The modern security operations center (SOC) needs the cybersecurity equivalent of LEGO systems. LEGO systems are interlocking plastic bricks that unlock creativity for kids and adults. The secret to LEGO systems lies in their innovative design, the bumpy studs on the top, and the holes known as anti-studs. The patented design and its “clutchability” enable people to realize their imaginations in the real world. 

For SOC teams, a composable architecture is the core foundation of an innovative, interoperable cybersecurity stack. Enabling security teams to design the security system that responds to their unique needs and risks. As more organizations seek to adopt a cybersecurity mesh architecture (CMSA), a security-focused Unified API becomes the digital equivalent of the LEGO brick’s studs and anti-studs, the building block that connects different security solutions into a whole that is greater than the sum of any individual part. 

As SOCs move away from monolithic architectures built around a single security alert solution, security vendors need to leverage integrations as a competitive differentiator  that enables customers’ composable architectures. 

What Is a Composable Architecture?

A composable architecture emphasizes building applications and systems from components that communicate through well-defined Application Programming Interfaces (APIs). These systems allow organizations to select and connect best-of-breed components that meet their specific needs by being:

• Modular: Each component operated independently, reducing dependencies and simplifying development. 
• Interoperable: APIs allow the components to communicate and share data seamlessly. 
• Flexible: Businesses can adapt to a changing landscape and implement new solutions as needs evolve. 

Understanding the Building Blocks of a Composable Architecture for Security Use Cases

Recent discourse around security technology stacks can be summarized as “tell me you want a composable architecture without telling me you want a composable architecture.” Security teams manage an average of 70 to 130 discrete tools, yet still struggle to consolidate these tools in ways that provide insights. 

Composable architectures are the answer to these challenges, and vendors must respond to these needs or lose out on market share. 

Modularity: Self-Contained Independent Components and Point Solutions

Modularity is the foundation of the composable architecture. At the core, each service can be developed and maintained independently. In security, this might look like having different vendors across each tool category, like:

• Security event management
• Ticketing and notification
• Vulnerability management
• Data Storage
• Identity management
• Endpoint security
• Network security
• Cloud security 
• Asset management
• Email security

Interoperability: Flexibility: Seamless Communications through APIs

APIs are the core building blocks that enable seamless communication and data exchange across these independent components. For example, security teams need to integrate their cloud security and configuration management tools with their identity lifecycle management and authentication tools. While each provides separate data, seamless integration and communication enable security teams to leverage security analytics. 

Flexibility: Adaptability and Ease of Change

With a composable architecture, organizations can quickly swap or modify the individual components without affecting the entire system. In security, this flexibility enables security teams to address evolving threats and purchase point solutions without compromising their current tooling deployments. Security vendors with solutions that integrate into these architectures can provide additional value either by:

• Augmenting the data that these new tools generate to improve alerts. 
• Supplementing the original tool’s data to improve analytics. 

Scalability: Growing and Shrinking Resources On-Demand

With a composable architecture, organizations can add new technologies or modify existing components without affecting the entire system. In security, composable architectures allow SOCs to scale resources on demand when data volume spikes, then reduce them again when the noise clears. Composable architectures enable SOCs to scale their security tooling capacity during an incident, allowing them to pull data from security data lakes and feed security automations. 

Reusability: Maximizing Value from Existing Components

In a composable architecture, reusability is the ability to apply the same component, workflow, or integration across multiple use cases without rebuilding it. For SOC teams, reusable data pipelines and integrations enable building automation steps across pre-tested response actions, like isolating a network segment or enriching an alert. Since the security team can mix and match the building blocks, they can scale their security monitoring and response activities more efficiently. 

Increasing Revenue by Enabling Customer Composable Architectures

As customers move toward composable security architectures and analysts advocate for CSMAs, security vendors must provide native integrations to maintain current revenue streams and appeal to new customers. As more new security solutions arrive on the market, vendors must create customer stickiness, or they will find themselves easily replaced in these new architectures. 

Baseline Expectations

Composability is no longer optional for the modern SOC. Security teams need best-of-breed technologies, often integrating new point solutions that respond to new threats. Whether a security vendor is new to the market or established, it must integrate or risk being excluded. 

Customer Retention

As SOCs increasingly adopt cloud-native solutions, they can switch between vendors more easily. To maintain annual recurring revenue (ARR), security vendors must fit into their customers’ security architectures. Vendors who offer a wide variety of integrations play a central role in customers’ security operations and workflows. By providing integrations, vendors improve stickiness. 

Rapid Onboarding

New customers must provide a return on investment (ROI) for all security tools. By offering native integrations, vendors streamline deployments and lower the total cost of ownership. These integrations ultimately mean that customers can more easily defend their security investments internally. 

The Value of a Security-Focused Unified API

For security vendors, integrations can take developers away from working on core product features and updates. Over time, the cost to develop and maintain a single API can be anywhere between $48,960 and $65,280. However, with a security-focused Unified API, vendors can give customers the experience they need while reducing the overall go-to-market costs. 

Normalize Complex Security Data Format and Schemas 

Security data has a wider array of data formats and schemas than traditional business APIs can handle. Security solutions may use any of the following formats:

• Syslog
• JSON
• XML
• Vendor specific formats, like Palo Alto, Cisco, Microsoft Windows Event logs

A security-focused solution understands these unique challenges and can also manage the different schemas across field names and structures. For example, working with a solution that parses and normalizes security data to the Open Cybersecurity Schema Framework (OCSF) improves overall integration across these diverse technologies, enabling customer composable architectures. 

Maintain Availability

Unlike business APIs, security APIs have dynamic schemas that change in response to new threats and risks. Changes to APIs often disrupt the data flows, leaving customers without important security telemetry. For customers, these service disruptions can impact their ability to detect, investigate, or respond to an incident in a timely manner. For vendors, that disruption can lead to customer distrust and churn. A security-focused Unified API understands how these changes can impact availability, even when the vendor makes schema changes like:

• Adding new fields
• Changing field names
• Updating the log structure

Manage Security and Compliance

Security APIs manage sensitive data beyond the information that traditional business technologies store and transmit. A Unified API that enables security vendors to provide native integrations for customer composable architectures should understand static customer data and dynamic IT environment data, including:

• Names
• Birthdates
• Bank account information
• IP addresses
• Hostnames
• User credentials

Synqly: Unified APIs for Composable Security Architectures

Built by security veterans for security vendors, Synqly is the first unified API for cybersecurity, IT Ops, and Managed Service Providers. With Synqly, you can provide the native integrations that customers want without the hassle and costs of building the APIs internally. Our cybersecurity integration platform connects your solution to dozens of other security tools so that customers have the connectivity they want for the visibility they need. 

Synqly provides a single API that enables integrations across multiple vendors, reducing the time and resources required to deliver a broad, integrated security ecosystem. You can simplify the integration support and maintenance with our real-time monitoring and management dashboards that provide insight into API usage and availability. 

Learn how you can extend your product’s value by contacting us today.