How MSPs can become Managed Detection and Response (MDR) Providers

Cynet now enables service providers to add MDR to their
portfolio and gain an important competitive advantage over
competitors with Cynet 360 integrated offering of breach protection
platform and CyOps 24\7 SOC team (Learn more
here^[2]).

MDR is a relatively new security service offering that emerged
in recent years to assist the standard organization with a team of
experts that provide 24\7 alert prioritization, investigation, and
proactive threat hunting — tasks that are typically beyond its
in-house capabilities.

Cynet 360’s complete coverage across endpoints, network, and
user accounts makes it a tool of choice that provides MDR providers
with real-time threat coverage across the entire environment with a
single integrated platform.

New Threats Lead to New Detection Solutions

The security industry confronted the evolvement of the advanced
threat landscape with various detection technologies that alert
upon the identification of malicious presence or activity within
the environment. These technologies—of which most prominent are
EDR, Network Analytics, UBA, and Deception—introduced a high
potential of improving organizations’ security posture.

The Security Skill Gap Deprives Detection Solution from
Delivering Full Protection

In practice, this potential is to a large extent not yet realized
due to the high volume of alerts (often including a substantial
false positive rate) and the required skills to both prioritize the
critical ones as well as to proactively leverage the technologies
to hunt for existing threats which are yet undetected.

The bottom line is that there’s a critical missing link in the
efficient operation of the advanced detection products which, if
not addressed, leaves organizations vulnerable to advanced attacks
despite the security investments they make.

MDR – Security Skills as a Service

MDR has emerged to fill this gap. In essence, MDR services consist
of a team of security experts that manage a 24\7 SOC to which all
alerts are streamlined, prioritized, and analyzed. This greatly
assists in reducing what is known as ‘alert fatigue,’ a term which
refers to the overwhelming effect of multiple alerts that are way
beyond the capacity of security teams’ efficient handling.

MDR serves as the front line that encounters the alerts, and due
to their security skill and knowledge can easily determine what’s
important and what’s not. Once the MDR team reaches a conclusion on
what’s going on, it contacts the customer to update and instruct on
the required remediation steps.

MDR Implemented Detection Technology – Essential
Requirements

To deliver the best of breed MDR services, the MDR provider must
ensure that the detection technology it implements indeed covers
all the environment core attack surfaces, namely the endpoints,
network, and user accounts.

Sample from CyOps MDR attack report

This coverage manifests in both the ability to detect malicious
activity regardless if it involves endpoint, network, or user
accounts, as well as full visibility into all the activities in the
environment to support its proactive investigation

Cynet 360 for MDR Providers

Cynet 360 the only platform today that provides endpoint, user, and
network protection in a single natively integrated product.
Following a rapid installation (5,000 endpoints in 1hr), Cynet 360
delivers high fidelity alerts across all main attack vectors —
malware, exploits, and fileless attacks on endpoints, anomalous
login, and connection of user accounts and network-based attacks
such as ARP spoofing, lateral movement, and data exfiltration.
Learn more about
Cynet offering for MDR providers.

Native Multitenancy for Easy Management

Cynet 360 server fully supports multitenancy, enabling MDR to
manage multiple customers from a single console. In practice, it
means that the MDR needs to put a single, one-time deployment
effort to set up the infrastructure and is them free to add any.

Get Full Threat Visibility with Just One Product to Deploy

Using Cynet 360, MDR providers can gain the benefit of the complete
threat visibility that can otherwise be gained only by the conjoint
operation of EDR, UBA, Network Analytics, and Deception
technologies. This greatly increases the ability to scale and serve
a multitude of customers without being held back by deployment and
maintenance issues, focusing their primary efforts on alert
handling and proactive threat hunting.

High Precision Alerts Across all Main Attack Vectors

Moreover, Cynet 360 continuous monitoring of endpoint, network, and
use activities ensures that each activity is analyzed with its
entire context reducing false positives to a minimum. It is often
the case that a process execution cannot be determined as malicious
or legit without taking into consideration the user account context
or the initiated network traffic.

Cynet 360’s correlation engine easily unveils the threats that
siloed detection solutions such as EDR, Network Analytics, or UBA
would miss.

CyOps – Augmenting the MDR Security team

CyOps is Cynet’s security researchers and threat analyst team that
operates a 24\7 SOC, monitoring alerts, investigating malicious
events, and proactively hunting for hidden threats. CyOps is an
integral part of the Cynet 360 offering, which consists of 80\20
technology and services.

MDR providers can take advantage of CyOps expertise and use it
as an augmentation of their own team. In a similar manner, MSPs
(managed service providers) who want to join the rapidly growing
MDR market can utilize CyOps services in a white-label model while
building up their own teams.

Learn more about Cynet for MDR providers here^[4].

^[1][3]