Know the Right Answers to Your MDR Provider Questions

Organizations are at different stages of the cybersecurity maturity journey. Your organization may already have tools and teams in place or may be newly starting the trek. Either way, technology plays an important role in keeping your data and customers safe from cyber threats.

Can I keep my current technology or do I need to use yours?

You shouldn’t have to throw out your existing tools or be locked into only one approach. After all, you spent good money on the technology you currently have. A modern MDR provider should build on the technology you have and bring any additional technology you need.

The provider should integrate your existing infrastructure and controls into its monitoring and response platform.

What technology do you use to provide the MDR solution?

You want to know that the MDR provider offers more than management of alerts and firewalls using an outdated SIEM architecture and approach.

Modern MDR providers should be equipped with tools to combat today’s cybercriminals. Some of these advanced tools include a cloud-based monitoring and response platform, machine learning-supported analysis and detection solutions, and advanced endpoint detection and response tools.

Can you provide the visibility I need for my logs, endpoints, network, and cloud?

For visibility, an MDR provider with superior detection capabilities should have a broad and deep view into your systems and resources, including logs, endpoints, networks, and the cloud. The provider’s visibility should support advanced detection, not just rule-based detection. In addition, you want to know that the provider offers fine-grained visibility, meaning the ability to control who has access to specific data under specific criteria. Ideally, your provider should offer complete access to your log data to members of your organization.

Your organization may not need all of this visibility now, but you want to know that the provider can continue to support you as your cybersecurity needs evolve.

Will I have the same access to my data as you do?

When you use MDR services to protect against cyberattacks, the technology burden shifts from your cybersecurity team to the provider’s team.

Yet, your in-house team should still have access to the same technology as the provider, and you should retain access to your data at all times.

How are you planning to evolve your operation to combat new threats?

Cybercriminals constantly find novel ways to attack organizations. To combat these new threats, an MDR provider must evolve its technology and processes as the threat landscape evolves. Make sure the provider has a plan for staying ahead of cybercriminals and can talk about investments it has made to keep pace. You want to know that the provider will evolve as your organization’s cybersecurity needs mature.

Modern MDR providers know that human attackers must be confronted by human defenders. Without experienced cyber professionals on your team to leverage security tools, attackers will work around your defenses.

Unfortunately, there’s a global cybersecurity talent shortage, making it difficult for organizations to hire and retain employees. A recent Forrester Consulting study found that 53% of small and midsize businesses rely on external partners such as MDR providers to fill the talent gaps and keep their security operations centers (SOCs) up and running. The solution may be a good one for your business as well.

Does the provider have people on staff 24/7?

Cybercriminals work around-the-clock, and your MDR provider should too. The right MDR provider for your organization will be staffed 24/7 with seasoned cybersecurity professionals.

How is the provider recruiting, developing, and retaining talent?

The MDR provider should be able to communicate its strategy for hiring, training, and keeping talent. The provider should be comfortable discussing the current employee retention rate and specifically where it is focusing its efforts. You want to know that the provider carries the responsibility for recruiting, developing, and retaining talent.

How experienced are the people supporting your team?

People are the foundation of a good security program. If you don’t have experienced security staff in your organization to leverage security tools, attackers will not have much trouble penetrating your network. You want an MDR provider that is fully staffed and has senior-level people on your team with a long track record with the company. Look for a provider that values its employees and has a supportive mentoring program where the young professionals have access to the senior-level people. With the talent shortage, make sure the provider’s staff is not stretched thin and avoid any provider with a revolving door of employees.

What levels of expertise does the provider’s SOC team have?

The MDR provider should have talented professionals at all levels, from executives to senior level to entry level. The provider should be fully staffed with seasoned analysts, threat hunters, incident responders, forensic and malware specialists, and other security experts. In addition, if your organization needs a chief information security officer (CISO) to meet compliance requirements, the provider should be able to act as a virtual CISO for your organization.

How will the provider’s team work with my internal team?

A quality MDR provider integrates with your existing tools and fits with the people and policies of your organization. The provider’s security professionals should be readily accessible to your team to answer any questions and participate in conversations about the cybersecurity program 24/7. The provider should allow you to retain full access to your data and be transparent about the activity of the team.

Is threat hunting included with the MDR service?

You may expect threat hunting to be a basic MDR service, but many MDR providers only offer threat hunting as an add-on service. Be sure threat hunting is included in your package before moving forward with any MDR provider.

One cybersecurity package does not fit every business, so modern MDR providers need to allow for flexibility in their solutions. Most providers offer services that are customized to your organization’s specific industry and operational needs, but not all MDR providers do so. Look for an MDR provider that offers services and pricing tailored to your exact business needs.

Do I need to buy a full package of solutions?

You’ll want to know whether the provider will customize its package of services for your organization and, if so, what the package includes and at what cost. Ideally, an MDR provider should tailor a customized package of security services to meet your specific needs across multiple vectors, including endpoints, networks, logs, and the cloud. The provider should understand what cyber risks your organization faces, what existing technology systems and controls you have in place, and what your budget is. Then, the provider can customize a right-sized solution that works for your organization.

Can you tailor the services I need now and let me add more services as needed in the future?

An MDR provider should meet you where you are in your cybersecurity journey and customize solutions for your specific business needs. As your cybersecurity needs mature over time, you and the provider should work together to scale up (or down) the services you need to keep your business safe from an attack and in compliance.

How do you price your services?

Most likely, your organization has an allocated cybersecurity budget that you want to invest as wisely and cost effectively as possible. Using an MDR provider can be a more economical option than hiring a full security team and purchasing the technology tools needed to make it work. An MDR provider should never ask you to agree to or pay for more security services than you actually need. Many offer bundled services with few options for customization. This may be more than your organization needs or can afford. The provider should work closely with your organization to offer only the expertise and tools needed to protect your data from cyber threats.