What We Do
How we do it
Our Threat Response Unit (TRU) publishes security advisories, blogs, reports, industry publications and webinars based on its original research and the insights driven through proactive threat hunts.
View Threat Intelligence Resources →
Jan 19, 2023
Increased Activity in Google Ads Distributing Information Stealers
THE THREAT On January 18th, 2023, eSentire Threat Intelligence identified multiple reports, both externally and internally, containing information on an ongoing increase in Google advertisements…
Read More
View all Advisories →
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 1500+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
Dec 13, 2022
eSentire Named First Managed Detection and Response Partner by Global Insurance Provider Coalition
Waterloo, ON – December 13, 2022 – eSentire, Inc., the Authority in Managed Detection and Response (MDR), today announced it has been named the first global MDR partner by Coalition, the world’s first Active Insurance provider designed to prevent digital risk before it strikes. Like Coalition, eSentire is committed to putting their customers’ businesses ahead of disruption by improving their…
Read More
e3 Ecosystem
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
Learn more
Apply to become an e3 ecosystem partner with eSentire, the Authority in Managed Detection and Response.
Login to the Partner Portal for resources and content for current partners.
Blog — Apr 12, 2022

Microsoft Rescues Acronym-Weary CISOs

5 minutes read
Speak With A Security Expert Now

For all the disruption the COVID-19 pandemic caused, it also served as a catalyst of sorts for CISOs that took time to step back and consider how their security investments to date had to change to support an increasingly cybercrime-filled new normal.

Vendors, too, were repositioning themselves and their offerings as the need to secure remote working became a rallying cry — and a common denominator around which a whole range of security products and technologies could be released, rebadged, and repackaged.

For a company like Microsoft, this change presented a golden opportunity — and Mark MacDonald, senior manager of product marketing with managed detection and response (MDR) vendor eSentire, believes the industry-wide pivot of the past two years proved especially beneficial as the company successfully repositioned itself for an audience of time-pressured, integration-weary CISOs.

“Any time there’s a large event that happens, it forces people to take a step back and reevaluate things,” MacDonald told Cybercrime Magazine, “and the pandemic served as a kind of logical reset for a lot of IT leaders and security leaders to rethink their strategy moving forward.”

Cybercrime Radio: The latest on Microsoft Security

eSentire’s MDR shines

That proved fortuitous timing for Microsoft — which, he said four years ago “levelled up their game when it came to security tools and their security strategy.”

That included, for example, an update of the company’s Cybersecurity Reference Architecture with a new version covering IT elements such as the Security Operations Center (SOC), Software as a Service (Saas), information protection, identity & access, hybrid cloud infrastructure, IoT, and clients.

This more coherent security framework had already begun refocusing Microsoft’s security value proposition by the time the pandemic hit — causing what MacDonald calls “security vendor fatigue” as CISOs were given additional budget and flooded with remote-working security pitches to spend it on.

“It was really a question of ‘what acronym do I buy this year?’” MacDonald explained, “and Microsoft bundling has simplified this by bundling security controls, threat-hunting tools, and XDR tools within the Microsoft 365 license that you’ve probably already invested in anyways.”

“It’s a consolidation play that will save you money and a lot of hassle in the end,” he continued. “You can very cost-effectively bundle security tools and threat hunting tools to the Microsoft 365 Defender stack, compared to going out and buying EDR, email security, a CASB, identity security, and so on.”

“You’re easily saving 50 percent versus going out and building your own stack of tools from individual vendors — and any time a CFO hears an opportunity to save 50 percent on IT spend, they’re going to listen.”

The power of integration

By building a security ecosystem across its products, MacDonald said Microsoft — whose Microsoft Defender security platform has been lauded as the best endpoint protection tool on the market — has distinguished itself from vendors that have, by design, tended to specialize in one particular area.

Ongoing merger activity has seen many security players silo-busting by consolidating their capabilities — Google’s $5.4 billion acquisition of cybersecurity stalwart Mandiant was just one of hundreds of deals over the past year or so — and Microsoft has responded in kind, last year committing to quadruple its security investment, to $4 billion per year.

For MDR providers like eSentire, a Microsoft partner that has distinguished itself in a competitive market with offerings such as a 4-hour incident response service, the tight integration across Microsoft’s existing stable of near-ubiquitous cloud and infrastructure platforms provides a unique offering that simplifies the process of managing an incident response.

“The thing that’s impressive from our perspective at eSentire, in terms of an MDR or threat detection and response standpoint, is how integrated these tools are,” said MacDonald. “They all connect and talk with each other very well, which is a challenge that security teams have pretty commonly when it comes to building systems from the ground up.”

The range of Microsoft Defender capabilities has covered what a self-professed “bullish” MacDonald sees as the three legs of the tripod that holds up modern security strategies: endpoint security, email security, and identity management.

“Identity ended up being the main connection between a lot of cloud systems,” he explained, “and Microsoft’s ability to tie those three things together is very impressive — and probably unmatched in the market.”

By leveraging the technical integration within Microsoft’s portfolio, CISOs can focus on deciding which response structure works better for their requirements — either hiring and training an internal incident response function to use the Microsoft tools, or bringing on a Microsoft-fluent MDR partner like eSentire.

“One strategy is obviously a lot faster than the other,” MacDonald said, “especially when you consider the very well-documented security skill shortage. Having to hire, train, and retain employees is definitely a challenge.”

That challenge has only increased over time, he added, because the ever-expanding spectrum of cybersecurity skills has required companies to add more and more skilled employees across a range of capabilities.

Yet not even Microsoft can provide every security capability, MacDonald said, which is why prospective MDR customers need to be careful that their eventual choice of providers is able to provide a broader detection and response capability.

“While an organization can be all in on Microsoft,” he explained, “Microsoft isn’t going to represent the totality of the security footprint when it comes to thinking about protecting their organization.”

“Microsoft covers and checks a lot of boxes, but not all of them — and even they claim this. So a strong question to ask MDR vendors is: what else can you handle? And what is your strategy for training and retaining your talent?”

“If they don’t have a good answer for that, you might be setting yourself up for some challenges in the future. Because, ultimately, a lot of these outcomes still require skilled people and it’s a very important ingredient — and that’s not going away.”

David Braue is an award-winning technology writer based in Melbourne, Australia.

Go here to read all of David’s Cybercrime Magazine articles.

Originally posted on cybersecurityventures.com

View Most Recent Blogs

eSentire is the Authority in Managed Detection and Response, protecting the critical data and applications of 1500+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events. Combining cutting-edge machine learning XDR technology, 24/7 Threat Hunting, and proven security operations leadership, eSentire mitigates business risk, and enables security at scale. The Team eSentire difference means enterprises are protected by the best in the business with a named Cyber Risk Advisor, 24/7 access to SOC Cyber Analysts & Elite Threat Hunters, and industry-leading threat intelligence research from eSentire’s Threat Response Unit (TRU). eSentire provides Managed Risk, Managed Detection and Response and Incident Response services. For more information, visit www.esentire.com and follow @eSentire.