Taking a Page From Data Scientists for Better Security

This report advocates for a unified security data lake strategy to replace siloed security and enterprise datasets, enabling centralized, contextualized, and governed security data management. It outlines five steps—identifying data gaps, aligning stakeholder needs, standardizing data usage, normalizing/enriching data with common schemas (e.g., MITRE-CAR, OCSF), and designing with governance/security best practices—to improve threat detection, visibility, decision-making, and cost control across SOC and business teams.