It is a truth universally acknowledged that security APIs and integrations suck. Building them is time-consuming and resource-intensive, yet security teams increasingly want their vendors to provide them. Increasingly, integrations are becoming a critical market differentiator across large and small security technology companies.
The security vendor business model differs from many other technologies. Tools that enable business operations to streamline activities and improve productivity, like customer relationship management (CRM), sales, and task management tools. If these products play nicely together, customers optimize the value of their investment. However, with security technologies, customers can experience data breaches or compliance violations when a tool’s lack of integration creates blind spots.
As CISOs start looking to consolidate their mammoth security stacks, integrations become a security vendor’s +1 value add, if they can find a cost-effective solution for building them. A cybersecurity-focused integration platform with a Unified API offers the unique opportunity to improve revenue with a faster time-to-market capability.
Is The Integration Strategic? Build Internally.
Strategic integrations are fundamental to your business objectives and goals. Identifying the most-requested integrations often comes from your customer success team or your sales team’s win/loss analyses.
Problematically, the decision becomes complex when you look to your competitors. Some security vendors offer various products across the spectrum of security capabilities. While your point product solves a problem better than the competition’s version, potential buyers may be invested in that overall ecosystem, creating a barrier to market entry for you. Meanwhile, your competitor wants to retain market share so will refuse to build the integration to your product.
To identify strategic integrations, you should consider:
- Will this improve my close rate?
- Does this respond to customer requests?
- How does this increase our market share?
- Have we built something similar to improve the customer experience or improve the sales cycle?
Since these are critical to customer success and sales, maintaining control over them is fundamental so you can ensure that they function appropriately.
Is There High-Value Work My Engineers Need To Complete? Buy.
Integrations may support your business growth, but they are not your core product. Security tools are never complete because attackers continue to evolve their methodologies. Customers need innovation that responds to evolving threats, while they want integrations that make their lives easier.
To identify whether you have high-value work that your engineers should focus on, you should consider:
- Have recent changes to the threat landscape impacted customers’ ability to use my tool effectively?
- Does my product roadmap have something new and innovative that will expand my customer base?
- Will I experience customer churn without providing this new capability?
How Expensive Is Maintenance? Outsource Development.
Integrations are only valuable when they work consistently. Once you offer them to customers, you need to maintain them. In this case, both buying and building will cost you money. However, buying them is often less expensive since it allows your internal teams to focus on critical updates to your product.
With security integrations, engineers need to continuously update the integration when they update core functionalities because it can change the fields and formatting. Without doing that, the integration can fail. Unlike a business integration that may disrupt productivity, a service outage for a security integration may mean a detection fails to alert security teams, increasing the customer’s data breach risk.
When considering maintenance costs, you may want to ask:
- Do I have the internal staffing to monitor these integrations continuously?
- Does my team have enough time to monitor these integrations continuously?
- Can my team meet service level agreements (SLAs)?
Will My In-House Team’s Lack Of Experience With Security APIs Impact The Integration? Outsource Development.
Security integrations are unique when compared to traditional business APIs. Three key differences that make security APIs more challenging than traditional business APIs relate to your product and your customers’ requirements:
- Format complexity: While traditional APIs typically use only a few formats and have similar field names and structures, security APIs handle a variety of formats, including some proprietary ones, while managing diverse schemas that become more complicated with nesting.
- Schema flexibility: While business schemas are typically stable and predictable, security schemas change in response to new threats and risks.
- Security and compliance: While business APIs may allow some sensitive data transfers, security APIs transmit various types of sensitive data covered under different security and data protection compliance requirements.
Your developers often understand how your unique product works and the data that it generates. However, the integration needs to translate data to the receiving application’s format. For example, if your product is an endpoint detection and response (EDR) solution and customers want to integrate with their security information and event management (SIEM) solution, then your developers need to understand the data formats and schemas for the SIEM.
When considering your engineering team’s experience with security APIs, you may want to ask:
- How many people on my team have built security integrations before?
- How many security integrations have the people on my team built already?
- Can my team support proprietary data formats and schemas?
- How much experience managing security and compliance does my team have?
- Can my team translate their current experience to other security technologies easily?
Will The Integration Support a Revenue-Generating Partnership? Build internally.
While customers may want all the integrations with all the security tools, your business model may focus on the ones that support strategic partnerships. As implementing a defense-in-depth strategy, your customers may have security tools that overlap, dovetail, or augment each other.
In security, partner marketing often enables vendors to expand their brand visibility while ensuring that customers have a comprehensive solution to their problem. However, when you build integrations to support a partnership, you need to think carefully about how the investment supports your revenue goals. You want to find partners whose tools augment your product’s capabilities or provide coverage where your customers need it.
When trying to build integrations that support your partnership programs or other revenue-generating integrations, you should consider:
- How will integrating with this technology improve brand awareness?
- How does this integration expand my reach into new industry verticals?
- How will this integration improve the customer experience?
Do I Need to Build an Integration for Another Vendor in the Same Security Category? Buy.
Most vendors respond to a specific type of security concern, often mapped to a compliance framework. Some examples include:
- Identity Governance and Administration (IGA) and Identity and Access Management (IAM) that mitigate risks associated with creating, terminating, and managing user credentials and access.
- Firewalls and Web Application Firewalls (WAF) that monitor network traffic to identify suspicious behavior.
- Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) that mitigate device-based risks, like malware or ransomware.
If you build an integration for one vendor within a security category, you may want to connect your solution to others who do something similar. However, creating a unique integration for each vendor becomes time-consuming and cost-ineffective.
A Unified API will integrate with various individual vendors who provide similar services. For example, you could consider having a Unified API for vendors across any or all of the following:
- Security event management
- Ticketing and notification
- Vulnerability management
- Data Storage
- Identity management
- Endpoint security
- Network security
- Cloud security
- Asset management
- Email security
By focusing on what a security tool does rather than who the vendor is, you can provide customers with a greater depth and breadth of options. Often, finding a provider to build the Unified API is a better option because these integrations come with additional complexities.
When looking to purchase access to a pre-built Unified API, you may want to consider the following:
- Does the vendor have experience with cybersecurity’s nuances?
- How does the vendor normalize data so customers can gain value from the integration?
- How easy will it be for customers to select, configure, and test the integration?
- What metrics are available around usage, connection failure, incident timing, and cause analysis?
Synqly: The Integration Platform Providing Security-Focused Unified APIs
Built by security veterans specifically for security vendors, Synqly addresses the use cases that our customers need. Security teams need and want integrated solutions, and we understand how to build and maintain security tool APIs. Our security-focused integration platform provides a single API across multiple vendors within a security control category, reducing the time and resources required to deliver a broad, integrated security system.
Contact us today to see how to improve revenue with a unified security API that understands you and your customers.
