ArmorPoint is continuing to aggressively expand its cybersecurity capabilities by adding to its partner program and growing the offerings in its Integration Marketplace.
Since the beginning of the year, ArmorPoint has partnered with cybersecurity
vendors and channel players such as SentinelOne, IT managed services provider
Sagin, and MSP
Castle Technology Partners, with some of those partners’ technologies ending up in the Integration Marketplace. The company also joined other big-name IT players in the online marketplace, such as top cloud providers
Amazon Web Services (AWS),
Microsoft Azure, and
Google Cloud Platform, including security vendors like
Darktrace,
CrowdStrike and
Proofpoint, and infrastructure players such as
Cisco Systems.
This month, the Phoenix-based MSSP added
Fortinet’s FortiEDR endpoint detection and response tool and
QuickLaunch’s access and identity management (IAM) capabilities.
It’s all part of ArmorPoint’s efforts to build a comprehensive and unified cybersecurity platform for organizations, according to the company’s CISO, Jacob Johnson.
“The addition of QuickLaunch and FortiEDR fits directly into this strategy as it addresses two of the most critical and fast-growing attack vectors: identity-based threats and endpoint vulnerabilities,” Johnson told MSSP Alert.
Having QuickLaunch’s IAM events in ArmorPoint's platform is critical to strengthening protections against insider threats and credential theft, he said, adding that it “provides centralized visibility into who is accessing resources, when, and why, allowing security teams to monitor authentication patterns and detect suspicious login activity in real-time.”
Identity Under Threat
The integration with QuickLaunch comes as threats to identity – like phishing, credential stuffing, and multifactor authentication (MFA) bypass – continue to be key concerns in cybersecurity.
“Some reasons why identity attacks are on the rise are the use of adversarial AI, companies moving to cloud-based identity providers, and the adoption of more SaaS applications,” CrowdStrike
wrote earlier this year, noting that five out of the top 10 MITRE ATT&CK tactics are identity-based.
Before the QuickLaunch integration, ArmorPoint relied on other data sources and its managed SOC to detect identity-related suspicious activity, including analyzing logs from firewalls and endpoint devices, Johnson said.
'A Game-Changer'
“The addition of QuickLaunch is a game-changer because it provides a dedicated and deep layer of identity and access management data,” he said. “It provides real-time identity visibility by directly pulling IAM events into the SOC workflow, allowing for the more effective detection of identity-based threats like credential stuffing and brute-force attacks.”
The integration correlates identity data with other security information to give analysts a deeper understanding of an incident, and the centralized insights and audit logs QuickLauch delivers helps organizations show compliance with regulations that demand the tracking and monitoring user access, he added.
With FortiEDR, ArmorPoint can extend its managed detection and response [MDR] capabilities so that analysts can correlate endpoint alerts and behavioral telemetry along with broad security operations center (SOC) activity.
Platforming Cybersecurity
The FortiEDR and QuickLaunch integrations also dovetail with the ongoing platforming trend in the cybersecurity space, moving away from integrating and managing multiple and disparate security tools, a push fueled by complex threats, lack of integration between point solutions, and the ongoing talent shortage in cybersecurity.
“For corporate security teams, a platform approach simplifies their operations by consolidating various functions into a single, cohesive ecosystem, which reduces ‘alert fatigue’ and improves efficiency,” Johnson said. “For MSSPs, it's essential for scalability and efficiency, enabling them to provide a comprehensive and consistent security service to a wide range of clients without the complexity of managing a different set of tools for each customer.”
From Tech Providers to Strategic Partners
It also supports the changing nature of MSSPs and MSPs with security services, which are growing from being security technology providers to customers into strategic partners, another trend driven by the ongoing complexity and severity of cyberthreats. Organizations – and SMBs in particular – don’t have the expertise to build a modern cybersecurity program and are now turning to external partners for more than just basic security services, he said.
The shift puts pressure on MSSPs to ensure they have complete services portfolios to address the broadening needs of their customers.
Organizations “need partners who can act as strategic advisors by helping them build a long-term cybersecurity strategy and mature their security posture,” Johnson said. “The focus has moved from reactive ‘break-fix’ models to proactive services like 24/7 threat monitoring and threat hunting. Clients are looking for a single partner who can manage a wide array of security needs, from endpoint protection and identity management to compliance reporting and incident response.”
Cybersecurity is no longer simply an IT problem, he said, adding that “it's a business risk, and organizations are increasingly looking for partners who can help them navigate this risk and build cyber resilience.”
