When it comes to managed detection and response (MDR) services, I'm starting to hear the same pressing question over and over again: Who actually owns the R? In other words, who exactly is responsible for each component of a response?Over the past few weeks, the chatter surfaced in separate emails and individual MSSP Alert conversations with:Still, the "Who owns response?" conversation stretches back further than that. At the Right of Boom conference in February 2022, JupiterOne CISO and head of research Sounil Yu described a world where people remain heavily involved in response and recovery services. The obvious question that MSSPs and end-customers need to address: Whose people?Still, actual MDR services -- particularly the response stage of the services -- vary widely from one company to the next.Similarly, Rapid7 is banging the drum for digital forensics and incident response capabilities as differentiators in the MSSP, MSP and MDR markets.
- Jake Godgart, product marketing, managed services at Rapid7;
- Erin McLean, chief marketing officer at eSentire, a leading MDR service provider;
- Jen Olmsted, founder, Cytrex Cyber; and
- Jeff Schmidt, CEO, Avertium, a Top 250 MSSP.
MDR Security Services: Widespread Adoption
The question -- "Who owns response?" -- is particularly important amid the spread of MDR services. Indeed:- MDR now ranks among the core eight managed security services typically offered by MSSPs, according to Gartner.
- Hundreds -- perhaps thousands -- of companies now claim to offer MDR services. The MDR proponents include cybersecurity software companies, pure-play MDR businesses, MSSPs, and MSPs that are white labeling third-party services.
- Fully 91% of MSSP 250 survey participants for 2021 indicated that their companies offer MDR capabilities.
MDR Security: What Are 'Response' Services?
Amid that backdrop, eSentire divides the MDR discussion into this spectrum:- Detection: Actually spotting a threat to a business;
- Response: Containing that threat;
- Remediation: Making sure the adversary is removed from the system for good; and
- Digital forensics with incident response: Performing digital forensics, analysis, crime scene reconstruction, eDiscovery and more.
