Misconfigured components in production remain one of the most common—and most preventable—sources of security risk. To help you better understand and prioritize your organization’s misconfiguration issues, Dynatrace Security Posture Management (SPM) introduced severity classification labels for all misconfiguration findings based on the Common Configuration Scoring System (CCSS). CCSS provides a standardized, vendor-agnostic way of assessing configuration weaknesses that allows for clear, consistent scoring across diverse environments.

By aligning our findings with CCSS, teams can now compare misconfigurations across different frameworks, benchmarks, and technology stacks using a unified metric. This not only improves prioritization and triage but also strengthens communication between security, operations, and compliance teams. Whether you’re evaluating a Center for Internet Security (CIS) benchmark, the Digital Operational Resilience Act (DORA) framework, or Defense Information Systems Agency Security Technical Implementation Guides (DISA-STIGs), severity is now measured on the same transparent and repeatable scale—making it easier than ever to focus on what matters most.

How Dynatrace determines misconfiguration severity levels

By leveraging CCSS, Dynatrace researchers and domain experts evaluate the severity of configuration weaknesses by scoring them using metrics that capture the intrinsic characteristics of each misconfiguration—such as how easy it is to exploit and its potential impact. These metrics are combined into a numerical score that maps to a severity level (low, medium, high, or critical), providing a consistent and repeatable way of measuring configuration risk.

Specifically, these metrics can be summarized along three focus areas:

• Likelihood (L): Measures how easily a misconfiguration can be exploited. It considers factors such as required access level, required system knowledge, authentication requirements, and whether exploitation is automated or manual.
• Technical Impact (TI): Assesses the degree to which a misconfiguration affects confidentiality, integrity, and availability if exploited.
• Configuration Impact (CI): Captures risk related to the misconfiguration itself—how significantly it weakens expected security controls or baselines.

How it works

Our security research team recently evaluated the Ensure that the –authorization-mode argument is not set to AlwaysAllow rule from the CIS Kubernetes benchmark. This check describes a configuration in which the Kubernetes API server allows all requests—this rule should not be used in any production environment.

Our internal researchers and Kubernetes experts assessed this rule as follows:

This assessment results in a severity classification of Critical, which is appropriate, as the CIS benchmark states that this configuration should not be used in a production Kubernetes cluster.

The severity of each misconfigured rule is tracked in the Dynatrace Security Posture Management app, where each rule’s severity label is assigned by a domain expert, ensuring the highest assessment quality.

Impact on the current rule severities in Security Posture Management

The new rule-severity level assessments in the Security Posture Management app will replace the current labels, which are based on different factors and vendor classification. While the current severity labels aren’t wrong, depending on the rule-benchmark vendor, they sometimes focus on different areas. For example, rules might be classified by how difficult they are to implement in a given configuration in a specific environment.

By adopting the Common Configuration Scoring System for all misconfiguration findings in Dynatrace SPM, we’re taking a major step toward delivering clearer, more transparent, and more actionable security insights. This standardized, expert-driven severity model ensures that every rule—across every benchmark—is evaluated with the same rigor and security-focused methodology. As a result, teams can make better-informed decisions, prioritize risk more effectively, and maintain a consistent understanding of configuration health across their entire environment. While some individual rule severities will change with the transition, the outcome is a stronger, more reliable foundation for managing configuration risk at scale.

What you need to do

With the new CCSS-based classifications, we ensure that each benchmark in SPM receives a unified, security-focused rule classification. The current severity label of a rule might change when the CCSS-based classification is deployed with Dynatrace version 1.334. If you’re on Dynatrace SaaS, this change will happen automatically when version 1.334 is rolled out in March 2026. If you’re on Dynatrace Managed, an update to Dynatrace Managed version 1.334 (or later) is required.

The post Strengthen your security posture with the Common Configuration Scoring System for misconfigured production environments appeared first on Dynatrace news.

Compliance is only getting more complex, as organizations seek to proactively manage compliance risks and maintain trust with stakeholders. Traditional compliance tools often operate in silos, leaving critical compliance risks undetected. This fragmented approach makes it difficult to connect compliance risks to business impact, collaborate across teams, or respond quickly to incidents. Complex alignment between IT, legal, and business teams often results in inefficiencies, miscommunication, and critical compliance gaps. Furthermore, manual processes for managing compliance tasks are not only time-consuming but also insufficient in keeping pace with growing regulatory pressures.

From static checklists to continuous framework-specific visibility

With Compliance Assistant, Dynatrace provides compliance-critical observability and security insights streamlined into a single pane of glass. You can now track compliance health across IT and business landscapes with ease, with real-time insights mapped directly to a compliance framework.

Compliance Assistant provides an out-of-the-box, tiered score that reflects the current compliance risk posture across Information and Communication Technology (ICT) incidents, vulnerabilities, security detection findings, and misconfigurations. Designed to meet the demands of frameworks like EU DORA (Digital Operational Resilience Act), this score provides a quantifiable snapshot of ICT risks at a glance, enabling cross-functional collaboration and empowering teams to stay ahead of risks and maintain confidence in their compliance efforts.

Map IT assets to end-to-end compliance-critical business processes

Under EU DORA, organizations are required to identify and monitor critical or important functions (CIFs). This includes business operations that could significantly disrupt financial performance, service continuity, or compliance with regulatory obligations.

Identifying critical or important functions (CIFs), such as payment processing or fraud detection, requires in-depth business process monitoring and a clear understanding of how IT systems support them. Compliance Assistant transforms this traditionally complex task by leveraging Business Flow, powered by Dynatrace, to break down the steps of a critical or important function (CIF) directly connected to specific business milestones in real-time. With Smartscape on Grail, Dynatrace offers end-to-end visibility by linking compliance-critical business processes to specific IT components, hosts, or applications. For example, a payment approval process in Business Flow can be linked to a payment gateway service, a transaction database, and a fraud analytics engine — enabling Compliance Assistant to show how a single critical or important function (CIF) depends on multiple IT components.

With this business-centric approach, Compliance Assistant empowers teams to automatically track critical metrics such as conversions and errors, proactively addressing any potential disruptions to underlying services. The integration with Business Flow doesn’t just enhance visibility; it fosters collaboration by bridging IT performance data with tangible compliance-critical business outcomes.

Confidently manage compliance risk

Managing ICT risks is a cornerstone of compliance with resilience frameworks, and Compliance Assistant helps you leverage Dynatrace Application Security capabilities with insights mapped to regulatory requirements.

Compliance Assistant consolidates:

• Vulnerabilities with a breakdown of findings by severity and real runtime exposure, enabling security champions to prioritize risks through a compliance lens.
• Security detection findings offer visibility into suspicious activities across the digital landscape.
• Compliance results for evaluating configuration data against the relevant compliance standard. The built-in tile in ICT asset configuration rules summarizes assessment results by the percentage of passed and failed rules, powered by Dynatrace Security Posture Management.

Compliance teams must demonstrate regulatory readiness across security, infrastructure, and operations teams, often speaking different languages about configurations, vulnerabilities, and compliance gaps. The unified compliance-health view bridges domain gaps, reducing back‑and‑forth between teams and enabling efficient alignment. Compliance Assistant goes beyond ticking boxes next to regulatory requirements by translating abstract rules into concrete workflows, so you can close the cross-functional operational loop and confidently track progress towards compliance readiness.

AI-powered incident classification

Complying with regulations like EU DORA also requires organizations to identify, classify against thresholds, and report major incidents impacting compliance-critical business processes. This requirement poses significant challenges, especially in complex IT environments with high volumes of data.

Dynatrace Compliance Assistant simplifies this process with an AI-powered incident classification workflow. It automatically identifies potential incidents affecting critical or important functions (CIFs) and, based on the calculated impact against EU DORA classification criteria, categorizes them into unclassified, potential major incidents, and classified major incidents.

For each potential incident, you can access detailed insights into the triggered materiality thresholds, which signal the potential need to escalate an incident for classification as major:

1. Critical or important functions affected: Assesses the blast radius of the incident and its impact on compliance-critical business processes.
2. Incident duration: Monitors the 24-hour materiality threshold of the criterion for incident classification, according to EU DORA.
3. Economic impact: Indicates whether the impact surpasses the classification threshold of €100,000. The impact is calculated based on the estimated incurred cost per minute of the relevant CIFs and the duration of an incident.

For example, if payment processing is down for 30 minutes and the estimated economic impact exceeds €100k, the incident meets one of EU DORA’s materiality thresholds and Compliance Assistant flags it accordingly.

Under EU DORA, an incident must be classified as major if two or more materiality thresholds are breached. Dynatrace streamlines this process by automatically identifying threshold breaches and allowing users to manually classify incidents directly from the incident details page. Users can also add comments to document their reasoning, ensuring transparency and traceability. This end-to-end functionality ensures organizations can confidently manage incidents, align workflows, and accelerate regulatory reporting.

Classification of an incident in Compliance Assistant generates a snapshot of the compliance incident as a business event, enabling integration with your incident management ecosystem. Automations with Dynatrace Workflows can then be triggered by this classification event to bridge gaps between observability, compliance, and incident management teams. For example, you can use workflow actions to create incidents in your ServiceNow environment or to create a Jira ticket enriched with details of the incident’s compliance impact.

Ready to transform your compliance strategy?

Install and activate the Compliance Assistant app from Dynatrace Hub and take the first step toward streamlined, real-time compliance management. With Compliance Assistant, you can simplify compliance workflows while aligning IT operations with broader business objectives, ensuring more efficient compliance strategies.

• To learn more about setting up Compliance Assistant, check out the documentation.
• Share your feedback, suggestions, and ideas with us in the Dynatrace Community.
• New to Dynatrace? Try Compliance Assistant in the Dynatrace Playground or start a free trial to see Dynatrace in action

What’s next for compliance intelligence

We’re committed to continuously evolving Compliance Assistant to meet your ever-changing compliance needs. Upcoming enhancements include support for additional regulatory frameworks and expanded automation capabilities, allowing for even broader compliance coverage across industries. Stay tuned as we continue to empower organizations to simplify compliance, reduce risk, and stay ahead in a complex regulatory landscape.

The post Unlock business-centric compliance intelligence with Dynatrace Compliance Assistant appeared first on Dynatrace news.

AI is compressing attack timelines

The organizations pulling ahead are those with runtime visibility into the applications that directly generate and impact revenue.

What AI is changing

In a report published in November 2025, Anthropic documented the first large-scale AI-orchestrated cyberattack campaign, in which AI autonomously performed 80–90% of attack operations with minimal human intervention. This signaled a turning point.

The threat actors causing the most damage today aren’t traditional nation-state actors or advanced persistent threats (APTs)—they’re financially motivated collectives like Scattered Spider. AI hasn’t invented fundamentally new attack techniques yet, but it has significantly increased attack volume and velocity—CrowdStrike observed an 89% increase in attacks by AI-powered adversaries in 2025 alone.¹ Techniques once reserved for state-sponsored groups are now accessible to cybercriminals through AI-assisted tooling.

The same automation accelerating attacks also allows for faster defense. But with an average time of only 29 minutes from initial access to lateral movement, defenders relying on periodic assessments are structurally disadvantaged. The capability that matters now is continuous exposure assessment—analyzing real-time signals across all cloud assets and acting before adversaries complete their objectives.

Two battlefronts: One adversary

Traditional attack vectors haven’t disappeared—supply chains, endpoints, physical security, and human-targeted attacks are increasing just as rapidly. But business-critical applications have become a focal point of attack operations because lower entry barriers make them accessible to more threat actors. The applications that process transactions, manage customer data, and orchestrate supply chains are precisely where runtime compromise has the greatest business impact.

Organizations must drive parallel initiatives: one focused on people, identity governance, and communications; another on runtime protection, continuous exposure management, and application-layer visibility. These require different tools and skills—but critically, connected processes and connected insights. Siloed security functions are precisely what sophisticated attackers exploit.

Why runtime is the new frontline

Initiatives like Anthropic’s Claude Code Security and OpenAI’s reasoning-based vulnerability detection are collapsing scanning stages and shortening developer feedback loops. This is real progress. But production remains the definitive validation point. AI-generated code and accelerated release cycles introduce risks that surface only at runtime—pipeline scanners offer helpful signals but lack the reliability and context of a unified runtime view.

In an agentic ecosystem, detection and response can’t be focused on the perimeter—they must be intrinsic to the application and infrastructure. Environment-aware malware and prompt injection against enterprise AI agents aren’t visible at the perimeter. They’re visible at runtime. The XZ Utils backdoor (CVE-2024-3094) demonstrated this perfectly: malicious code passed all static analysis, activating only when loaded by sshd on targeted Linux distributions in production.⁷

Autonomous workflows that lack visibility into security risk operate with an incomplete picture. Integrating security context into agentic decision-making—rather than treating it as a separate operational domain—will be essential as enterprises scale these capabilities.

– IDC Link, Dynatrace Perform 2026: From Observability to Supervised Autonomous Operations (Doc #lcUS54307526, February 2026)

Security that’s embedded, not bolted on

The convergence of observability and security isn’t theoretical—it’s operational. IDC analysis notes that organizations expect the next generation of security to be embedded in solutions rather than bolted on. Dynatrace application security capabilities—runtime vulnerability analytics and runtime application protection—operate within Grail alongside observability and business data, sharing the same contextual mapping and causal dependency graph.

Resilience as a competitive advantage

Fortune 500 organizations that embed security into procurement, prioritize supplier maturity assessments, and integrate threat intelligence into operations are positioned to protect both infrastructure and the applications that drive revenue. Forward-thinking organizations recognize the agentic evolution as an opportunity to align security investments with business outcomes and build operational resilience that allows confident growth.

In a world where adversaries move from initial access to lateral movement in 29 minutes or less and autonomous agents make decisions at machine speed, the organizations that thrive will be those with unified runtime visibility.

Clarifying the competitive narrative

There is a prevailing belief that frontier AI labs—Anthropic with Claude Code Security, OpenAI with Codex⁵—are making traditional security tools obsolete. This belief is partially correct, but it fundamentally misunderstands which tools are being displaced.

What frontier labs are changing

These capabilities collapse scanning stages in the IDE and CI/CD pipeline. They find vulnerabilities through reasoning rather than pattern matching, uncovering business-logic flaws that static analysis misses. This is genuine progress—and it is expected to reduce certain vulnerability classes over time. SQL injection, for example, may become less prevalent as LLM-generated code matures and shift-left tools are integrated throughout the agent development lifecycle.

What frontier labs don’t address

Frontier lab security tools operate before deployment. They don’t see how code behaves in production—outside of API integrations that push context to them. They can’t detect configuration drift, environment-aware malware that activates only at runtime, or prompt injection against live AI agents. Anthropic describes Claude Code Security as an evolution of static analysis: rather than matching known patterns, it “reads and reasons about your code the way a human security researcher would.”⁴ Static analysis operates on code before it runs. These tools sit at completely different points in the security lifecycle from runtime protection.

What Dynatrace surfaces today

These capabilities deliver findings that frontier lab tools can’t—evidence of what is actually happening in production, not predictions based on code analysis.

Runtime Vulnerability Analytics

Identifies vulnerabilities in the context of actual execution—not theoretical exposure, but real risk based on how code runs in production.

Runtime Application Protection

Detects and blocks exploit attempts as they happen—the defensive layer that shift-left tools structurally can’t provide.

Security Posture Management

Surfaces misconfigurations and compliance gaps in live cloud infrastructure, including Kubernetes environments.

The evolving threat landscape

The Open Worldwide Application Security Project (OWASP) Top 10 for Agentic Applications (2026) report, provides consensus-based guidance and introduces new categories—Agent Behavior Hijacking, Tool Misuse and Exploitation, and Identity and Privilege Abuse⁶—directly relevant for organizations deploying autonomous agents. For any organization running business-critical applications, runtime visibility remains the validation layer that confirms whether security controls actually work.

What this means in practice

Organizations using Dynatrace already have the core capabilities required for agentic security.

• Security findings flow directly to development and SRE teams through workflows that include clear remediation guidance.
• Natural-language queries on security findings are already available through Dynatrace Intelligence.
• Dynatrace Intelligence allows agentic remediation, allowing automation to act within goals and constraints defined by humans and for humans to retain the flexibility to stay in the loop (see Agentic workflows in Dynatrace documentation).

What sets the Dynatrace approach apart is the combination of deterministic runtime findings with agentic workflows—enabling remediation that is reliable, repeatable, and grounded in real production evidence.

Article citations

1. CrowdStrike 2026 Global Threat Report. Average eCrime breakout time (initial access to lateral movement) fell to 29 minutes in 2025, a 65% increase in speed from 2024. Fastest observed: 27 seconds. CrowdStrike also observed a 89% increase in attacks by AI-enabled adversaries compared with 2024. crowdstrike.com/en-us/blog/crowdstrike-2026-global-threat-report-findings
2. Fortune, “Feds are hunting teenage hacking groups like ‘Scattered Spider’ who have targeted $1 trillion worth of the Fortune 500 since 2022,” January 2026.
3. Anthropic, “Disrupting the first reported AI-orchestrated cyber espionage campaign,” published November 2025. Attack detected mid-September 2025. AI executed 80–90% of tactical operations independently.
4. Anthropic, “Claude Code Security,” anthropic.com/news/claude-code-security, 2026.
5. OpenAI, “Codex,” platform.openai.com/docs/codex.
6. OWASP GenAI Security Project, “Top 10 for Agentic Applications 2026,” genai.owasp.org, December 2025.
7. CVE-2024-3094 (XZ Utils). Backdoor activated only when loaded by sshd on targeted Linux distributions — bypassing all static analysis. Wired, April 2024.
8. Dynatrace Intelligence: “supports in-context natural language for investigation and guided next steps.” docs.dynatrace.com/docs/dynatrace-intelligence

The post The runtime reckoning: How the agentic evolution is reshaping security appeared first on Dynatrace news.

Trusted vulnerability data empowers teams to make faster and clearer security decisions. That’s why we’re elevating the Dynatrace Vulnerabilities app with the Dynatrace Vulnerability feed: a new, native source of vulnerability intelligence that’s more accurate, transparent, and threat-aware, helping maintain strong coverage of critical risks. With curated inputs, stronger sourcing, and deeper integration across the Dynatrace platform, teams can prioritize what matters most—and act with confidence.

A native vulnerability feed: Agile, precise, and focused on real customer risk

We recognize how quickly noise and alert fatigue can slow vulnerability management. When teams face a high volume of security findings, they require accurate, timely, and reliable threat intelligence to address potential breaches and optimize remediation time, resources, and costs. That’s why Dynatrace is upgrading the Vulnerabilities app to use the Dynatrace vulnerability feed—a new, internally curated source of vulnerability data that replaces the previously used external feed. It delivers more accurate, timely, transparent, and threat-aware vulnerability information, tightly integrated with innovations from Dynatrace security researchers, already recognized through a European patent.

The Dynatrace Vulnerability feed is built on multiple reputable sources, including OSV.dev, GitHub, the National Vulnerability Database (NVD), and vendor advisories, providing comprehensive coverage of vulnerabilities. These insights are further curated and enriched by Dynatrace’s own findings and internal security research.

Key benefits for customers

The new Dynatrace Vulnerability feed is included in the Vulnerabilities app at no additional cost and offers:

• Trustworthy, high-quality, curated vulnerability data

• Clearer and more consistent vulnerability descriptions and remediation guidance
• Strong coverage of critical and high-severity vulnerabilities
• Improved accuracy for certain findings compared to the previous feed
• Better long-term agility: Dynatrace owns and evolves the feed based on customer needs

• Deeper integration with the Dynatrace platform.

Coverage and parity with the previous vulnerability feed

The Dynatrace Vulnerability feed provides full parity with the previously used feed for critical and high-severity vulnerabilities in customer environments. For medium- and low-severity vulnerabilities, we ensure over 90% coverage in customer environments compared to the previous feed, while also adding extra vulnerabilities that were not previously included. Certain medium- and low-criticality vulnerabilities, as well as those without a CVE number that exist solely in the previous feed, will be marked as deprecated (Figure 1).

We recognize that coverage is a key topic for organizations when it comes to vulnerabilities. The Dynatrace Vulnerability feed is designed to be dynamic, keeping pace with the large volume of newly reported vulnerabilities. This agility ensures timely updates to meet customer-specific coverage needs, reducing blind spots and protecting against emerging threats. This flexibility is one of the key reasons we decided to introduce our own feed.

What changes for existing vulnerabilities?

From an access and viewing standpoint, nothing changes for existing vulnerabilities. You can continue accessing vulnerability insights from the existing Vulnerabilities app, ensuring a seamless experience with minimal disruption.

Existing vulnerabilities from our previous feed will retain their CVE numbers, but the IDs will be replaced with the Dynatrace Vulnerability IDs (Figure 2). Vulnerabilities from the previous feed without a CVE number will be automatically marked as resolved.

If your organization drives vulnerability remediation through an IT Service Management (ITSM) tool like ServiceNow, your existing tickets remain unchanged regarding CVEs and Dynatrace IDs. Tickets linked to vulnerabilities outside the Dynatrace Vulnerability feed will still function, but when accessed, the vulnerabilities might be deprecated, have updated severity, or have an adjusted score.

Availability for SaaS vs. Managed: What You Need to Do

The Dynatrace Vulnerability feed is available in all Dynatrace SaaS environments starting with version 1.334. If you’re on Dynatrace SaaS, this change will happen automatically when version 1.334 is rolled out in March 2026.

If you’re on Dynatrace Managed, an update to version 1.334 (or later) is required to use the Dynatrace Vulnerability feed. Be sure to update to version 1.334 or later before April 1, 2027; otherwise, you’ll no longer be able to analyze vulnerabilities.

Not a Dynatrace customer yet? Try the Dynatrace Vulnerabilities experience in our Playground and see how threat-aware, curated vulnerability intelligence helps you cut through noise and focus on real risk.

The post Introducing the Dynatrace Vulnerability feed: Accurate, transparent, and threat-aware appeared first on Dynatrace news.

Established by the Government of Dubai, DESC sets rigorous cybersecurity standards to safeguard critical systems, promote secure cloud adoption, and support transformational smart city initiatives. DESC certification confirms that Dynatrace meets and exceeds these standards, giving Dubai government entities confidence to deliver seamless, secure digital services to their citizens.

Overcoming challenges in public sector IT compliance

Dynatrace collaborates closely with public sector organizations in the UAE and worldwide to support government and educational institutions in delivering secure, reliable, and efficient services. Such organizations are obliged to implement adequate controls to ensure the integrity and security of their data. Government agencies are under added pressure; as they continue to digitally transform and their data is distributed across multiple platforms and applications, the complexity of their systems increases. Delivering secure, resilient, and optimized operations within these environments requires a platform that provides actionable insights and intelligent automation from vast amounts of cloud data, all while adhering to stringent cybersecurity requirements.

Dynatrace: Certified solutions to complex problems

The Dynatrace® AI-powered observability platform is purpose-built to process and analyze massive volumes of data, with robust controls in place to protect customer data. The platform continuously invests in advanced capabilities to stay ahead of evolving market standards, as well as regional and sector-specific requirements. Key Dynatrace capabilities that help Dubai governmental entities protect their data include the following:

• End-to-end observability — Real-time insights into applications, infrastructure, and user experience across hybrid/multicloud environments.
• AI-powered automation — Predictive analysis, root-cause detection, and instant remediation to accelerate resolution.
• Application security — Continuous threat detection and automated mitigation aligned with DESC requirements.
• UAE data residency — While operating globally, Dynatrace stores UAE public-sector data securely within the UAE’s borders.
• Independent validation — Assessment against DESC’s cybersecurity framework by qualified third-party auditors.

Empowering secure digital transformation for Dubai’s public sector

Our partnership with Microsoft Azure UAE and the Dubai Government reflects a shared vision of creating smarter, safer, and more sustainable cities. Dynatrace’s intelligent observability and integrated security capabilities empower organizations to:

• Accelerate digital transformation with speed, confidence, and resilience.
• Enhance citizen experiences by delivering secure, high-performance, and reliable digital services.
• Foster trust by safeguarding data privacy and following UAE regulations.

Dubai’s ambition to lead the world in smart city innovation, sustainability, and digital empowerment is at the heart of this collaboration. Dynatrace’s achievement of DESC certification on Microsoft Azure in the UEA aligns seamlessly with this vision, delivering:

• A secure foundation for smart cities — Safeguarding interconnected systems that drive smart infrastructure and digital ecosystems.
• Enhanced citizen engagement — Enabling secure, seamless, and efficient services that elevate the quality of life for residents and visitors.
• Sustainability through efficiency — Harnessing AI-powered automation and intelligent observability to optimize resource consumption and operations, advancing Dubai’s environmental goals.

Together, we’re building the foundation for a future-ready digital ecosystem that empowers Dubai to thrive as a global leader in innovation, sustainability, and security.

Join us in shaping the future

At Dynatrace, we’re committed to driving innovation and helping organizations thrive in the digital age. Achieving DESC certification on Microsoft Azure in the UAE is just one of the many ways we’re delivering on this promise.

We invite all government agencies, critical non-government entities, and forward-thinking private sector organizations seeking secure, compliant, and innovative cloud solutions to discover what Dynatrace on Microsoft Azure in the UAE can do for the future of smart cities and secure digital transformation.

Get started today with a free trial and transform your own enterprise with an AI-powered observability platform, purpose-built for Azure cloud native and AI environments. Or start your free trial via the Azure Marketplace.

The post Dynatrace secures Dubai’s digital future with DESC certification appeared first on Dynatrace news.

Transform how you derive actionable insights from data

Have you ever struggled to make sense of a massive data set or turn raw data into actionable business insights? Investigations handles all this for you—and more—at the scale modern organizations demand.

Whether you’re troubleshooting API call throttling, debugging AWS integration issues, or accelerating root cause analysis, the Investigations app provides a flexible toolkit for exploring your data, allowing you to:

• Analyze large DQL results in their original form at a detailed level
• Maintain your entire investigation flow and historical queries in context via the query tree
• Perform complex investigations on data stored in Dynatrace Grail®
• Build DQL queries quickly and efficiently based on your findings
• Save and reuse evidence to refine queries and uncover answers
• Pivot your queries based on the metainformation attached to log records
• Analyze the observability metrics connected to your log sources

With Investigations, you can easily navigate through investigation history to review queries and results—streamlining incident response, accelerating root cause analysis, and delivering deeper contextual insights from your data.

Get started with practical use cases

As strong advocates of “learning by doing,” we understand you may be curious about how to start using the Investigations app more broadly. You don’t need to start from scratch—there are plenty of documented scenarios you can customize for your own purposes. To help you get started, explore these informative tutorials:

• Investigate API call throttling using DQL and Investigations
• Debug AWS Integration issues
• Creating faster filters for DQL queries to speed up any investigation

If threat hunting is more your style, you can start with these tutorial-style investigation challenges:

• Christmas hands-on: Who stole Santa’s secret file
• Valentine’s Day hands-on: Heartbeat failed

There are, of course, many more use cases to explore—Investigations can be used with any data in Grail: logs, events, metrics, traces, and even performance data.

Drive insights across all your data

Since its launch, the recently renamed Investigations app has been key to unlocking insights in Grail, allowing teams to analyze metrics alongside logs and connect traces during incident response—this is a game-changer for both security and observability. Over time, the capabilities of the Investigations app were extended well beyond security, supporting a wide range of analytical scenarios.

Despite the name change, all the app’s existing features, including application IDs, which are used in intents and in the browser address bar, remain unchanged, so no updates to integrations or bookmarks are needed. And the roadmap will continue to prioritize incident response and accelerations of investigations.

For ease of use, Investigations will remain listed under “Security” on the Dynatrace platform and in Dynatrace Hub.

For complete details, please see Investigations documentation.

Ready to get started?

Investigations is a built-in app available in all SaaS environments beginning with Dynatrace SaaS version 1.330. Best of all, this app requires no additional subscriptions or privileges—so you can start using it immediately without waiting for access permissions and unlock deeper insights for your business.

The post From incident response to everyday analytics: Introducing Dynatrace Investigations appeared first on Dynatrace news.

At Dynatrace, we believe you shouldn’t have to fix every cloud misconfiguration—rather, we believe you should focus on the ones that matter to your production environments. That’s why we’ve integrated Dynatrace with AWS Security Hub and Kiro CLI to streamline triaging and remediation of critical findings, focusing efforts where they count most.

The challenge in managing complex cloud environments

Modern cloud environments are complex with many moving parts and constant change. Whether initially misconfigured or affected by configuration drift, these environments pose a compliance issue and a significant security threat if exploited by malicious actors. Depending on the scale and composition of your environments, you may end up with thousands of misconfigurations that need to be addressed. Or do they?

AWS provides native services, such as AWS Security Hub, that help detect misconfigurations in your cloud environments. Such misconfigurations are often referred to as compliance findings. Many of the findings might not pose an immediate threat to production systems. AWS Security Hub’s latest capabilities, such as Exposure findings, already help a lot in distilling the most critical findings.

Is it possible to get additional validation of findings with deeper context into your production services and applications? That would help you understand which findings affect your crown jewels and prioritize their remediation over other issues.
And is it possible to automate this process, thereby reducing human intervention and the required deep understanding of the complex environments?

This is a modern dilemma for SREs and security teams: how to prioritize remediation without compromising operational integrity or wasting valuable resources on non-critical issues.

Context-aware remediation with Dynatrace and Kiro CLI

The Dynatrace® AI-powered observability platform monitors your applications and has all the runtime insights required to help organizations navigate through thousands of compliance findings and use the runtime context to prioritize them. Dynatrace’s Model Context Protocol (MCP) server exposes this deep runtime context to automation and agentic AI-driven workflows.

The Kiro CLI allows interaction with specialized AI agents and AWS native capabilities using MCP servers. It serves as the SRE assistant, possessing knowledge of all connected products and the ability to remediate issues.

To further streamline and connect the dots, Dynatrace integrates with AWS Security Hub, supporting the latest OCSF (Open Cybersecurity Schema Format). This allows SREs to fine-tune the triaging and enrichment to their particular needs, leveraging Dynatrace Workflows as the automation engine.

In the next section, we present a use case with two scenarios that demonstrate how detection, triage, and remediation of cloud misconfiguration were made more efficient using Dynatrace and the latest AWS advances in automation and AI domains.

Intelligent triage in action

This use case starts with compliance findings, detected by AWS Security Hub. In the first scenario, an SRE retrieves critical findings using the Kiro CLI and verifies them with Dynatrace using the Dynatrace remote MCP server, which is connected to a dedicated Kiro custom agent.

In the second scenario, the initial validation is automated with Dynatrace Workflows and supported by the AWS Security Hub integration. The validated findings are then sent to a Jira ticket, which can be picked up later by the SRE directly from the Kiro CLI.

By combining Dynatrace deep observability with Kiro CLI intelligent automation, teams gain the ability to triage findings based on actual runtime impact. Instead of treating every misconfiguration as equally urgent, this solution helps prioritize those misconfigurations that pose real risks to business-critical applications. This not only reduces alert fatigue but also ensures that remediation efforts are focused, efficient, and aligned with operational priorities.

The result? A streamlined security posture that’s proactive rather than reactive. Teams can move faster, reduce manual overhead, and maintain a higher level of confidence in their cloud infrastructure while keeping production safe and stable.

Scenario 1: Kiro CLI-driven validation with Dynatrace MCP

In this scenario, an SRE interacts with Kiro CLI to perform validation and remediation actions with the help of Dynatrace MCP.

1. Detection: AWS Security Hub identifies cloud misconfigurations.
2. Verification
   • An SRE interacts with the Kiro CLI to extract top findings.
   • The Dynatrace agent, invoked by the Kiro CLI, utilizes the Dynatrace MCP server to verify whether these findings impact production applications.
3. Remediation
   • SRE remediates confirmed findings via Kiro CLI; others are suppressed.
   • Findings are resolved and verified in AWS Security Hub.

Scenario 2: Dynatrace-driven automated triaging and Kiro CLI remediation

In this scenario, initial validation and triage are automated in Dynatrace Workflows, and the SRE then acts on the Jira tickets to perform assisted remediation using the Kiro CLI.

1. Detection: AWS Security Hub identifies cloud misconfigurations.
2. Verification
   • AWS Security Hub integration ingests findings into Dynatrace.
   • A Dynatrace workflow analyzes new critical/high-risk findings and performs the automated verification using the Davis CoPilot® workflow action.
3. Remediation:
   • A Jira ticket is created automatically with the summary of the verification results.
   • An SRE uses Kiro CLI to act on the Jira findings. Confirmed findings are remediated, while the unconfirmed findings can be suppressed.
   • Findings are resolved in AWS Security Hub and are no longer in the top findings dashboard in Dynatrace.

What’s next

As AI footprint growth and capabilities evolve, the collaboration between AWS and Dynatrace will extend to additional use cases for agentic AI workflows and observability-context-supported issue remediation. One such example is covered in this recent blog post.

In this blog post, we demonstrated how the Dynatrace remote MCP server can be integrated with Kiro CLI for SRE use cases. Stay tuned as the collaboration extends to additional use cases that help development teams remediate vulnerabilities and performance issues directly from their IDEs.

Get started

To get started, learn more about Dynatrace MCP and sign up for the preview to experience how real-time production context makes your organization more efficient.

For details on how to set this up, refer to Dynatrace documentation.

The post Smarter cloud security with Dynatrace and Kiro CLI appeared first on Dynatrace news.

Rising cybersecurity risks in the public sector

Modern public sector organizations manage and store increasingly large volumes of sensitive data, elevating cloud security as a top priority. At the same time, these organizations face mounting pressure to innovate and modernize, all while maintaining rigorous standards for data protection and regulatory compliance.

Qualification of cloud infrastructure and services is a central pillar of the Italian Cloud Strategy, issued by the Department for Digital Transformation and the Agenzia per la Cybersicurezza Nazionale (ACN). The strategy provides guidelines for migrating data and digital services of the Italian Public Administration to the cloud, ensuring that security and resilience are foundational at every stage.

To this end, the Italian government—through ACN—has established a robust framework for qualifying cloud solutions that manage all levels of public sector data and workloads. This framework ensures that only providers who meet strict criteria for security, reliability, and transparency are eligible to serve the public administration. The QC1 certification, in particular, is designed to simplify, regulate, and secure how cloud services are acquired by Italian administrative bodies. It aligns with the objectives of the National Cybersecurity Strategy, which aims to plan, coordinate, and implement measures to make Italy safer and more resilient.

For technology vendors, achieving ACN QC1 is not merely a regulatory requirement; it is a demonstration of trustworthiness and a prerequisite for participating in Italy’s digital future. Without this qualification, cloud solutions will not be considered by public sector entities—ultimately limiting both innovation and public benefit.

Empowering Secure Digital Transformation for Italy’s Public Sector

Dynatrace’s attainment of the ACN QC1 qualification directly addresses the complex requirements of Italy’s public sector. By certifying our platform against the rigorous standards established by the Italian Cloud Strategy and the ACN, Dynatrace allows public sector organizations to adopt advanced observability and automation aligned with the security, compliance, and resilience requirements defined by the ACN.

The Dynatrace platform represents a new era in observability, uniting analytics, AI, and automation to help organizations thrive in the age of agentic AI. The latest Dynatrace platform is engineered to contextualize vast streams of observability data, transforming it into real-time intelligence that powers actionable insights, automation, and the path toward autonomous operations.

QC1 certification confirms that Dynatrace has implemented comprehensive technical and organizational safeguards to protect data, prevent unauthorized access, and ensure the reliability of services. This independent validation gives public sector customers confidence that they can accelerate their digital transformation initiatives on a secure, compliant, and future-ready platform.

What ACN QC1 means for Dynatrace customers

With ACN QC1 qualification, Italian government agencies and public sector bodies can now confidently adopt Dynatrace for their mission-critical workloads. Key benefits include:

• Assured compliance: Independent validation that Dynatrace meets or exceeds all ACN QC1 requirements for managing ordinary data.
• Accelerated procurement: Simplified onboarding through the ACN marketplace, reducing procurement friction and time-to-value.
• Operational transparency: Ongoing alignment with Italian cybersecurity regulations, with clear documentation and audit readiness.
• Trusted innovation: Access to the full capabilities of the Dynatrace platform, enabling secure cloud native transformation and intelligent automation.

At Dynatrace, every certification we achieve unlocks a new level in our mission to empower our customers worldwide with cutting-edge, secure, and compliant solutions. Visit the Dynatrace Trust Center to review all our certifications and accreditations and to learn more about the Dynatrace approach to security and compliance by design.

The post Dynatrace achieves QC1 certification from the Italian Agency for National Cybersecurity appeared first on Dynatrace news.

We’re proud to announce that the Dynatrace® platform is now certified in accordance with Esquema Nacional de Seguridad (ENS), Spain’s National Security Framework by OCA CERT.

The ENS is an official cybersecurity framework established by the Spanish government to ensure the protection of information and services in the public sector and among regulated service providers. By aligning to ENS standards, organizations guarantee that their technology, processes, and people meet stringent requirements set forth by the Spanish government, fostering greater trust and reliability in digital services.

Partnering with the Spanish public sector

Many public sector organizations across Spain and the broader EU are eager to accelerate their digital transformation. They want to deliver faster services, better user experiences, and smarter operations. Due to the criticality and sensitivity of the information handled by public sector institutions, finding the right balance between innovation and regulatory adherence is a constant challenge. Regulations such as ENS are designed to ensure that data remains protected while enabling digital progress.

This dynamic often slows down transformation efforts, leaving teams reliant on legacy monitoring tools that lack scalability, cloud-readiness, and automation. To move forward, public institutions must rely on technology partners who not only deliver innovation but do so with trust, accountability, and a deep understanding of national cybersecurity standards.

We’re proud to support this mission and honored to stand alongside our customers in Spain as a trusted partner for their secure digital future.

Dynatrace: Security meets intelligence

The Dynatrace® platform is reimagining observability by combining the power of analytics, AI, and automation to drive organizations forward in the age of agentic AI. The 3rd generation platform has been built to harness a goldmine of observability data in context and turn that data into real-time knowledge for AI, creating actionable insights and automation, and paving the way for autonomous intelligence. The ENS certification reinforces our commitment to delivering trustworthy, compliant, and secure cloud services, enabling organizations to innovate with confidence.

Certification comes with practical advantages

• Public sector onboarding: Spanish government agencies and regulated entities can now confidently adopt the Dynatrace platform and meet local compliance requirements.
• Enterprise risk reduction: Organizations in finance, healthcare, and other critical sectors benefit from reduced risk and a proven security framework, simplifying their own compliance efforts.
• Accelerated RFP and procurement: ENS certification streamlines the procurement process, enabling faster onboarding and go-live timelines for projects subject to regulatory scrutiny.

Example use cases include deploying digital citizen services, secure data analytics platforms for healthcare, and compliant hosting environments for fintech applications, all leveraging the Dynatrace ENS-certified platform, a solution that combines world-class observability with government-grade security. The bigger story is what this allows: faster innovation, smarter public services, and more trust between citizens and their institutions.

How ENS High elevates Dynatrace security and trust for the public sector

ENS certification reinforces Dynatrace’s already robust security foundation, which includes:

• Enhanced data protection mechanisms that offer access, confidentiality, integrity, traceability, authenticity, and conservation of data.
• Formalized incident response protocols for quick detection and remediation of potential threats.
• Advanced risk management strategies, including regular vulnerability assessments.
• Increased transparency and monitoring of operational activities.

The bottom line is, with Dynatrace, Spanish public sector organizations have gained the performance insights they need, supported by the compliance and security standards required for regulated environments.

Compliance without compromise

Achieving ENS High certification is one of many testaments to our dedication to setting industry benchmarks. Visit the Dynatrace Trust Center to review all our certifications and accreditations and to learn more about the Dynatrace approach to security and privacy by design.

The post Dynatrace achieves High certification under Spain’s National Security Framework (ENS) appeared first on Dynatrace news.

Observability context is critical to prioritizing Amazon GuardDuty findings

Security remains top of mind for enterprises as the tech landscape continues to evolve, making threat detection and monitoring one of the most critical aspects of an organization’s IT strategy. Amazon GuardDuty is a threat detection service that continuously monitors an organization’s AWS accounts and workloads for malicious activity and delivers detailed security findings for visibility and remediation.

Amazon GuardDuty monitors and analyzes events and logs from various AWS services, spanning the entire cloud infrastructure, including running containers in an AWS environment.

However, teams operating in multicloud environments need more than traditional monitoring can provide. To effectively address security issues, teams need a unified monitoring platform to prioritize and efficiently respond to various threats.

Moreover, findings can come from various types of environments, including development, testing, and production. This increases the number of findings to prioritize, increasing the amount of noise, along with the probability of missing critical issues.

Additional runtime and organizational context are required to efficiently filter out the less important findings and focus on the critical issues that directly affect sensitive services and applications.

Reduce alert noise and prioritize critical issues with runtime context

The Dynatrace AI-powered observability platform integrates with Amazon GuardDuty to bring its valuable security findings into the Dynatrace Grail® data lakehouse.

Leveraging OpenPipeline®, the integration processes and maps security findings to a unified data format, making it uniformly accessible for analysis across tools and cloud environments.

Platform-native Dynatrace® Apps, such as Dashboards, Notebooks, and Security Investigator, help you visualize and analyze your security findings. The Workflows app, meanwhile, helps you automate your response—efficiently triaging the findings, creating tickets for DevSecOps teams, and notifying the relevant stakeholders without manual intervention that could slow down the distribution process and tie down your resources.

The Threats and Exploits app serves as your starting point for consuming the ingested findings and as a guide for exploring the potential impact of each detection.

Additionally, Dynatrace allows teams to contextualize ingested security findings with the additional runtime context. This context helps to better filter incoming findings and further reduce the number of alerts handled by various security teams. This way, teams stay focused on the issues that really matter to your critical services and applications.

Breaking down the Amazon GuardDuty and Dynatrace integration

The Amazon GuardDuty integration leverages Amazon EventBridge and AWS Lambda as the transit points for forwarding the various security findings to Dynatrace. The ingested events are processed in OpenPipeline, mapped to Dynatrace semantic conventions, and stored in Grail in a unified security event data model.

The integration provides easy-to-follow steps for setting up the integration and monitoring capabilities to ensure the integration runs properly.

Teams can easily access the ingested security findings using various platform-native apps that help them accomplish various use cases.

Dynatrace also provides several ready-made artifacts as part of the application to serve as a starting point for analysis and automation, including the following:

• Sample dashboards visualize your security findings and assess monitoring coverage.
• Sample workflows automate the orchestration of critical findings by creating notifications and tickets.

Take the next step with Dynatrace and Amazon GuardDuty

With Dynatrace AI-powered observability context added to Amazon GuardDuty findings, SRE and security teams can now filter out noisy alerts and focus their efforts on the most impactful critical issues.

As the Amazon GuardDuty integration evolves, it will provide additional context that’s mapped and easily accessible in Dynatrace Query Language and available in the Threats and Exploits app.

For more information about how to ingest Amazon GuardDuty security findings, check out our documentation.

The post Ingest and enrich Amazon GuardDuty security findings with Dynatrace appeared first on Dynatrace news.

The Australian Cyber Security Center (ACSC) created the ISM framework to provide practical guidance and principles to protect organizations’ IT and operational technology systems, applications, and data from cyber threats. The Australian Signals Directorate created the IRAP to create a pool of assessors capable of conducting high-quality assessment services. Endorsed IRAP Assessors independently assess organizations’ cybersecurity postures, identifying security risks and suggesting mitigation measures. All Australian Commonwealth entities must comply with the Protective Security Policy Framework. The ISM is the cybersecurity framework that facilitates compliance.

Dynatrace previously achieved PROTECTED status for deploying the Dynatrace platform on Amazon Web Services (AWS). The new assessment demonstrates that Australian government agencies and highly regulated enterprises, such as utilities, healthcare, and financial services providers, can deploy Dynatrace on Microsoft Azure. This empowers these organizations to deliver automation and intelligence at scale, unlocking deeper business insights and faster time to value, knowing that their data resides in a Microsoft Azure environment in Sydney that meets high standards.

Breaking down the advantages of a unified observability platform

With the Dynatrace unified observability platform, Australian government agencies can:

• Gain real-time visibility into the performance and availability of infrastructure and applications.
• Deliver high-quality, cloud-native applications to accelerate innovation.
• Identify, prioritize, and resolve service-affecting issues to deliver seamless user experiences.
• Automate repetitive and time-consuming manual tasks, freeing skilled IT resources to focus on strategic initiatives and automation that can be triggered anytime without manual interaction.
• Adopt shift-left development practices to make applications more secure by automating vulnerability detection and resolution before they can be exploited.
• Overcome the complexity of cloud-native environments and stay ahead of regulatory reporting rules by automating continuous discovery, proactive anomaly detection, and optimization across the software development lifecycle.
• Create a single source of truth about the health of IT services to facilitate closer collaboration between development, operations, and security teams, as well as support the adoption of DevSecOps practices.

Data protection is a growing challenge

All organizations must implement adequate controls to ensure the integrity and security of their data. Government agencies are under added pressure, and as they continue to digitally transform, the complexity of their systems increases.

Data is distributed across multiple platforms and applications, making it more difficult to ensure adequate controls. Common challenges include the following:

• Data residency. Government agencies need to maintain complete control and transparency of where their data is stored, especially when using cloud services. Highly sensitive data is subject to stringent residency requirements, meaning it can’t be stored outside the country of origin.
• Securing data throughout the vendor ecosystem. The process of assessing a vendor’s security, privacy, and compliance posture and validating they meet the stringent requirements of the Australian government is often time-consuming and cumbersome.
• Continuous compliance. It’s essential to remain compliant with security and privacy requirements on an ongoing basis rather than treat them as an annual check-box exercise. With rapidly evolving threats and regulatory requirements, it’s crucial for organizations to stay ahead of the curve and continuously improve their security posture.

Keep your data secure with Dynatrace

Dynatrace was purpose-built to process and query massive volumes of data. Therefore, it has comprehensive controls to protect customer data and is constantly investing in these capabilities to stay ahead of evolving market standards and regional and sector-specific needs.

Key Dynatrace capabilities that help Australian government agencies protect their data include the following:

• Dynatrace operates its AI-powered unified observability and security platform as a SaaS solution in 20 worldwide regions. By allowing customers to choose where their data resides, Dynatrace assists them in meeting their country- and sector-specific regulations.
• Dynatrace proactively engages with highly qualified and independent assessors to validate its security, privacy, and compliance posture against the ISM control framework. This simplifies and accelerates the due diligence process for Australian government agencies and other highly regulated enterprises.

Independent software vendors (ISVs) such as Dynatrace can demonstrate their security posture level according to the Australian government’s ISM. This process evaluates risk assessments, access controls, incident response strategies, and sensitive data handling to ensure the vendor maintains robust security practices.

Completing this additional assessment for Dynatrace on Azure is the latest validation of its rigorous security, privacy, and compliance posture. The Dynatrace Trust Center provides a complete overview of the certifications, laws, and standards with which the Dynatrace platform complies.

Get started with Dynatrace on Azure

Australian government agencies that want to learn more about how Dynatrace on Azure can improve their operations and accelerate innovation should contact us or check out our free trial via the marketplace.

Microsoft Azure is a registered trademark of the Microsoft group of companies.

Dynatrace and the Dynatrace logo are trademarks of the Dynatrace, Inc. group of companies. All other trademarks are the property of their respective owners.

The post Dynatrace on Microsoft Azure achieves PROTECTED status in Australian government IRAP assessment appeared first on Dynatrace news.

We’re excited to announce the expansion of the Dynatrace security portfolio with new Cloud Security Posture Management (CSPM) capabilities. The Dynatrace CSPM solution significantly enhances security, compliance, and resource efficiency through continuous monitoring, automated remediation, and centralized visibility for enterprises managing complex hybrid and multicloud environments.

By enabling automated response actions, Dynatrace helps SREs and SecOps teams significantly reduce the time spent fixing compliance and configuration issues. This helps customers continuously fulfill their compliance requirements with strict regulatory timeframes enforced globally.

The importance of addressing key security posture management challenges for businesses

In the dynamic and complex world of hybrid and multicloud environments, relying on manual audits, custom scripts, and general-purpose security tools is no longer enough to achieve efficient security posture management. Here’s why:

Complex configuration management
“30% of all cloud environment attacks during the first half of 2024 used misconfigurations as the initial access vector” – Google Cloud Threat Horizons report. Cloud environments are vast and constantly evolving, making manual identification of misconfigurations virtually impossible. Multicloud and hybrid cloud setups are particularly error-prone, with configuration drift often going unnoticed until it’s too late. This delay in discovery significantly increases a business’s risk exposure. The segmentation between SecOps, who identifies misconfigurations, and DevOps, who implements the remediations, can further delay this process and lead to longer risk exposure. Addressing these challenges proactively is critical to maintaining a secure and efficient cloud infrastructure.

Rising compliance demands
Businesses today are under immense pressure to keep up with stringent regulations surrounding data storage, processing, and access. With compliance requirements constantly evolving and cloud environments growing more complex, staying compliant has become an ongoing challenge.

Traditional, manual compliance checks are labor-intensive and prone to errors, increasing the risk of costly penalties and reputational damage. According to the Ponemon Institute, the average cost of non-compliance has surged to $14.82 million annually per organization.

In addition, cloud misconfigurations are a common culprit behind compliance violations, making it clear that relying on outdated processes is no longer sufficient. The solution? Automation and continuous monitoring. These tools are essential for maintaining compliance seamlessly while safeguarding sensitive data in an increasingly regulated landscape.

For businesses leveraging the cloud, effectively addressing these issues isn’t optional—it’s necessary to maintain operational resilience, regulatory compliance, and customer trust.

Dynatrace brings a smarter approach to cloud security posture management

Significantly different from existing offerings, Dynatrace enhances security posture with observability context, ensuring all cloud resources are effectively monitored, properly configured, and continuously audited for technical requirements of compliance with regulatory standards through automated checks and reports. Potential misconfigurations are detected and prioritized automatically, with clear guidance and workflows for swift remediation. This proactive approach reduces the risk of breaches and mission-critical service disruptions while ensuring consistent enforcement of compliance requirements and reducing manual efforts to mitigate security and regulatory risks.

By offering deep visibility into hybrid and multicloud configurations alongside security and compliance assessments aligned with standards like NIST, CIS, DORA, and more, Dynatrace empowers Security, Operations, and SRE teams to validate, track, and remediate findings efficiently. With a focus on automated enforcement and alignment to technical best practices, Dynatrace delivers enhanced operational efficiency, enabling teams to focus on proactive improvement while creating evidence for auditing processes, saving time and resources, and bolstering overall security hygiene.

Key benefits of Dynatrace CSPM

With Dynatrace CSPM, teams can ensure robust security posture management across hybrid and multicloud environments while maintaining audit readiness and enabling cross-functional teamwork. Here’s how these capabilities come together in the Dynatrace platform to transform cloud security and compliance:

Proactive issue resolution
Identify and address security risks before they escalate. Automatically and continuously monitor hybrid and multicloud configurations to identify risky configurations or patterns that can lead to security violations or downtime. Leverage tailored workflows to ensure quick resolution.

For example, a Japanese financial Dynatrace customer reduced troubleshooting and issue identification time by 80% by leveraging automated scans that continuously prioritized latent risks and compliance issues. This approach eliminated manual cross-referencing, allowing proactive resolution before problems escalated.

Continuous compliance assessments
Continuous compliance assessments allow for better audit readiness without needing time-intensive manual assessment tracking. This capability enables the assessment, reporting, and remediation of compliance-relevant findings across hybrid and multicloud environments.

For example, another Dynatrace customer, a German medical company, saved hundreds of hours across the entire IT team on security compliance by shifting from disparate solutions and lots of manual effort, research, cross-referencing, and analysis to a single platform with risk-based prioritization and context.

Enhanced collaboration with Grail
With the power of Dynatrace Grail™ data lakehouse, teams can extend the value of their security posture management findings via Dynatrace Notebooks, Dashboards, and Workflows. Grail allows for collaboration and remediation actions across multiple teams. SecOps teams can proactively hunt for threats and perform Incident Response in a single platform, greatly increasing efficiency and MTTR.

For example, by implementing automated reporting and prioritization workflows, a Dynatrace customer in the UK reduced their monthly incidents and unresolved issues by 80%, freeing up significant staff hours to focus on proactive maintenance.

Comprehensive cloud security in one platform

Dynatrace offers cloud teams a unified platform for all cloud security and observability needs. It provides complete visibility into all the cloud environments, identifying runtime vulnerabilities, compliance issues, and security risks, along with their potential impact, without false positives. As a unified security and observability platform, Dynatrace provides end-to-end visibility and analytics to shift from disparate tools and data silos to efficient modernization and collaboration.

Dynatrace continuous discovery and visualization of dynamic environments—including hosts, virtualization, network, and services, helps you accelerate and measure the success of your cloud transformation.

The post Dynatrace Cloud Security Posture Management elevates cloud security with real-time compliance across hyperscalers appeared first on Dynatrace news.

What is TX-RAMP?

The Texas Risk and Authorization Management Program (TX-RAMP) provides a standardized approach for security assessment, certification, and continuous monitoring of cloud computing services that process the data of Texas state agencies. TX-RAMP certification requires cloud service providers to meet the stringent security and privacy standards set by the Texas Department of Information Resources (DIR).

TX-RAMP Level 2 Certification is the required minimum certification level for a cloud computing service that processes, stores, or transmits agency data determined to be confidential and from a moderate or high-impact information resource.

Dynatrace partners with Texas state institutions

Dynatrace partners with public sector agencies in the US and globally to ensure that essential government and educational institutions deliver resilient, efficient, and secure services. Complex IT environments that house these services are often built on hybrid and multicloud architectures. Ensuring application security, resilience, and efficient operations with limited resources in the public sector requires a solution that provides precise answers and intelligent automation from enormous amounts of cloud data while meeting the strictest cybersecurity standards.

Receiving TX-RAMP Level 2 certification confirms that the Dynatrace platform meets these standards and allows Texas state institutions to ensure flawless and secure digital services for its residents.

Unified observability and security accelerate digital transformation initiatives

Satisfaction with services provided by state and local government agencies strongly influences trust in those agencies. The opportunities that digital and cloud-based technologies provide constantly increase expectations for providing these services digitally and without disruptions. To achieve this, state and local government agencies must undergo digital transformation so that their services are cost-efficient, secure, and resilient.

Whether in an enterprise or state agency, technology executives are aware that observability is the foundation for managing the health of cloud and IT services. The right observability platform with observability, security, and other data in context makes the difference in increasing IT productivity, reducing business risks, optimizing costs, and reducing carbon footprint.

Our commitment to enterprise-level security

As shown by our broad range of certifications and accreditations, security is a core value at Dynatrace. Adding TX-RAMP highlights our dedication to excellence. We’re focused on ongoing improvements to maintain the highest security standards and deliver exceptional service, providing our customers with a safe and governed environment.

What’s next

Contact Dynatrace to discuss how we can support your cloud transformation and provide cost-efficient, resilient and secure services for Texas residents.

The post Dynatrace platform receives TX-RAMP Level 2 certification appeared first on Dynatrace news.

Dynatrace continues to deliver on its commitment to keeping your data secure in the cloud. Enhancing data separation by partitioning each customer’s data on the storage level and encrypting it with a unique encryption key adds an additional layer of protection against unauthorized data access. Separate data storage fulfills the security compliance requirements of many Dynatrace customers operating in highly regulated sectors, making it much easier for them to use Dynatrace SaaS and accelerate their digital business transformation.

Protect data in multi-tenant architectures

To bring you the most value by unifying observability and security in one analytics and automation platform powered by AI, Dynatrace SaaS leverages a multitenancy architecture, enabling efficient and scalable data ingestion, querying, and processing on shared infrastructure. Such infrastructures must implement additional controls to securely separate each customer’s data. Dynatrace ensures that each customer’s tenant data is separated from each other customer’s data throughout its lifecycle using multiple layers of data security controls, such as:

• Authentication
• Separated HTTP requests per tenant
• Logical data separation through data package tracking
• Granular permission control with access policies
• Individual domain per environment

In addition to the data security controls, a rigorous secure development lifecycle (SDL) ensures that data security controls for data separation work as designed and that any potential issues are detected and prevented during development. The Dynatrace SDL includes penetration testing, red teaming, continuous threat modeling and risk assessments, a public bug bounty program, and vulnerability scans.

Dedicated storage and unique encryption keys for each tenant

Dynatrace introduces a fundamental improvement in how each customer’s tenant data is kept separate. By providing dedicated storage and a unique encryption key for each tenant, each Dynatrace tenant’s data is kept separate at rest on the storage level, significantly reducing the risk of unauthorized access to the data.

A unique encryption key is applied to each tenant’s storage and automatically rotated every 365 days. This guarantees that only one tenant is affected in the unlikely case of a compromised encryption key. For further security and convenience, you can easily revoke a key without impacting your data.

This level of data separation and encryption fulfills the security compliance requirements of many Dynatrace customers operating in highly regulated sectors.

Tenant data separation in Dynatrace

Currently, the enhanced tenant data separation and encryption feature is activated by default for all Dynatrace SaaS customers on AWS and Azure using the latest version of Dynatrace SaaS. There is no need to make any changes.

On AWS, each Dynatrace tenant now has a dedicated S3 bucket assigned to it. All new Dynatrace platform data at rest is stored in such a dedicated S3 bucket. S3 buckets are configured to be encrypted with a bucket key stored in the AWS key management system (KMS). Each S3 bucket is assigned its own unique bucket key. All bucket keys are managed by Dynatrace and are configured to rotate automatically after 365 days.

On Azure, each Dynatrace tenant now has a dedicated Azure storage account assigned to it. All new Dynatrace platform data at rest is stored in such a dedicated storage account. Storage accounts are configured to be encrypted with a key stored in the Azure Key Vault. Each storage account is assigned its own unique encryption key. All encryption keys are managed by Dynatrace and are configured to rotate automatically after 365 days. 

What’s next

Next, the enhanced data separation and encryption features are planned for release to all customers on Azure and then to all customers on Google Cloud.

With improved data separation and newly introduced encryption, Dynatrace helps you fulfill data security requirements for highly regulated sectors.

Contact your Dynatrace account manager to learn how Dynatrace meets your organization’s security, privacy, and compliance requirements and to accelerate your journey to Dynatrace SaaS.

The post Dynatrace elevates data security with separated storage and unique encryption keys for each tenant appeared first on Dynatrace news.

We’re excited to announce that Dynatrace has successfully achieved CSA Star 2 certification with a Gold Maturity Score. This significant milestone underscores our ongoing commitment to maintaining the highest standards of security and compliance in the cloud and making it easier for our customers to use Dynatrace SaaS.

What is CSA Star 2?

The Cloud Security Alliance (CSA) Security, Trust & Assurance Registry (STAR) is a comprehensive framework for cloud security assurance. The Level 2 certification involves a rigorous third-party assessment based on the CSA’s Cloud Controls Matrix (CCM). This certification is specifically designed for Cloud Service Providers (CSPs) and builds upon the more generic approaches of ISO 27001 and SOC 2 Type II.

CSA Star 2 strengthens Dynatrace cloud security posture

CSA Star 2 certification provides a trusted benchmark for cloud security and thus strengthens the overall Dynatrace security posture. It signifies that a cloud provider has undergone a thorough evaluation by an independent auditor, confirming that their security measures meet or exceed industry standards.

Benefits to Dynatrace customers

The Dynatrace® platform for observability and security with Davis® hypermodal AI provides answers and intelligent automation from data at an enormous scale. This enables innovators to modernize and automate cloud operations, deliver software faster and more securely, and ensure flawless digital experiences. That’s why the world’s largest organizations trust Dynatrace to accelerate digital transformation.

Achieving CSA Star 2 certification is not just a badge of honor for Dynatrace; it’s a testament to our dedication to safeguarding your data. This certification means:

• Enhanced trust: Customers can be assured that Dynatrace adheres to the highest security standards, as validated by CSA Star 2 certification through a third-party audit.
• Risk reduction: The certification process ensures that we have strong controls in place to mitigate security risks significantly, reducing the likelihood of breaches.
• Regulatory compliance: Our certification helps customers meet their own regulatory requirements, simplifying their compliance processes because our certification aligns with international standards and ensures data is handled in compliance with relevant laws and regulations.
• Streamlined audits: Customers can leverage our certification during their own audits, making the process more efficient and providing evidence of our commitment to security.

Our commitment

As shown by our broad range of certifications and accreditations, security is a core value at Dynatrace. Adding CSA Star 2 certification highlights our dedication to excellence. We’re focused on ongoing improvements to maintain the highest security standards and deliver exceptional service, providing a safe and governed environment for our customers.

What’s next

To learn more about Dynatrace data security and privacy, visit our Trust Center.

If you’re an existing Dynatrace Managed customer looking to upgrade to Dynatrace SaaS, see How to start your journey to Dynatrace SaaS.

The post Dynatrace achieves CSA Star 2 certification appeared first on Dynatrace news.

What is SOC 1 Type II?

SOC 1 (Service Organization Control 1) is a widely recognized auditing standard developed by the American Institute of Certified Public Accountants (AICPA). It focuses on controls related to financial reporting. The “Type II” designation means that an independent auditor evaluated our controls over a period of time (typically six months) and confirmed the controls’ effectiveness.

Strengthening the Dynatrace security posture

Having SOC 1 Type II certification demonstrates Dynatrace’s robust security practices. Our internal controls have been rigorously assessed, ensuring we meet or exceed industry standards. This certification provides peace of mind to our customers, partners, and stakeholders, who can be confident that their data is safe.

Benefits to Dynatrace customers

Our customers directly benefit from our SOC 1 Type II certification:

1. Increased trust: With this certification, you can trust that Dynatrace adheres to stringent security protocols. We prioritize the confidentiality, integrity, and availability of all customer data.
2. Risk mitigation: By adhering to SOC 1 Type II standards, we minimize the risk of financial misstatements or security breaches. You can confidently rely on Dynatrace for critical operations.
3. Streamlined audits: You can leverage Dynatrace certification during your own internal audits; it simplifies the audit process and provides evidence of our commitment to security.

Our commitment

At Dynatrace, security is at the core of everything we do. Achieving SOC 1 Type II certification reinforces our dedication to excellence. We remain focused on continuous improvement, maintaining the highest security standards while ensuring you receive exceptional service.

What’s next

• To learn more about Dynatrace data security and privacy, visit our Trust Center.
• If you’re an existing Dynatrace Managed customer looking to upgrade to Dynatrace SaaS, see How to start your journey to Dynatrace SaaS.

The post Dynatrace achieves SOC 1 Type II certification appeared first on Dynatrace news.

The complexity of modern cloud-native environments is ever-increasing. The latest State of Observability 2024 report shows that 86% of interviewed technology leaders see an explosion of data beyond humans’ ability to manage it. On average, organizations have twelve different platforms and services embedded in their multicloud environments.

To avoid drowning in data, it’s critical to ensure that organizations can seamlessly collect data from any source in a single place and in context. Visualizing data in context while supporting and automating decisions with causal, predictive, and generative AI—all while providing a seamless experience—is where the future of cloud-native observability lies.

With new and updated experiences for Ops and SRE teams, proactively managing your cloud environments has never been easier.

Cloud-native observability for monitoring your cloud

OpenPipeline™ is the Dynatrace platform data-handling solution designed to seamlessly ingest and process data from any source, regardless of scale or format. With OpenPipeline, you can effortlessly collect data from Dynatrace OneAgent^®, open-source collectors such as OpenTelemetry, or other third-party tools. OpenPipeline then filters and preprocesses the data.

OpenPipeline also incorporates data contextualization technology, enriching data with metadata and linking it to other relevant data sources. By contextualizing data, OpenPipeline enhances the Dynatrace platform’s ability to offer AI-driven insights, analytics, and automation across observability, security, software lifecycle, and business domains.

Furthermore, OpenPipeline is designed to collect and process data securely and in compliance with industry standards. It features high-performance filtering, masking, routing, and encryption capabilities that are easy to configure and operate.

In the latest enhancements of Dynatrace Log Management and Analytics, Dynatrace extends coverage for

• Native Syslog support: Use Dynatrace ActiveGate to automatically add context and optimize network traffic to your Syslog messages.
• Seamless integration with AWS Data Firehose: address high-impact issues quickly through real-time, high-frequency log analytics. Dynatrace support for AWS Data Firehose includes AWS Lambda logs, Amazon Virtual Private Cloud (VPC) flow logs, Amazon S3 logs, and Amazon CloudWatch.
• Kubernetes log monitoring with Fluent Bit

In an effort to further democratize data, Dynatrace provides a curated and supported OpenTelemetry collector. The Dynatrace Otel Collector includes collector components verified by Dynatrace for seamless operation. This removes the burden of manually validating each component and use case. The list of use cases is actively extended and includes batching and ingesting data from Syslog, Fluentd^®, Jaeger™, Prometheus^®, StatsD, and more.

Understand and secure your cloud

It’s critical to have easy and intuitive access to contextually relevant answers when working within complex cloud-native environments and the gold mine of information they provide. Dynatrace is essential for unlocking that gold mine of data, allowing you to enhance application performance, deliver better experiences, and optimize operational efficiency.

Kubernetes

The Dynatrace Kubernetes experience for Site Reliability Engineers (SREs) and Platform Engineers focuses on providing insights into the health and performance of multicloud Kubernetes environments in the tailor-made Kubernetes app. Powered by Davis^® AI, the Kubernetes app offers proactive monitoring and analysis, allowing automated monitoring and optimization of health and performance and providing simple and easy troubleshooting. In addition, ready-made dashboards are available for a quick and easy overview, allowing you to see the Kubernetes data you want alongside the cloud-native observability data you need, all in one place.

Clouds

Quickly onboard and manage cloud monitoring in one place across different cloud providers and observe multiple cloud environments, including their instances, resources, cost analysis, health, and optimization. Ingest data remotely through cloud integrations covering Amazon CloudWatch, Azure Monitor, Azure Liftr, and Google Cloud™ Kubernetes with GKE™ AutoPilot cluster.

Vulnerabilities

Prioritize and sort vulnerabilities based on Davis Security Score, detection time, or the number of affected entities. Quickly identify if public exploits, internet exposure, or reachable data assets are exposed. Get powerful insights into the true impact of vulnerabilities in your environment. The embedded Davis Security Advisor can help you enhance remediation for third-party vulnerabilities with AI-assisted and precise recommendations on remediation actions, allowing you to address several critical vulnerabilities simultaneously. Davis AI uses security intelligence and runtime context to determine risk and remediation based on criteria like internet exposure and access to sensitive data.

Service-Level Objectives

Measuring a system’s reliability can be complex and overwhelming. Indicators that provide insights into the environment’s health and performance vary across industries, products, and applications. Applying Service Level Objectives (SLO) to track these indicators is a common best practice within site reliability engineering. Still, an SLO’s quality lies in the significance of the underlying service-level indicator.

Dynatrace guides you in quickly setting up the most valuable SLOs—considering the typically used metrics but providing the freedom to use any data stored in Dynatrace Grail™ data lakehouse, such as logs and events.

It doesn’t matter if you need the typically used failure rate or response-time metrics to ensure your system’s availability and performance or if you need to rely on abnormal log drops to gain insights into raising problems—SLOs leveraged with Grail provide all the information you need.

Automate your cloud

Answer-driven Dynatrace Automation is further extended by providing direct interaction with your cloud and cloud-native ecosystem:

• Kubernetes: Read manifests, free up resources (for example, delete failed terminations), and restart deployments.
• AWS: Automate your AWS infrastructure with actions across EC2, S3, Lambda, and more.
• GitHub^®: Integrate with your GitHub repositories. Automate issues and pull requests (for example, to change configuration files for sizing).
• GitLab™: Integrate with your GitLab projects. Automate issues and merge requests (for example, to change configuration files for sizing).

Example: Predictive auto-scaling for Kubernetes workloads

Kubernetes provides flexibility but also introduces complexity. For instance, manual scaling is time-consuming, reactive, and prone to errors. Using Dynatrace Automation and Davis AI helps you predict bottlenecks and automatically open pull requests to scale applications. This proactive, automated approach minimizes downtime, ensures your applications perform at their best, and helps optimize resource utilization and cost.

The Auto-Scaling tutorial provides a step-by-step guide to automatically scaling Kubernetes workloads up or down, horizontally or vertically.

Try out cloud-native observability yourself

Proactively manage your environments to increase performance and reduce cost. It’s never been easier to truly own your cloud!

The capabilities highlighted in this blog post will be available in Dynatrace SaaS environments in the coming weeks.

The post Cloud-native observability made seamless with OpenPipeline and AI-driven observability appeared first on Dynatrace news.

Dynatrace integrates with AWS Elastic Container Registry (ECR) to enable visibility, orchestration, and prioritization of cross-container-registry vulnerability findings. This integration provides a single pane of glass for container image scans of your containerized applications and is part of a larger effort to enrich vulnerability findings with runtime context.

In complex multicloud environments, vulnerability findings are often siloed between build-time and run-time tooling. Thus, getting a holistic view of security risks is challenging.

Dynatrace addresses this issue by providing unified ingest and analysis of container vulnerability findings across cloud and container registries. This ensures that SecDevOps has a continuous and comprehensive understanding of its security posture.

In addition, security findings detected during the build phase and in your artifact registries, such as Amazon ECR, might not be relevant to your production-critical applications. By enriching runtime context from the monitored entities, Dynatrace helps filter out the noise, prioritize critical findings, and focus your remediation efforts on what truly matters for your production environment.

Key Steps in the Integration Process

Container image scanning

Amazon ECR scans container images for vulnerabilities. You can choose between basic and enhanced scanning.

Data ingestion

The vulnerability findings are pushed into the Dynatrace platform through AWS Event Bridge via the dedicated security ingest endpoint powered by OpenPipeline^TM. You can set it up using an AWS CloudFormation template provided by Dynatrace. For instructions, see the documentation.

Data mapping

The ingested data is mapped according to the Dynatrace Semantic Dictionary, ensuring a unified format for analysis.

Analysis and automation

Once the findings are ingested, you can visualize, analyze, and automate in Dynatrace with Dashboards, Notebooks, and Workflows.

Use cases

Once security findings and scan events are ingested into Dynatrace Grail™, you can analyze them and perform automation tasks, leveraging the uniform data format.

Amazon ECR ingested data can be consumed as follows:

• Dashboards: Use the provided sample dashboards or create custom visualizations of the security findings and scan events.
• Notebooks and Security Investigator: Use vulnerability findings as an additional dimension for threat hunting and forensic investigations.
• Workflows: Automate the orchestration of critical vulnerability findings by creating alerts and tickets.

Explore individual use cases in Dynatrace Documentation:

• Visualize and contextualize security findings
• Automate and orchestrate security findings
• Discover coverage gaps in security scans
• Visit the Dynatrace Hub and leverage our Amazon ECR app

Get started

Visit Dynatrace Documentation and get started setting up your Amazon ECR data integration.

The post Enrich Amazon ECR vulnerability findings with runtime context appeared first on Dynatrace news.

Dynatrace, powered by OpenPipeline™, offers a single pane of glass that consolidates container security findings from your existing DevSecOps tools, providing a comprehensive runtime context-based prioritization. It helps unveil blind spots by identifying and addressing coverage gaps throughout your Software Development Lifecycle (SDLC). With contextual operationalization, you can prioritize, visualize, and automate the response to container findings, all within the context of runtime operations while reducing alert noise in the SDLC. Moreover, seamless integration is achieved through out-of-the-box solutions that connect, transform, and map your findings data into a unified format using the Dynatrace Semantic Dictionary, ensuring a smooth and efficient security workflow.

The challenge we’re tackling arises from multicloud environments, where container images are dispersed across different registries and scanned by various vulnerability scanners, if at all. This leads to container security findings scattered across multiple products, complicating achieving unified visibility. The consequences include time spent navigating various platforms to collect data, difficulty prioritizing findings from disparate tools, coverage gaps with containers deployed unscanned, and excessive manual effort required to notify stakeholders and generate tickets.

Addressing this issue is crucial for cloud architects, who aim to establish a robust container scanning process within the SDLC, ensuring timely action on findings and prioritization of critical vulnerabilities. Cloud architects also seek to minimize manual efforts in managing each finding. Meanwhile, developers need prompt notifications about new critical vulnerabilities affecting containers that they can trust and take action on without being overloaded by false positives, which lead to alert fatigue and risk critical alerts being ignored. Developers should handle as few tickets as possible, focusing on those that yield the maximum return on investment (ROI).

Why Dynatrace?

Container security in DevSecOps typically focuses on the build phase, where scanners flag numerous critical vulnerabilities without considering runtime context, often resulting in false alarms. Dynatrace revolutionizes this process by utilizing its insights into active containers and their operational significance. This allows you to prioritize genuine threats impacting live containers. Additionally, Dynatrace observability data for running containers, enriched with security insights, offers a comprehensive view for more effective issue resolution. In essence, Dynatrace refines container security management by integrating runtime context, thus elevating the prioritization and handling of vulnerabilities.

Generic ingest security endpoint

Dynatrace introduces a generic ingest security endpoint, a versatile feature that enables data ingestion directly from any third-party security tool.

This capability opens up a range of use cases, such as:

• Security findings visualization on custom dashboards tailored within Dynatrace.
• In-depth analysis of security findings using tools like Notebooks and Security Investigator.
• Automated orchestration of security findings through Dynatrace Workflows, enhancing efficiency and response times.
• Contextualization of third-party security findings with Dynatrace runtime entities, offering a more integrated and coherent security management experience.

With the generic ingest security endpoint, you can ingest any data in an unstructured format. However, to truly gain the benefits of uniform prioritization, the ideal scenario is to have the data in a unified format. To this end, we’re also releasing Dynatrace Semantic Dictionary conventions for vulnerability findings.

The Dynatrace Semantic Dictionary for vulnerability findings is a key feature in Dynatrace that enables a consistent and uniform analysis of security data. Dynatrace uses this format in supported third-party integrations, but this same format can also be used to map data from custom integrations.

It allows for uniform prioritization of container vulnerability findings across different tools, which can be conveniently managed and visualized through Dynatrace sample dashboards.

Additionally, this format supports automated notification of vulnerability findings across security tools, utilizing Dynatrace sample workflows to enhance efficiency.

Lastly, the generic ingest security endpoint provides a comprehensive understanding of the security findings coverage within your runtime environment, ensuring that all potential vulnerabilities are accounted for and addressed. This unified approach ensures that security management is systematic and effective, catering to the complex needs of modern containerized environments.

Dynatrace supported integrations

Dynatrace supported security data ingest integrations streamline the setup process and ensure automatic Semantic Dictionary (SD) mappings, providing a seamless integration experience.

With the first integrations in place, the foundations are there to build additional native integrations into the Dynatrace Platform to support additional container registries and generic security standards. This will expand our capability to provide contextual information to observability and security events, irrespective of where they originate. So, look for future blog announcements on this topic.

What’s next

• Watch the data-driven DevSecOps automation webinar, where we present and discuss the benefits of Dynatrace runtime context in operationalizing third-party security findings.
• To discover which products, tools, and standards we support, please visit the Dynatrace Hub.
• Explore the security data ingest capabilities and view the step-by-step setup guides for the supported integrations in Dynatrace Documentation.
• For additional out-of-the-box integration requests, please contact your Dynatrace account manager or submit a request in the Dynatrace Community.

The post Break the silos: Enrich vulnerability findings with runtime context appeared first on Dynatrace news.

This brings the latest Dynatrace innovations to Australian Government agencies, financial services, utilities, telecommunication, and other Australian enterprises and citizens. It gives all Dynatrace customers confidence that their data resides in a highly secure environment.

IRAP was created by the Australian Cyber Security Center (ACSC), part of the Australian Signals Directorate (ASD).

Australian IRAP

In an increasingly interconnected world, data security is paramount. The Australian government and high-compliance private sectors recognise this urgency and have established stringent requirements to safeguard sensitive information.

The challenge: Protecting sensitive data

Organisations across Australia handle a diverse array of sensitive data, including:

• Personally Identifiable Information (PII): Details that uniquely identify individuals.
• Personal Health Information (PHI): Health-related data that requires strict confidentiality.
• Mission data: Critical national security, defence, and strategic operations information.
• Financial data: Sensitive financial records and transactions.

To maintain data integrity and security in the public sector and highly regulated industries, Dynatrace has met the requirements and standards specified in the Australian Government Information Security Manual (ISM) and the Protective Security Policy Framework (PSPF).

Frameworks and assessments

Australian Government Information Security Manual (ISM)

The ISM is the definitive guide for information security within Australian government agencies. It covers risk assessment, access control, incident response, and secure data handling. Compliance with the ISM ensures robust security practices for government information systems.

Protective Security Policy Framework (PSPF)

The PSPF extends beyond information security to encompass broader protective security principles. It includes physical security, personnel security, information security, and governance. Adherence to the PSPF ensures a coordinated approach to security across government operations.

IRAP: Assessing ICT Systems

The Information Security Registered Assessors Program (IRAP) plays a pivotal role:

• IRAP assesses and accredits information and communication technology (ICT) systems.
• Independent assessors rigorously evaluate these systems against specific security standards.
• Certification by IRAP ensures compliance before deployment in government agencies.

Summary

An IRAP assesses and accredits information and communication technology (ICT) systems, the ISM provides detailed security guidelines for government information systems, and the PSPF establishes broader protective security principles for all government operations.

Following an IRAP assessment undertaken by a certified and independent IRAP Assessor, Dynatrace customers and their users can be assured that Dynatrace, as an organisation, adheres to the rigorous security controls mandated by the Australian Government’s ISM and PSPF.

By offering unified observability and security, Dynatrace enables organisations to safeguard their data and streamline operations. Companies can efficiently manage all their full stack observability and application security needs with a single platform that integrates AI-driven analytics and intelligent automation.

Dynatrace for Australia Regulated Sector

With the Dynatrace® platform, Australian citizens and enterprises can:

• Confidently deliver high-quality, innovative, cloud-native applications to take advantage of the benefits of new technologies.
• Prioritize and resolve issues before they have an adverse effect to ensure superior experiences.
• Relieve strained and limited IT resources from repetitive, laborious, and time-consuming tasks using automation.
• Eliminate blind spots and gain valuable insights into the performance and availability of infrastructure and applications with end-to-end observability.
• Shift security to the left (of the software development lifecycle) by automating vulnerability detection and resolving issues before they can be exploited, thus reducing threat-hunting needs and security analyst fatigue.
• Tame cloud complexity and stay ahead of rapidly changing demands by automating continuous discovery, proactive anomaly detection, and optimisation across the software lifecycle.
• Enable cross-functional collaboration by eliminating silos and providing DevSecOps teams with a standard set of contextual data and a single source of truth across their entire hybrid, multicloud ecosystem.

What’s next

• To learn more about Dynatrace data security and privacy, visit our Trust Center.
• If you’re an existing Dynatrace Managed customer looking to upgrade to Dynatrace SaaS, see How to start your journey to Dynatrace SaaS.

The post Dynatrace SaaS achieves “Protected” status after successful completion of Australian Information Security Registered Assessors Program assessment (IRAP) appeared first on Dynatrace news.

The Digital Operational Resilience Act (DORA) looms large on the horizon, casting its regulatory shadow over financial institutions. DORA is a European Union (EU) regulation that took effect on January 16, 2023, with full implementation starting January 17, 2025. DORA aims to bolster the IT security of financial entities such as banks, insurance companies, and investment firms. By ensuring robust cybersecurity practices, DORA seeks to enhance the digital resilience of the European financial sector, making it better equipped to withstand severe operational disruptions. The regulation covers areas like Information and Communication Technology (ICT) risk management, third-party risk, digital operational resilience testing, and reporting of major ICT-related incidents to competent authorities. Its harmonized principles address the increasing reliance on technology in financial services, safeguarding against cyber threats and promoting stability across borders.

As a strong partner of European financial institutions, Dynatrace is preparing for DORA requirements. This blog post describes how we’re aligning our efforts with the upcoming changes.

Understand the Digital Operational Resilience Act

DORA isn’t just an acronym; it’s a compass pointing toward operational resilience. Let’s break it down:

• Risk management: DORA mandates that financial institutions navigate the treacherous waters of IT and cybersecurity risks. Dynatrace, with its AI-driven observability platform, isn’t merely ticking boxes—we’re actively scanning the digital landscape, identifying vulnerabilities, and fortifying the ramparts.
• Business continuity: We don’t just draft continuity plans; we live them. Imagine a symphony where every instrument knows its part. When operational disruptions strike—whether it’s a rogue server or a cyberattack—Dynatrace services remain in harmony. The show must go on.
• Supervision and oversight: Dynatrace embraces transparency without compromising security. It welcomes constructive engagement with supervisory authorities, ensuring robust practices while safeguarding operational resilience. No smoke, no mirrors—just a commitment to excellence.

How will DORA impact Dynatrace?

The regulation imposes heightened regulatory scrutiny on ICT providers, including Dynatrace. Providers must meet rigorous requirements outlined in the framework and substantiate their compliance through tangible evidence.

How Dynatrace will support you

The Dynatrace secret weapon is data. It’s not about stockpiling ones and zeros; it’s about turning raw information into actionable insights. Imagine a dashboard that whispers, “Hey, there’s a vulnerability brewing in Server Room B.” The Dynatrace data-centric approach ensures compliance isn’t a burden; it’s an opportunity to fine-tune operations.

Instead of waiting for January 2025 to engage with customers, we’re already engaging with CISOs, CIOs, risk managers, and compliance officers. But here’s the twist: At Dynatrace, we don’t just preach; we listen. Customer feedback shapes our compliance strategy. After all, resilience isn’t an individual effort; it’s a symphony of collaboration and shared responsibility.

As the DORA countdown ticks down and the second batch of DORA policy documents is scheduled to be released in July 2024, we extend an invitation to you for a pragmatic roundtable discussion: Let’s embrace agility, dissect DORA, scrutinize our processes, and emerge stronger together.

So, to all our financial institution partners, DORA takes effect on January 17, 2025, and Dynatrace will be ready.

What’s next

Learn more about how Dynatrace assists with addressing DORA requirements and how Dynatrace complies with DORA in our DORA blog series, and contact your Dynatrace account representative to find the best solution for your organization.

The post The Dynatrace journey toward DORA compliance appeared first on Dynatrace news.

“Data Privacy Framework Program (The EU-U.S. DPF, UK Extension to the EU-U.S. DPF, and Swiss-U.S. DPF) was respectively developed by the U.S. Department of Commerce and the European Commission, United Kingdom (UK) Government, and Swiss Federal Administration to provide U.S. organizations with reliable mechanisms for personal data transfers to the United States from the European Economic Area (EEA), UK, and Switzerland while ensuring data protection that is consistent with EU, UK, and Swiss law.”

(Source: https://www.dataprivacyframework.gov/)

Dynatrace is committed to managing all personal data received from the European Economic Area (EEA), U.K., and Switzerland (EU Personal Data) in accordance with its data protection requirements and is now self-certified under the Data Privacy Framework (DPF). This demonstrates Dynatrace’s ongoing commitment to managing all EU Personal Data in compliance with the requirements of the DPF.

Benefits of Data Privacy Framework for Dynatrace customers.

The data Privacy Framework demonstrates our commitment to complying with EU requirements. By participating in the DPF Program and obtaining certifications such as ISO 27001 or TISAX, Dynatrace makes reviewing and validating how Dynatrace meets your security, privacy, and compliance requirements more efficient.

As a Dynatrace customer, you trust Dynatrace with ingesting and processing terabytes of data. You can be assured that cross-border transfers of your personal data fall within the scope of the European Commission adequacy decision under the GDPR. Dynatrace has invested in building its security compliance enhancement to ensure that all your data is protected end-to-end and that you have control and can see how your data is being used. All this enables you to keep expanding the use of Dynatrace to cover use cases that you weren’t able to cover earlier.

What’s next?

• Learn more about Dynatrace participation in the Data Privacy Framework Program.
• To learn more about Dynatrace data security and privacy, visit our Trust Center.
• Contact us for more information.

The post Dynatrace completed Data Privacy Framework self-certification appeared first on Dynatrace news.

Bridge the gaps while staying secure

While more and more applications are moving to the cloud, the need for secure environments isn’t going away. EdgeConnect provides a secure bridge for SaaS-heavy companies like Dynatrace, which hosts numerous systems and data behind VPNs. EdgeConnect facilitates seamless interaction, ensuring data security and operational efficiency.

With the increasing adoption of SaaS platforms and escalating security concerns caused by the proliferation of cyber threats, companies are becoming increasingly aware of the importance of safeguarding their systems and data. In this hybrid world, IT and business processes often span across a blend of on-premises and SaaS systems, making standardization and automation necessary for efficiency. Enterprises seek solutions that enable these processes to interact across their entire system landscape without compromising security.

Due to a variety of challenges, organizations face significant difficulties in achieving seamless interaction between on-premises and SaaS systems. Security concerns make it risky to bridge these systems, leaving enough flexibility for users to achieve their goals and keeping IT in control of infrastructure and deployments.

A look behind the curtain: EdgeConnect connects to the outside world

An EdgeConnect instance establishes a WebSocket secure connection (WSS/443) to the Dynatrace platform that doesn’t require opening ports or inbound connections. EdgeConnect acts as a bridge between Dynatrace and the network where it’s deployed

Setting up an EdgeConnect is simple. You can manage your EdgeConnect configuration in the Settings app under General > External requests. Once the initial setup is complete, Dynatrace routes all HTTP(s) service requests that match your configured rules via EdgeConnect.

Efficiency and control

EdgeConnect boasts a range of features designed for efficiency and control. It’s built for container-based deployments, operating either as a standalone container or within your Kubernetes or Openshift clusters. EdgeConnect is designed to forward HTTP(s) requests exclusively, ensuring secure data transmission. It supports multi-instance high availability and load balancing, providing robust performance and reliability.

EdgeConnect empowers operators with an optional allow list for domains during deployment. This feature enables IT to maintain control without the need for any configuration in Dynatrace, further simplifying the process.

The versatility of EdgeConnect enables many use cases:

• Automated creation and update of tickets in your local Jira instance using Dynatrace Workflows whenever Davis® AI identifies problems.
• Integration of data from your internal data warehouse to Dynatrace dashboards, blended with data from Grail.
• Flexible and adaptable connections to internet-based services like ServiceNow via a dedicated host and IP that you control.

What’s next

EdgeConnect is available for all Dynatrace SaaS environments, version 1.275+. Have a look at our documentation to learn more about how to configure and deploy EdgeConnect. Once deployed, you can manage your EdgeConnect configuration in the Settings app under General > External requests.

We’d love to hear your feedback about EdgeConnect. Let us know your thoughts or share your ideas about how we can improve EdgeConnect in the future.

The post Dynatrace EdgeConnect securely connects your local systems to Dynatrace SaaS appeared first on Dynatrace news.

DevSecOps is the seamless integration of security throughout the software development and deployment lifecycle. Like DevOps, DevSecOps is as much about culture and shared responsibility as it is about any specific technology or techniques. Also, like DevOps, the goal of DevSecOps is to release secure software faster, and detect and respond to security flaws (like vulnerabilities) faster and more efficiently.

That’s a lot to digest. In the sections below, I’ll unpack each of those thoughts so you can better understand how your organization can move towards a fuller embrace of DevSecOps.

What is DevSecOps?

DevSecOps is a tactical trifecta that connects three disciplines: development, security, and operations. The goal is to seamlessly integrate security into your continuous integration and continuous delivery (CI/CD) pipeline in both pre-production (dev/test/staging) and production (ops) environments. Let’s take a look at each discipline and the role it plays in delivering better, more secure software faster.

Development

Development teams create and iterate on new software applications. This includes:

• Custom, built-in-house apps designed for a single, specific purpose
• API-driven connections that bridge the gap between legacy systems and new services
• Apps that leverage open-source code to accelerate the development process

Modern development practices rely on agile models that prioritize continuous improvement versus sequential, waterfall-type steps. If developers work in isolation without considering operations and security, new applications or features may introduce operational issues or security vulnerabilities that can be expensive and time-consuming to address.

Operations

Operations refers to the processes of managing software functionality throughout its delivery and use life cycle, including:

• Monitoring system performance
• Repairing defects
• Testing after updates and changes
• Tuning the software release system

DevOps has gained ground in recent years as a way to combine key operational principles with development cycles, recognizing that these two processes must coexist. Siloed post-development operations can make it easier to identify and address potential problems, but this approach requires developers to circle back and solve software issues before they can move forward with new development. This creates a complex road map instead of a streamlined software workflow.

Implementing operations parallel to software development processes allows organizations to reduce deployment time and increase overall efficiency.

Security

Security refers to all the tools and techniques needed to design and build software that resists attack, and to detect and respond to defects (or actual intrusions) as quickly as possible.

Historically, application security has been addressed after development is completed, and by a separate team of people — separate from both the development team and the operations team. This siloed approach slowed down the development process and the reaction time.

Also, security tools themselves have historically been siloed. Each application security test looked only at that application, and often only at the source code of that application. This made it hard for anyone to have an organization-wide view of security issues, or to understand any of the software risks in the context of the production environment.

By making application security part of a unified DevSecOps process, from initial design to eventual implementation, organizations can align the three most important components of software creation and delivery.

How DevSecOps differs from the “waterfall” approach

Traditional software development is often called the waterfall approach because each stage of the process — design, development, testing, and final approval — is separate and one stage can start only when the previous one is completed.

In most organizations, waterfall has largely been replaced by Agile methodology, which separates a project into sprints. But security tests are typically delayed until the end of the sprint—waterfall style! This delay forces developers to shift gears and backtrack their thinking to remediate security problems. This “context switching” is error-prone and time-consuming.

DevSecOps, on the other hand, enables security testing to occur seamlessly and automatically in the same general timeframe that other development and testing are happening. For example, developers can run security tests in the development stage in near-real-time to prevent wasting time context switching. They can also run security tests in the production phase in near-real time so they can immediately discover all instances of a vulnerability running in production soon after the vulnerability is announced.

DevSecOps vs. DevOps

DevOps is a methodology that brings together development, operations, and security teams to shorten the software development lifecycle.

DevSecOps takes this further by integrating security into the DevOps process from the start. It ensures that security is not an afterthought but a top priority throughout the entire software development process.

Here are some critical differences between DevSecOps and DevOps:

• DevSecOps involves a broader range of stakeholders, including security teams.
• DevSecOps requires a more rigorous approach to security testing and scanning.
• DevSecOps requires a stronger focus on compliance with security regulations.

Benefits of DevSecOps

DevSecOps can improve the overall security of software with benefits such as: 

• Increased security: By integrating security into the DevOps process, DevSecOps can help to prevent security vulnerabilities from being introduced into production systems.
• Reduced risk: Reduce the risk of security and data breaches.
• Improved compliance: Automate processes that will help enforce compliance with security regulations.
• Improved efficiency: Improve the efficiency of the software development process by automating security checks and scans.
• Improved compliance: Help organizations to comply with security regulations.
• Increased collaboration: Improve collaboration between development, operations, and security teams, through a shared sense of responsibility
• Faster time to market: Speed up the software development process by automating security checks and scans.
• Improved quality: Improve software quality by catching security vulnerabilities early in the development process.
• Improved risk management: Help organizations identify and address security risks more effectively.
• Increased customer satisfaction: Increase customer satisfaction by delivering secure and reliable software.
• Reduced costs: Reduce the costs associated with security and data breaches.
• Improved visibility: Help organizations gain visibility into their security posture to quickly identify and address security risks.

Challenges in implementing DevSecOps

Implementing DevSecOps has some challenges.

The first challenge involves people and culture. You might find it necessary to retrain the people on your DevOps teams so they understand security best practices and know how to operate your new security tooling. In terms of culture, your teams need to truly adopt the mindset that they’re responsible for the security of the software they build and deploy, just as much as they’re responsible for feature, function, and usability.

A second challenge is finding the right security tooling and integrating it into your DevOps workflow. The more automated your DevSecOps tooling is, and the more integrated it is with your CI/CD pipeline, the less training and culture-shifting you need to do.

In many cases, however, choosing a more automated version of the security tools you have been using for years is not the right answer. Why? Because your development environment has likely changed drastically over the past few years. The typical modern software application is comprised of 70% open source software. Unfortunately, accurately detecting vulnerabilities in open source software is not something traditional security tools were designed to do.

Similarly, modern cloud-native applications run in containers that may spin up and down very quickly. Traditional security tools designed for production environments—even those that now advertise themselves as “cloud security” tools—can’t accurately assess the risks of applications running in containers.

Top traits of successful DevSecOps practices

If the goals of DevSecOps are 1) to release better software faster, and 2) to detect and respond to software flaws in production faster and more efficiently, what are the capabilities you should cultivate to achieve them? What key performance indicators (KPIs) should you use to measure the quality of your DevSecOps initiatives?

Here are the most important characteristics of a strong DevSecOps program:

1. Security awareness and ownership

Everyone involved with software development and operations should be aware of security fundamentals and have a sense of ownership in the results. The philosophy “security is everyone’s responsibility” should be a part of your organization’s DevSecOps culture.

2. Automated operation

To align with the high degree of automation present in most CI/CD tool chains, your DevSecOps security tooling needs to run with complete automation — no manual steps, no configurations, no custom scripts. It needs to provide information about the security of your application even when your developers might want to avoid running a security test for fear that it would slow them down.

3. Fast results

Your security tooling needs to produce results in near-real-time because speed is a high priority for modern DevOps teams.

4. Wide scope

Your security tooling should function across all types of compute environments including containers, Kubernetes, serverless, PaaS, hybrid clouds, and multiclouds. No blind spots. No silos.

Also, your security tooling needs to provide information about all types of applications — including applications that are mostly based on open-source software, as well as applications that you purchased from a third party, for which you have no source code at all.

5. Shift-left and shift-right

Much has been written about the benefits of conducting security assessments early in the software development lifecycle (“shift left”), before vulnerabilities find their way into production. However, DevSecOps also needs to extend to production environments (“shift right”) for four reasons:

• Production is where most attacks happen.
• Scanning source code can’t give you the same rich insights you can get by observing the application when it is running in production.
• Some applications you run in production may not have run through your dev environment, so they never had a chance to be scanned by security tools in your dev environment.
• To detect new zero-day vulnerabilities, you need to monitor existing applications in your production environment.

6. Accuracy

Automation is important, but you also need accuracy and quality. In our recent CISO survey, 77% of respondents said most security alerts and vulnerabilities they receive from their current security tools are false positives that don’t require action, because they’re not actual exposures.

To achieve DevSecOps efficiency, you need security tests that eliminate false positives and false negatives, and provide useful information to your remediation team.

7. Developer acceptance

Everything about your DevSecOps program needs to be accepted by the people who will be developing the software, running the tests, scanning for vulnerabilities, and remediating the security issues that are found.

Implementing DevSecOps Best Practices

The seamless integration of development, security, and operations has become critical. To achieve this harmonious balance, adopt these DevSecOps best practices to foster a culture of collaboration, continuous improvement, and heightened security awareness.

1. Automated Security Testing:

Automated security testing is the backbone of DevSecOps. Regular security scans, such as vulnerability assessments, penetration testing, and security code reviews, should seamlessly integrate into the development pipeline. Automated tools identify vulnerabilities and help prioritize them based on severity, enabling development teams to promptly address critical issues.

2. Continuous Monitoring and Feedback:

DevSecOps emphasizes continuous monitoring of deployed applications. Real-time monitoring helps identify and mitigate security threats in production, allowing for immediate response and mitigation. Teams should leverage SIEM systems and APM tools to gain holistic insights into application behavior.

3. Infrastructure as Code (IaC) Security:

As infrastructure becomes more code-driven, IaC security becomes crucial. Implementing security practices within infrastructure code helps maintain consistent security configurations and reduces the risk of misconfigurations that could lead to breaches. Regularly audit and validate your infrastructure code for adherence to security standards.

4. Collaboration and Training:

DevSecOps thrives on collaboration between development, security, and operations teams. Foster a culture of open communication and knowledge sharing. Additionally, provide regular security awareness training to developers, helping them understand the latest threats and mitigation techniques.

5. Immutable Infrastructure:

Consider adopting immutable infrastructure practices where deployed components are treated as disposable entities. When detected, vulnerabilities can be addressed by replacing the entire component with an updated version. This approach reduces the attack surface and simplifies patch management.

Automation for DevSecOps

Automation lies at the heart of DevSecOps, acting as a force multiplier for development and security teams. It accelerates the deployment pipeline, reduces manual errors, and enforces consistent security controls throughout the development lifecycle. DevSecOps and automation are two key components of a secure software development process. Automation can help to improve the efficiency and effectiveness of security checks and scans and can help to prevent security vulnerabilities from being introduced into production systems.

A platform for all stages of DevSecOps

To respond to the need for application security that spans both production (shift-right) and pre-production (shift-left), many organizations are choosing to leverage the security information that is available from their existing application performance monitoring platform.

With the Dynatrace Software Intelligence Platform’s Application Security module, the same OneAgent that provides deep observability for application performance also provides deep observability for security issues. The Dynatrace OneAgent provides rich information, such as which libraries are called, how they’re used, whether a process is exposed to the internet and whether an application or service interacts with sensitive “crown jewel” type data. This is much richer information than traditional security scanners or behavioral anomaly tools can deliver. By combining security with contextual awareness and observability, Dynatrace Application Security delivers the accuracy and precision teams need to achieve their DevSecOps goals.

What is DevSecOps? It’s the seamless integration of security testing and protection throughout the software development and deployment lifecycle. With real-time security intelligence across pre-production and production environments, and with AI-driven recommendations and automation that can help manage every stage of the DevOps workflow, your teams can produce better, higher-performing, more secure software faster and with less effort.

The post What is DevSecOps? And what you need to do it well appeared first on Dynatrace news.