What We Do
How we do it
Oct 18, 2021
Grief Ransomware Gang Claims 41 New Victims, Targeting Manufacturers; Municipalities; & Service Companies in U.K. & Europe
Grief Operators Earned an Estimated 8.5 Million British Pounds in Four Months Key Findings: The Grief Ransomware Gang (a rebrand of the DoppelPaymer Ransomware Group) claims to have infected 41 new victims between May 27, 2021—Oct. 1, 2021 with their ransomware.Over half the companies listed on Grief’s underground leak site are based in the U.K. and Europe. The Grief Ransomware Gang appears to…
Read More
View all Advisories →
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 1000+ organizations in 70+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
Oct 12, 2021
eSentire Launches MDR with Microsoft Azure Sentinel Extending Response Capabilities Across Entire Microsoft Security Ecosystem
Waterloo, ON – Oct. 12, 2021 -- eSentire, recognized globally as the Authority in Managed Detection and Response (MDR), today announced the expansion of its award-winning MDR services with Microsoft Azure Sentinel, as part of its integration with the complete Microsoft 365 Defender and Azure Defender product suites supporting Microsoft SIEM, endpoint, identity, email and cloud security services.…
Read More
Our award-winning partner program offers financial rewards, sales and marketing tools and personalized training. Accelerate your business and grow your revenue by offering our world-class Managed Detection and Response (MDR) services.
Learn about our Partner Program
Apply today to partner with the Authority in Managed Detection and Response.
Login to the Partner Portal for resources and content for current partners.
Blog — Sep 24, 2020

The Untold History of Managed Detection and Response Part I: “Collaborative Threat Management” and “Embedded Incident Response”

Wikipedia tells us that “A naming ceremony is an event at which a person or persons is officially assigned a name. The methods of the practice differ over cultures and religions. The timing at which a name is assigned can vary from some days after birth to several months or many years.”

Managed Detection and Response (MDR) didn’t get a traditional naming ceremony; instead, the term was etched forever into the cybersecurity landscape (and security budgets) when Gartner published its first annual Market Guide to Managed Detection and Response in May 2016. And just last month, Gartner released the fifth edition of this guide.

However, at eSentire, managed detection and response functionally existed well before 2016 … we just called it something different. As eSentire’s founder, I’m proud that our company is known today as the creator and world leader of MDR. And, as MDR celebrates its fifth official industry “birthday,” this series takes a look at the past, present and future of the category as it becomes the service of choice within the cybersecurity industry.


In the late 1990s and at the turn of the millennium, the beginnings of eSentire took shape. I was working in New York managing security for clients in the financial services sector. Typically, this entailed installing, configuring and managing firewalls, performing vulnerability assessments and penetration testing and similar activities.

After the terrorist attacks of 9/11, I came home to Ontario—just as the global recession was getting into full-swing. Information security (infosec) was all I knew, so I set up shop in November 2001, joined by a business partner and my wife, Carole. We called the company eSentire, from the Latin root for “Sentry,” and used the “lowercase e” because that was practically required by law in those days if you worked in technology.

We quickly realized we could achieve our goals—helping customers harden their security posture to prevent breaches—more effectively if we could see their actual network traffic, so we began delivering to our customers a hand-built, customized piece of equipment to give us those insights.

Sometimes, during the course of assessing and configuring a customer’s defenses, we would have the fortunate timing of actually seeing threat actors attempt an attack. And so we would immediately alert.

It didn’t take long before customers started asking us to leave the little network device installed, as part of their defense layers. Who were we to argue with them?! We started charging a service fee and all of a sudden we were providing security analysis as an ongoing managed service, in addition to our up-front consulting.

We needed a name for what we were doing and the two that we used most often were “Collaborative Threat Management” and “Embedded Incident Response.” (Today, I’m quick to concede that neither is as catchy or as accurate and precise as MDR.)

Filling a visibility gap

I often get asked what made us different or what gap were we trying to fill all those years ago? Was it that we were providing security-as-a-service at a time when most companies were sourcing, installing and managing solutions on their own? While the service aspect contributed to our success, in my view the major point of value was that we were filling a visibility gap—and we filled that gap in a couple of ways.

First, 20 years ago people were aggregating and looking at logs, it was like managed SIEM. But for what we were trying to do—provide real-time defense against very motivated attackers—logs were so high up, and the information they provided was so coarse, that they were at best supplemental.

What we needed more was that visibility into and analysis of network traffic. So we built up modules to do just that. Then, as instrumentation and telemetry from endpoint devices improved, we gained even more insights.

By consuming and analyzing information from multiple sources—network and endpoints, supplemented by logs—we gained a much more precise, accurate and actionable picture of the threats against our clients, which meant we could provide them with much better visibility into these threats than they had ever before experienced.

But we went further.

I’ll illustrate with an example.

I remember we had a client, who had a standalone IDS (intrusion detection system) in place. And one Christmas there was an exploit where your machines could get infected just by opening a JPEG. Needless to say, this exploit proved popular with attackers; security companies scrambled to respond and pretty soon there were something like 50 signatures. Unfortunately, these signatures also caused lots of false positives—not quite every single time someone opened a JPEG, but not too far off.

The IT person managing this IDS at our client told me, “I get all of these alerts and I don’t know what to do with them. I don’t mind getting a real alert, but the false positives are killing me.”

And because the IDS didn’t capture any traffic beyond the single packet that matched the signature, he was unable to dig in. Our little network device provided an answer by letting him look deeper into the full packet flow of the conversation to distinguish between the accurate alerts that needed an immediate response and those that were just someone opening up a Christmas card.

From alerts to action

Another thing we realized was that it didn’t do much good just to overwhelm someone with alerts. If they don’t have the resources or expertise to analyze the alerts and (when needed) to take action, then what’s the point?

So we evolved our model beyond what other security service providers were doing. Where managed security service providers (MSSPs) would wait for the customer to say, “I’d like you to look into ‘Alert X,’” we actually proactively performed investigations using high-fidelity data we had collected ... and we took action on behalf of our clients to defend them against attacks as those attacks unfolded.

Then we would send them a report that said, “Here’s what we did and here’s why we did it,” which we supported with the telemetry we had gathered and the analysis we had performed.

Needless to say, this new model proved popular and it separated us from the managed security service providers (MSSPs).

We knew that what we were doing was different, but we were really just a handful of infosec nerds working to protect our clients—we didn’t realize at the time that we were leading a cybersecurity revolution.

Eldon Sprickerhoff
Eldon Sprickerhoff Founder and Chief Innovation Officer

In founding eSentire, Eldon Sprickerhoff responded to the incipient yet rapidly growing demand for a more proactive approach to preventing and investigating information security breaches. Now with over twenty years of tactical experience, he is acknowledged as a subject matter expert in information security analysis.