Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Visibility and response across your entire Microsoft security ecosystem.
XDR with Machine Learning that eliminates noise, enables real-time detection and response, and automatically blocks threats.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert threat hunting, original research, and proactive threat intelligence.
TRU is foundational to our MDR service. No add-ons or additional costs required.
Flexible MDR packages that enhance your cyber resilience and security operations.
Stop ransomware attacks before they disrupt your business.
Detect and respond to zero-day exploits.
Protect against third-party and supply chain risk.
Adopt a risk-based approach to cybersecurity.
Protect your most sensitive data.
Meet cybersecurity regulatory compliance mandates.
Eliminate misconfigurations and policy violations.
Prevent business disruption by outsourcing MDR.
Meet insurability requirements with MDR.
Defend brute force attacks, active intrusions and unauthorized scans.
Safeguard endpoints 24/7 by isolating and mediating threats to prevent lateral spread.
Enhance investigation and threat detection across multi-cloud or hybrid environments.
Remediate critical misconfigurations, security vulnerabilities and policy violations across cloud and containerized environments.
Detect malicious insider and identity-based behavior leveraging machine learning models.
THE THREAT eSentire is aware of widespread exploitation attempts targeting the recently disclosed ownCloud vulnerability CVE-2023-49103. CVE-2023-49103 (CVSS: 10) is tracked as a disclosure of… READ NOW
Our Threat Response Unit (TRU) publishes security advisories, blogs, reports, industry publications and webinars based on its original research and the insights driven through proactive threat hunts.
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 2000+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company's mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Waterloo, ON and GITEX GLOBAL 2023, Dubai, UAE – October 18, 2023 – eSentire, Inc., the Authority in Managed Detection and Response (MDR), today announced that Inspira Enterprise Inc, (Inspira), a… READ NOW
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
We believe a multi-signal approach is paramount to protecting your complete attack surface. See why eSentire MDR means multi-signal telemetry and complete response.
See how our 24/7 SOC Cyber Analysts and Elite Threat Hunters stop even the most advanced cyberattacks before they disrupt your business.
Choose the right mix of Managed Detection and Response, Exposure Management, and Incident Response services to strengthen your cyber resilience.
Try our interactive tools including the MITRE ATT&CK Tool, the SOC Pricing Calculator, the Cybersecurity Maturity Assessment, and our MDR ROI Calculator.
Read the latest security advisories, blogs, reports, industry publications and webinars published by eSentire's Threat Response Unit (TRU).
See why 2000+ organizations count on eSentire to build resilience and prevent business disruption.
Wikipedia tells us that “A naming ceremony is an event at which a person or persons is officially assigned a name. The methods of the practice differ over cultures and religions. The timing at which a name is assigned can vary from some days after birth to several months or many years.”
BY Eldon Sprickerhoff
September 24, 2020 | 5 MINS READ
Managed Detection and Response (MDR) didn’t get a traditional naming ceremony; instead, the term was etched forever into the cybersecurity landscape (and security budgets) when Gartner published its first annual Market Guide to Managed Detection and Response in May 2016. And just last month, Gartner released the fifth edition of this guide.
However, at eSentire, managed detection and response functionally existed well before 2016 … we just called it something different. As eSentire’s founder, I’m proud that our company is known today as the creator and world leader of MDR. And, as MDR celebrates its fifth official industry “birthday,” this series takes a look at the past, present and future of the category as it becomes the service of choice within the cybersecurity industry.
In the late 1990s and at the turn of the millennium, the beginnings of eSentire took shape. I was working in New York managing security for clients in the financial services sector. Typically, this entailed installing, configuring and managing firewalls, performing vulnerability assessments and penetration testing and similar activities.
After the terrorist attacks of 9/11, I came home to Ontario—just as the global recession was getting into full-swing. Information security (infosec) was all I knew, so I set up shop in November 2001, joined by a business partner and my wife, Carole. We called the company eSentire, from the Latin root for “Sentry,” and used the “lowercase e” because that was practically required by law in those days if you worked in technology.
We quickly realized we could achieve our goals—helping customers harden their security posture to prevent breaches—more effectively if we could see their actual network traffic, so we began delivering to our customers a hand-built, customized piece of equipment to give us those insights.
Sometimes, during the course of assessing and configuring a customer’s defenses, we would have the fortunate timing of actually seeing threat actors attempt an attack. And so we would immediately alert.
It didn’t take long before customers started asking us to leave the little network device installed, as part of their defense layers. Who were we to argue with them?! We started charging a service fee and all of a sudden we were providing security analysis as an ongoing managed service, in addition to our up-front consulting.
We needed a name for what we were doing and the two that we used most often were “Collaborative Threat Management” and “Embedded Incident Response.” (Today, I’m quick to concede that neither is as catchy or as accurate and precise as MDR.)
I often get asked what made us different or what gap were we trying to fill all those years ago? Was it that we were providing security-as-a-service at a time when most companies were sourcing, installing and managing solutions on their own? While the service aspect contributed to our success, in my view the major point of value was that we were filling a visibility gap—and we filled that gap in a couple of ways.
First, 20 years ago people were aggregating and looking at logs, it was like managed SIEM. But for what we were trying to do—provide real-time defense against very motivated attackers—logs were so high up, and the information they provided was so coarse, that they were at best supplemental.
What we needed more was that visibility into and analysis of network traffic. So we built up modules to do just that. Then, as instrumentation and telemetry from endpoint devices improved, we gained even more insights.
By consuming and analyzing information from multiple sources—network and endpoints, supplemented by logs—we gained a much more precise, accurate and actionable picture of the threats against our clients, which meant we could provide them with much better visibility into these threats than they had ever before experienced.
But we went further.
I’ll illustrate with an example.
I remember we had a client, who had a standalone IDS (intrusion detection system) in place. And one Christmas there was an exploit where your machines could get infected just by opening a JPEG. Needless to say, this exploit proved popular with attackers; security companies scrambled to respond and pretty soon there were something like 50 signatures. Unfortunately, these signatures also caused lots of false positives—not quite every single time someone opened a JPEG, but not too far off.
The IT person managing this IDS at our client told me, “I get all of these alerts and I don’t know what to do with them. I don’t mind getting a real alert, but the false positives are killing me.”
And because the IDS didn’t capture any traffic beyond the single packet that matched the signature, he was unable to dig in. Our little network device provided an answer by letting him look deeper into the full packet flow of the conversation to distinguish between the accurate alerts that needed an immediate response and those that were just someone opening up a Christmas card.
Another thing we realized was that it didn’t do much good just to overwhelm someone with alerts. If they don’t have the resources or expertise to analyze the alerts and (when needed) to take action, then what’s the point?
So we evolved our model beyond what other security service providers were doing. Where managed security service providers (MSSPs) would wait for the customer to say, “I’d like you to look into ‘Alert X,’” we actually proactively performed investigations using high-fidelity data we had collected ... and we took action on behalf of our clients to defend them against attacks as those attacks unfolded.
Then we would send them a report that said, “Here’s what we did and here’s why we did it,” which we supported with the telemetry we had gathered and the analysis we had performed.
Needless to say, this new model proved popular and it separated us from the managed security service providers (MSSPs).
We knew that what we were doing was different, but we were really just a handful of infosec nerds working to protect our clients—we didn’t realize at the time that we were leading a cybersecurity revolution.
Eldon Sprickerhoff is the original pioneer and inventor of what is now referred to as Managed Detection and Response (MDR). In founding eSentire, he responded to the incipient yet rapidly growing demand for a more proactive approach to preventing and investigating information security breaches. Now with over 20 years of tactical experience, Eldon is acknowledged as a subject matter expert in information security analysis. Eldon holds a Bachelor of Mathematics, Computer Science degree from the University of Waterloo.