The EDR Evolution

There is no shortage of security solutions available to Managed Service Providers (MSPs). While finding vendors to fill your security stack is, in and of itself, not a difficult endeavor, making the individual selections can be time-consuming. The options are endless, the promises are comparable, and the technical capabilities are vague.

One such solution you may be considering is called Endpoint Detection and Response (EDR). EDRs:

• Monitor activity on endpoint devices (think computers, servers, and IoT devices),
• Provide alerts on and isolate threats, and
• Retain information on threat behavior, root-cause analysis, etc.

More specifically, EDRs are programmed to detect malware and malicious activity on endpoints. These solutions are built with the signature-based detection engine of an antivirus (AV) and include machine learning (ML) to capture malicious behavior, which is an essential part of your security posture in malware detections.

Where these solutions fall short is in detecting tradecraft—techniques used by adversaries to evade companies’ cybersecurity efforts. They disguise their behavior as administrative activity by maliciously using IT tools and executions native to operating systems. When this behavior is performed, EDRs typically fail to detect it, as they cannot distinguish these actions from that of an IT admin moving within a network.

Another solution available to MSPs is called Managed Detection and Response (MDR). MDRs:

• Provide 24/7 continuous monitoring performed by highly specialized security analysts,
• Act with immediate response prior to lateral spread, and
• Eliminate alert fatigue and false positives.

At Blackpoint, we built our MDR from the ground up, in-house. It is particularly focused on detecting adversaries while in discovery and enumeration mode within a network. With this powerful technology, our 24/7 Security Operations Center (SOC) team has visibility into tradecraft techniques and is therefore able to remove these adversaries from the network within the first stages of a breach before malware is installed. Their intervention steps are based on the context of the activity, rather than relying on ML. Being able to make calls in this fashion results in earlier breach detection, rapid removal of the adversary, and a low false positive rate.

Another element that allows our MDR to detect this tradecraft activity earlier and more accurately is that our technology is built with machine-to-machine understanding, whereas an EDR comprehends activity on isolated endpoints. Our machine-to-machine understanding, and patented live network map, gives us the ability to understand the network holistically based on behavior between all endpoints. This provides us with the context and visibility to track hackers’ movements and communication through an entire network, leading to the fastest response and highest efficacy rate in the market.

All that to say, we are not here to simply bash EDRs and promote our MDR. Antivirus and EDR solutions are a prominent and essential feature of our partners’ security stacks. That said, they cannot be the sole solution you rely upon. With more and more adversaries abusing trusted IT tools, as seen here, next-level protection is critical to withstanding advanced cyberthreats. That is why, instead of forcing our partners to make a shift in their stack’s formation, we come alongside their other solutions and complement their efforts with our 24/7 capabilities.

Blackpoint integrates with many of the leading EDR solutions in the space through our offering, Managed EDR. While EDRs provide malware detection through their AV engine, we provide 24/7 response for your EDR alerts through our expert-led SOC team. Just as you shouldn’t solely rely on your EDR, we don’t solely rely on it for threat detection. Rather, it serves as additional coverage for your protection.

In 2022, our SOC found that in environments with an integrated AV/EDR, 86% of their responses involved no alerts from the integrated tool. These solutions aren’t comprehensive and would have likely alerted the threat further down the attack chain once malware was in use. In that case, the impact of the breach would be higher.

If you’re ready to provide backup for your EDR and stand firm against innovative threat actors, set up Managed EDR with your preferred endpoint security solution today. We currently integrate with:

• Bitdefender
• CrowdStrike
• Cylance
• Malwarebytes
• Microsoft Defender for Endpoint
• SentinelOne
• Sophos

Blackpoint Cyber takes integrating with your preferred third-party endpoint security solution a step further, providing you with a robust, streamlined cybersecurity ecosystem. In addition to visibility, the Blackpoint SOC quickly and effectively remediates attacks by acting upon alerts on your behalf. Enhance your overall posture and drive operational efficiency through the power of Managed EDR.

Book a Demo Today