No two organizations are precisely alike when it comes to cybersecurity. Every organization has its own unique infrastructure and its unique business risks.
Since no two organizations are the same, neither can their overall cyber defense strategy. Some of the fastest growing security investments today are in endpoint detection and response (EDR), extended detection and response (XDR), and managed detection and response (MDR).
For perspective, according to Gartner, by 2025, 50% of organizations will be using MDR services for threat monitoring, detection and response functions that offer threat containment and mitigation capabilities. And, in a recent Forrester study, 60% of security professionals surveyed said they plan to either start investing or expand their investment in XDR. While each of these 3 letter acronyms have “detection and response” in them, they are very different. For example, EDR is focused only on analyzing threat data at the endpoint. XDR focuses beyond the endpoint by analyzing threat data across endpoint, cloud, network and other business applications. MDR is different in that it can pull and analyze threat data from a variety of telemetry sources, depending on the solution, but is fully managed by a 3rd party to offer 24×7 security monitoring.
The choice of EDR vs. XDR vs. MDR is not always an either-or decision. A lot of what is best for an organization will depend on their internal team and resources as well as the security outcomes one will want to drive. You need to consider the following:
- Size and complexity of your IT infrastructure
- Regulatory mandates and consequences for non-compliance in your industry
- Current maturity of cyber defense systems today and plans for the future
- Locations of your security team and ability to support 24×7 coverage
- Use of contractors and subcontractors
- Ability to attract and retain skilled cybersecurity professionals
- Ability to obtain cyber insurance – and maintain at lowest rate possible
- Institutional risk tolerance
EDR, XDR, and MDR solutions are not always independent of one another, and some vendors offer more than one option or all three options. For example, not all XDR vendors will have a native endpoint agent. But if you want to have full visibility of your IT landscape, you will still need endpoint coverage. And not all endpoint vendors provide XDR that combines telemetry into a single view.
Given these individual characteristics, the following chart offers useful generalized guidance about EDR vs. XDR vs. MDR.
| You probably should if you… | You probably shouldn’t if you… | |
|---|---|---|
| EDR |
|
|
| XDR |
|
|
| MDR |
|
|
Additional points you should consider when choosing providers of EDR, XDR, or MDR:
- Threat intelligence matters. The effectiveness of any EDR, XDR, or MDR solution is highly contingent upon the breadth, depth, and freshness of threat intelligence it uses to detect potential markers of malicious activity. Your evaluation of any vendor’s solution should therefore include a rigorous assessment of that vendor’s threat intelligence.
- The false positive problem. Cybersecurity success isn’t just about detecting any threat that might put your organization in jeopardy. It’s also about not generating a lot of false positives that waste time and — perhaps even worse — result in alert fatigue that inhibits your ability to respond to real attacks. When evaluating solutions, it is important to ask the vendor for the average number of investigations they are performing per month with customers? Ask if they can share ratio of events triggered vs. investigations performed vs. true incidents detected. Accuracy is thus as important as sensitivity.
- Responsive personal service. Regardless of which course you choose, responsive service is a must for cybersecurity. After all, when an indication of an attack occurs, you’ll likely need some expert guidance. And you’ll need it immediately, because every minute counts when you’re trying to stop an active invader. It is important to consider the prospective vendor’s service-level assurances. Protip: You may want to pass on any vendor that doesn’t offer live chat with expert cybersecurity support on-demand.
- The bottom line. Don’t assume one solution is more expensive than another. Costs can vary widely among EDR, XDR, and MDR solutions. Focus on your specific needs and consider your current staffing and existing investments, including potential tradeoffs between technologies and cost of in-house vs. outsourced resources. A simple cost analysis may challenge your assumptions.
One more key point: No decision is also a decision. Given how much is riding on your choice of EDR, XDR, or MDR, a natural tendency is to postpone a decision for another month or another quarter. It’s also prudent to delay a decision until you believe you’ve assembled enough information to make the right call.
However, what’s not prudent is to delay too long. Cybercriminals are acting now. Your organization is expanding its digital footprint now. Your employees, contractors, and supply-chain partners are all exposing you to new dangers now. So undue hesitation is not a viable risk-mitigation strategy.
You must act decisively — and soon — to counter the relentless evolution of cyber criminality. That’s what cybersecurity leadership is ultimately all about.
By Steve Snyder, Director of Portfolio Marketing, Secureworks