The nature of systems administrators' jobs puts them in a position of power, which can be deliberately or inadvertently subverted

Reseller opportunity remains within the area of systems administration (sys-admin) for better management of privilege, automation and improve compliance.

For a long time there has been a need to gather and store log files for compliance purposes. Early log management products evolved in to SIEM (security information and event management) as their scope was extended to include a broader range of events across a wide range of IT devices from the data centre, across the network to the desktop. Typically, this information was use retrospectively to prepare reports for auditors etc. More recently some of the vendors have souped up their products to enable them to act on data in real time. This enables advanced cyber security protection measures to be put in place that can identity anomalies that may be missed by point security products such as firewalls, anti-malware and data loss prevention (DPL); some are calling this next generation SIEM.

Careless insiders, malicious insiders and hackers can all do far more damage if they are operating with privilege.

Cyber security threats are becoming increasingly complex and can often only be detected by looking at data from multiple sources. This includes the logs from point security products, information about IT systems and the data that is used to store knowledge of users and their rights and other contextual information. A correlated view of all this data enables unforeseen attacks to be thwarted as they happen, as well as providing IT security teams with the insight to do their jobs more effectively and improve base security.