The Promise of XDR for Effective Threat Detection and Response

THE STATE OF CYBERSECURITY OPERATIONS

Threat detection and response is a core responsibility of any cybersecurity team, but many continue to struggle in this area. Beyond the global cybersecurity skills shortage, ESG research points to a range of threat detection and response challenges:

Threat detection efforts are also dependent on a scalable, high performance data pipeline to collect, process, and analyze real-time security data. This includes endpoint data, network data, cloud data, and threat intelligence. Unfortunately, building and managing a scalable security data pipeline isn’t easy. The research reveals that 36% to 38% of respondents reported challenges scaling the data pipeline, integrating threat intelligence with internal security alerts, and filtering through security data to separate signal from noise.

The ESG research paints an alarming picture. For many security teams, threat detection and response isn’t working well, and problems are increasing. Organizations need to think differently with a new approach to tools and processes for threat detection and response or face a future of increasing cyber-risk and frequent security incidents.

Simplifying visualizations of complex attacks across the attack surface. SOC analysts often complain about “swivel chair” management as they are forced to view multiple security dashboards, logs, and reports as part of threat investigations. Survey respondents (42%) believe that XDR would be especially attractive if it could simplify visualization of complex attacks across the attack surface. In other words, they want an XDR interface that lets them monitor and investigate cyber-attack lifecycles as they proceed through the kill chain.

Advanced analytics for detecting modern, sophisticated attacks. Rather than rely on event correlation and discrete machine learning algorithms and other techniques for every security domain (i.e., endpoint, network, etc.), 38% of cybersecurity professionals want XDR solutions offering advanced analytics that can detect modern, sophisticated attacks. In this way, machines can crunch vast amounts of data across control points, detect real cyber-attacks in progress, and present analysts with detailed timelines of the events involved in the attack lifecycle. Armed with this information, security teams can accelerate investigations and incident response.

Automated response capabilities. When threats are detected with a high degree of confidence, 31% of security teams want XDR to take automated responses to block attacks in progress. These automated response actions could include updating endpoint security signatures, blocking a DNS domain, or adding a new firewall rule. The goal? Continually fortify the entire cybersecurity infrastructure—not just individual security domains – at machine speed.

Figure 1. Most Appealing XDR Capabilities

Which of the following XDR capabilities are most appealing to your organization? (Percent of respondents, N=339, three responses accepted)

High fidelity alerts for detection and prioritization. 40% of security operations teams want alerts to be timely and accurate, containing a timeline of details that track the progress of cyber-attacks. These specific facts can then help them prioritize responses, pinpoint the root cause and scope of a cyber-attack, and build a remediation plan for reinforcing applicable security controls.

A central management hub. 38% of security operations analysts want to create and manage security policies, configure security controls, and view security activities through a single interface. By consolidating security controls, XDR can centralize security command and control in this way.

Coverage for a growing attack surface from endpoints through cloud. 37% of security operations analysts want to extend their threat detection and response capabilities across a growing attack surface. This speaks to XDR’s integration and visualization across all control points including endpoints, networks, servers, and cloud workloads. Some XDR offerings will include other controls such as email security, web security, and SaaS security, but the goal remains the same—track malicious/suspicious activities across the entire attack kill chain. This capability can also help align XDR with the MITRE ATT&CK Framework.

Figure 2. XDR Outcomes for Security Efficacy

What XDR outcome would be most important for your organization in terms of security efficacy? (Percent of respondents, N=339, three responses accepted)

Organizations are already moving forward towards XDR. The research reveals that nearly one-quarter (23%) of organizations are already working on an XDR project. These are likely custom integration projects between two controls like EDR and network detection and response (NDR). Additionally, 70% believe they could establish an XDR budget within the next 12 months (see Figure 3). This speaks to the pressing need to improve security efficacy and streamline security operations.

Figure 3. XDR Budget Plans

When could you foresee your organization establishing a formal budget to invest in an XDR solution? (Percent of respondents, N=339)

XDR could replace existing security controls. Nearly half (48%) of organizations would be willing to replace existing controls with XDR while an additional 47% might do so if they were convinced of XDR’s effectiveness. Which controls? The most likely areas are endpoint and network security, but the platform nature of XDR could cause organizations to replace others as well. Interestingly, many organizations may start with cloud-based threat detection and response controls and then build out a more comprehensive XDR architecture from there.

Organizations would be willing to add XDR sensors/agents to their infrastructure. More than three-quarters (76%) of organizations would be willing to add a new sensor or agents if necessary or if XDR could deliver significant benefits. Again, this is indicative of the grave need for security improvement. If organizations need to collect, process, and analyze more data, they are willing to do so to achieve better results.