Threat mitigation system and method

1. A computer-implemented method, executed on a computing device, comprising:

monitoring, by a Security Information and Event Management (SIEM) system, activity of one or more security-relevant subsystems;

detecting, by the SIEM system, one or more security events within a computing platform of a client;

notifying the client of the one or more security events within the computing platform;

determining how long it took the client to resolve the one or more security events within the computing platform; and

providing a resolution report to the client that quantifies client resolution performance based, at least in part, upon how long it took the client to resolve the one or more security events within the computing platform, wherein the resolution report defines a client resolution time with respect to how long it took the client to resolve the one or more security events within the computing platform and compares the client resolution time to a resolution time of third parties.

2. The computer-implemented method of claim 1 wherein the third-parties include one or more of:

other clients regardless of industry; and

other clients in the same industry as the client.

3. The computer-implemented method of claim 1 wherein the resolution report defines time-based resolution performance over a defined period of time.

4. The computer-implemented method of claim 3 wherein the time-based resolution performance includes time-based resolution performance for the client and for third parties.

5. The computer-implemented method of claim 4 wherein the time-based resolution performance for the client includes time-based resolution performance for the client sorted by severity of the one or more security events.

6. The computer-implemented method of claim 4 wherein the third-parties include one or more of:

other clients regardless of industry; and

other clients in the same industry as the client.

7. A computer program product residing on a non-transitory computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:

monitoring, by a Security Information and Event Management (SIEM) system, activity of one or more security-relevant subsystems;

detecting, by the SIEM system, one or more security events within a computing platform of a client;

notifying the client of the one or more security events within the computing platform;

determining how long it took the client to resolve the one or more security events within the computing platform; and

providing a resolution report to the client that quantifies client resolution performance based, at least in part, upon how long it took the client to resolve the one or more security events within the computing platform, wherein the resolution report defines a client resolution time with respect to how long it took the client to resolve the one or more security events within the computing platform and compares the client resolution time to a resolution time of third parties.

8. The computer program product of claim 7 wherein the third-parties include one or more of:

other clients regardless of industry; and

other clients in the same industry as the client.

9. The computer program product of claim 7 wherein the resolution report defines time-based resolution performance over a defined period of time.

10. The computer program product of claim 9 wherein the time-based resolution performance includes time-based resolution performance for the client and for third parties.

11. The computer program product of claim 10 wherein the time-based resolution performance for the client includes time-based resolution performance for the client sorted by severity.

12. The computer program product of claim 10 wherein the third-parties include one or more of:

other clients regardless of industry; and

other clients in the same industry as the client.

13. A computing system including a processor and memory configured to perform operations comprising:

monitoring, by a Security Information and Event Management (SIEM) system, activity of one or more security-relevant subsystems;

detecting, by the SIEM system, one or more security events within a computing platform of a client;

notifying the client of the one or more security events within the computing platform;

determining how long it took the client to resolve the one or more security events within the computing platform; and

providing a resolution report to the client that quantifies client resolution performance based, at least in part, upon how long it took the client to resolve the one or more security events within the computing platform, wherein the resolution report defines a client resolution time with respect to how long it took the client to resolve the one or more security events within the computing platform and compares the client resolution time to a resolution time of third parties.

14. The computing system of claim 13 wherein the third-parties include one or more of:

other clients regardless of industry; and

other clients in the same industry as the client.

15. The computing system of claim 13 wherein the resolution report defines time-based resolution performance over a defined period of time.

16. The computing system of claim 15 wherein the time-based resolution performance includes time-based resolution performance for the client and for third parties.

17. The computing system of claim 16 wherein the time-based resolution performance for the client includes time-based resolution performance for the client sorted by severity.

18. The computing system of claim 16 wherein the third-parties include one or more of:

other clients regardless of industry; and

other clients in the same industry as the client.