.png)
Managed detection and response (MDR) is one of the fastest-growing segments in the cybersecurity market. ESG research from April 2019 reveals that 27% of organizations are actively pursuing an MDR project, while another 11% plan to pursue an MDR project in the future.
Cynet now enables service providers to add MDR to their portfolio and gain an important competitive advantage over competitors with Cynet 360 integrated offering of breach protection platform and CyOps 247 SOC team (Learn more here).
MDR is a relatively new security service offering that emerged in recent years to assist the standard organization with a team of experts that provide 247 alert prioritization, investigation, and proactive threat hunting — tasks that are typically beyond its in-house capabilities.
Cynet 360’s complete coverage across endpoints, network, and user accounts makes it a tool of choice that provides MDR providers with real-time threat coverage across the entire environment with a single integrated platform.
New Threats Lead to New Detection Solutions
The security industry confronted the evolvement of the advanced threat landscape with various detection technologies that alert upon the identification of malicious presence or activity within the environment. These technologies—of which most prominent are EDR, Network Analytics, UBA, and Deception—introduced a high potential of improving organizations’ security posture.
The Security Skill Gap Deprives Detection Solution from Delivering Full Protection
In practice, this potential is to a large extent not yet realized due to the high volume of alerts (often including a substantial false positive rate) and the required skills to both prioritize the critical ones as well as to proactively leverage the technologies to hunt for existing threats which are yet undetected.
The bottom line is that there’s a critical missing link in the efficient operation of the advanced detection products which, if not addressed, leaves organizations vulnerable to advanced attacks despite the security investments they make.
MDR – Security Skills as a Service
MDR has emerged to fill this gap. In essence, MDR services consist of a team of security experts that manage a 247 SOC to which all alerts are streamlined, prioritized, and analyzed. This greatly assists in reducing what is known as ‘alert fatigue,’ a term which refers to the overwhelming effect of multiple alerts that are way beyond the capacity of security teams’ efficient handling.
MDR serves as the front line that encounters the alerts, and due to their security skill and knowledge can easily determine what’s important and what’s not. Once the MDR team reaches a conclusion on what’s going on, it contacts the customer to update and instruct on the required remediation steps.
MDR Implemented Detection Technology – Essential Requirements
To deliver the best of breed MDR services, the MDR provider must ensure that the detection technology it implements indeed covers all the environment core attack surfaces, namely the endpoints, network, and user accounts.
 |
| Sample from CyOps MDR attack report |
This coverage manifests in both the ability to detect malicious activity regardless if it involves endpoint, network, or user accounts, as well as full visibility into all the activities in the environment to support its proactive investigation
Cynet 360 for MDR Providers
Cynet 360 the only platform today that provides endpoint, user, and network protection in a single natively integrated product. Following a rapid installation (5,000 endpoints in 1hr), Cynet 360 delivers high fidelity alerts across all main attack vectors — malware, exploits, and fileless attacks on endpoints, anomalous login, and connection of user accounts and network-based attacks such as ARP spoofing, lateral movement, and data exfiltration. Learn more about Cynet offering for MDR providers.
Native Multitenancy for Easy Management
Cynet 360 server fully supports multitenancy, enabling MDR to manage multiple customers from a single console. In practice, it means that the MDR needs to put a single, one-time deployment effort to set up the infrastructure and is them free to add any.
Get Full Threat Visibility with Just One Product to Deploy
Using Cynet 360, MDR providers can gain the benefit of the complete threat visibility that can otherwise be gained only by the conjoint operation of EDR, UBA, Network Analytics, and Deception technologies. This greatly increases the ability to scale and serve a multitude of customers without being held back by deployment and maintenance issues, focusing their primary efforts on alert handling and proactive threat hunting.
High Precision Alerts Across all Main Attack Vectors
Moreover, Cynet 360 continuous monitoring of endpoint, network, and use activities ensures that each activity is analyzed with its entire context reducing false positives to a minimum. It is often the case that a process execution cannot be determined as malicious or legit without taking into consideration the user account context or the initiated network traffic.
Cynet 360’s correlation engine easily unveils the threats that siloed detection solutions such as EDR, Network Analytics, or UBA would miss.
CyOps – Augmenting the MDR Security team
CyOps is Cynet’s security researchers and threat analyst team that operates a 247 SOC, monitoring alerts, investigating malicious events, and proactively hunting for hidden threats. CyOps is an integral part of the Cynet 360 offering, which consists of 8020 technology and services.
MDR providers can take advantage of CyOps expertise and use it as an augmentation of their own team. In a similar manner, MSPs (managed service providers) who want to join the rapidly growing MDR market can utilize CyOps services in a white-label model while building up their own teams.
Learn more about Cynet for MDR providers here.
