We have been talking about eXtended Detection and Response (XDR) for some years now, but despite being a buzzword in the industry, a fundamental question remains: what are we really talking about here? According to Gartner, which first defined the term in 2020, XDR is a vendor-specific threat detection and incident response tool that natively integrates multiple security products into a cohesive security operations system.
According to a Mandiant survey of 1,350 global business and IT leaders, when trying to secure their networks against cyber threats, nearly all respondents (96%) believe it’s important to understand the threat actors targeting their organizations. That’s hardly a surprise. But then there’s this finding: 79% of respondents say that most of the time, they make decisions about cyberattacks without insights into who could be targeting their organization.
Cybersecurity automation is a hot topic as organizations wrestle with the challenges of increasing attack volumes, cybersecurity skill shortages, and how to make the best use of limited resources to protect the enterprise. However, when it comes to implementing automation with a target of achieving extended detection and response (XDR), it can be hard to know where to start and how to build a case for investment.
Hybrid working models have increasingly become the normal way of doing business. Employees are working from anywhere, users and their devices are moving on and off the office network, and many applications once hosted in data centers are now moving to public clouds or being replaced with software as a service (SaaS).
XDR (Extended Detection and Response) systems and SIEM (Security Information and Event Management) systems share some similarities, but they are not exactly the same and do not necessarily replace each other. XDR systems are a newer technology that is designed to provide organizations with a more comprehensive view of their security posture by collecting and analyzing data from multiple sources, such as endpoints, networks, and cloud environments.
