Extended detection and response, or XDR, is one of the fastest-growing areas of cybersecurity. As organizations continue to embrace digital transformation, they also need to add more advanced cybersecurity solutions that can quickly tackle today’s threats and ingest telemetry from their expanded attack surface — and that means more than just endpoints. That includes cloud, networks, OT, and email systems, to name just a few.
Data from all these systems is correlated and analyzed, resulting alerts are prioritized, and ultimately, this analysis enables rapid automated or human response. And that’s important, because we’re learning that the majority of security events are now happening outside of endpoints. A 2022 analysis of customer data by Secureworks found that 60% of alerts generated in its XDR platform came from non-endpoint sources. Maybe that is why, according to Gartner, 40% of organizations will have deployed an XDR platform by 2027.
But not all XDR solutions are the same. One of the first differences organizations will find when researching a new solution is open XDR versus native (or closed) XDR. The distinction between these two broad categories of XDR is significant and will influence not just initial rollout, but also how your organization may approach cybersecurity in the future. So how do you know which one is right for your organization and goals? Let’s define these terms and take a look at the pros and cons of each approach.
Open XDR
The “open” in open XDR refers to its ability to easily integrate with third-party solutions especially those that your organization may already have invested in. Open XDR platforms can ingest telemetry from a variety of sources, allowing organizations to use their preferred security technology and bring telemetry into a single platform for data correlation, threat detection and timely response.
Pros
- Organizations can keep their current technology investments while still adding in the benefits of an XDR platform. There’s no need to rip and replace existing solutions.
- Organizations have the ability to take a best-of-breed approach to choosing technologies, both now and in the future. There is no vendor lock-in which future proofs the solution.
Cons
- Only as good as its integrations. That’s why it is important to choose an open XDR vendor with an extensive library of playbooks and integrations that can be used right out of the box. Even better, look for one that also offers custom automations and integrations to make sure it can be tailored to fit your unique ecosystem and needs.
Native XDR
A native XDR solution is an all-in-one platform from a single vendor. The solution is designed to integrate with that specific vendor’s other security tools for what is perceived to be most critical sources of data, such as endpoint, network and cloud.
Pros
- Faster time to deploy, especially if an organization is already using that vendor’s tools. An existing working relationship can also make the buying process easier.
- Streamlined approach. Having one vendor can simplify configurations and troubleshooting.
Cons
- Vendor lock-in. If you become unhappy with some aspect of the solution, you may be stuck with it because the cost to switch vendors can make it overly burdensome to do so.
- A one-solution approach may not be able to provide all the telemetry and data your team needs, creating security gaps if you aren’t able to ingest from other tools.
Choosing the Right Solution
It’s important to lay out both your long-term goals and your short-term goals when choosing an XDR platform. Many organizations begin looking at XDR because they want to modernize their cybersecurity in the face of new, advanced threats. This may lead some to prioritize time-to-value, but it’s important to not lose sight of how you want your cybersecurity to mature in the future.
Do you want to keep your security team small and efficient? Do you want to work with a partner to manage the platform for you? Will you need the ability to scale your security operations and tools as the organization grows? If you’re a CISO, what is your ultimate vision for your security operations? How you answer these questions may lead you down one path or the other, or to one vendor over another.
Overall, cybersecurity experts seem to be leaning toward open XDR as the preferred platform. As reported in the Wall Street Journal, more than three-quarters of cybersecurity professionals want their vendors to deliver open, interoperable solutions. For many organizations, it often makes both security and business sense to have an open platform that allows you to choose the tools you want and take advantage of existing investments. For others, the streamlined nature of a native XDR may be preferrable.
Don’t neglect the fact that whether it’s an open or native XDR, you are also choosing a partner to help you in your fight against the adversary. It’s a critical time for many organizations as the confluence of advanced threats, expanding IT stacks and a shortage of skilled cybersecurity professionals makes addressing risk an urgent matter. You will want to make sure you are choosing a partner in that fight who has the technology, knowledge and transparency you need to meet your goals by keeping their solution future proof and ahead of the evolving cyber threats.
By Steve Snyder, Director of Portfolio Marketing at Secureworks