Choosing MDR? – Start with selecting an MDR provider

The demand on Managed Detection and Response (MDR) solutions is growing, especially among SMB organizations. Gartner predicts every fourth company will be using MDR by 2024 in comparison with just 5% in 2019. Moreover, it believes that, by 2024, 40% of midsize enterprises will use MDR as their only managed security service.[1]

This growing interest to MDR turns out to be challenging for SMBs, as they have traditionally invested more into preventive technologies with less focus on detection and response. However, choosing MDR is in many ways about selecting a right provider and a team of security experts, who would manage the security. And here SMBs often come across a lack of in-house professionals, who would constantly monitor their security events. It is difficult to hire and expensive to retain such experts, as now the cybersecurity talent shortage has reached 3.5 million positions in comparison with 2 million 5 years ago.

Define your security needs to choose the right MDR provider  

Once the value of the detection and response is clear, it is time to choose the right solution. On top of considering a solution with good detection rates, companies should have a room for self-reflection to define the security requirements specific for the organization. Based on understanding of these needs, it is easier to select the right solution as well as the MDR provider.

Here is a list of questions that can help you to identify and structure your needs:

• Are you aware of the main threat vectors and security gaps of your organization? If not, it makes sense to conduct security assessment as a step zero of your strategy.
• Are you looking for a solution that would build up the response capabilities from scratch or just improve your current capabilities? And therefore, do you want the MDR provider to bring his technologies or use yours?
• What geographies and time zones do you need to cover? If you need to protect your Italian locations, look for a security management team in Europe. If your company’s offices are distributed, or if you expect 24×7 security monitoring, choose a provider whose SOCs are spread across the globe.
• Do you value the full transparency of the detection and response process? Or having regular reports and notifications on critical events is enough for you?
• Do you need an SLA for threat detection and response? If it is critical to bring business back to work as soon as possible, it is worth finding out if the MDR provider has incident response packages with the defined SLA in place.
• In case you may need additional advanced managed services like threat hunting or vulnerability management, it makes sense to choose a provider with strong SOC.
• If you deal with the SMB security management as an MSSP, consider solutions with the multi-tenancy supported.

Sababa MDR

Sababa Security brings managed endpoint detection and response service to protect SMB organizations against cyber threats, including ransomware and brute force attacks. The solution combines all the benefits of the EDR, supported by Sangfor, as well as handles threat management and response with a team of the Sababa SOC experts.

Sababa MDR leverages from the shared threat intelligence and multi-layered response mechanisms, due to the Sangfor Platform-X cloud-based security analysis and management system. It provides real-time information about the global threats and the way they affect different local environments. Granularly identifying the unknown threats, Sababa MDR can therefore quickly apply the suitable incident containment actions.

The threat management expertise comes from Sababa SOC, that is up and running for 10+ years and gains hundreds of high-profile customers all over the globe, including 15+ central banks of different countries. The team of 50 experts works from the SOCs in Verona, Singapore, and Dubai to monitor endpoint security and notify clients of the critical security events 24×7. Incident Response packages with various SLA conditions can be included.

Not only Sababa MDR addresses the needs of the SMB end customers, but can also be the right solution for MSSPs, managing security for multiple clients every day.

[1] Midsize Enterprises Should Embrace MDR Providers, Gartner, February 2020