Choosing the Right MXDR Vendor

XDR brings teams newfound levels of coordination across threat detection, vulnerability scanning, endpoint protection and more. But administrators must understand that XDR is not simply a plug-and-play solution. Since XDR is essentially an orchestration layer for a much broader set of tools that serve various functions and may come from multiple vendors, the choice of an IT partner for a managed XDR (MXDR) engagement is just as important as the decision to go with XDR in the first place.

Key Criteria for MXDR Vendor Selection

The power of XDR lies in its ability to orchestrate a wide range of tools from multiple vendors into a cohesive security operations system for stronger cyber threat detection and protection. But this expanded arsenal of capabilities raises the stakes for organizations to find an IT partner with the right blend of cross-disciplinary skills and domain expertise to manage the XDR deployment. Otherwise, it’s like having a Formula One race car without an experienced driver at the wheel.

What qualifications should the ideal MXDR vendor have? For starters, remember that MXDR is cross-technology and cross-disciplinary, so you don’t want to choose an MXDR vendor who doesn’t already own the tools and possess the expertise in the underlying set of technology solutions and capabilities that MXDR encompasses.

From there, the focus shifts to the quality of the quality of threat intelligence and how familiar the MXDR partner is with how these threats play out specifically in financial sector organizations. The right vendor should have an in-depth knowledge of the MITRE ATT&CK® Matrix and other threat intelligence resources – together with highly-specific knowledge of the financial sector’s most critical and current cyber threats – in order to develop a unique risk profile for the organization. This helps set the stage for an active partnership between the client and its MXDR partner to get the most out of the XDR investment.

The MXDR Partnership in Action

Let’s take a closer look specifically at threat assessment and penetration testing to see how a financial firm’s choice of MXDR partner makes all the difference in putting XDR capabilities to optimal use in the enterprise. The MXDR partner should have the advanced threat intelligence, domain expertise and coding acumen to pursue adversary-based detection – prioritizing writing and detection rules for the threats that are most likely to target the organization.

This is not as easy as it may sound. Not only are the threats changing, but software tools are constantly being upgraded as well. That’s why the right MXDR vendor will have superior staffing and skill sets in infrastructure engineering, systems architecture, device configuration and data management to continually customize and improve the XDR deployment around threat detection and mitigation.

The ideal MXDR partner’s combination of advanced threat intelligence and deep familiarity with multiple tools also makes for better penetration testing. The right MXDR can help organizations go beyond occasional red and blue team exercises and instead conduct more dynamic and frequent “purple team” exercises – which can happen multiple times a month and bring senior blue and red team officials together for iterative exercises to continually test and refine security.

MXDR enables effective purple teaming by providing more system control, coding support and behavioral insights on the latest attack patterns. The red team group in this scenario can use MXDR to access the latest intelligence streams, including specific examples of malicious code that the red team can then use to run more convincing mock “attacks” on a targeted enterprise system. And the blue teamers use these same insights to configure alerts and make detection rules easier to write and apply across all logs and endpoints.

Throughout this and many other examples, the right MXDR partner can leverage an XDR platform’s massive datasets and historical logs to look back in time for lessons learned about previous threats and how the organization dealt with them. These insights from a seasoned MXDR team analyzing a trove of XDR historical data, will further augment the cyber protections organizations enjoy when they choose the right MXDR partner to enhance the value of the XDR investment.