MDR Has To Stop Mopping The Floor

A CISO got breached and could not say how. No entry point, no list of what walked out, nothing to take to the board. He paid the ransom blind. Then he bought MDR.

The next time, he had all of it. Who clicked, which data was touched, when it left. He still got breached.

So what did the M in MDR actually buy him?

Lieuwe Jan Koning, Co-founder & CTO at ON2IT, sits down at RSA Conference with Nicholai Piagentini, Technical Enablement Engineer at ON2IT and twenty years deep in the Bay Area security scene, to separate what MDR vendors pitch from what MDR delivers.

Buyers think MDR is one product. It is five jobs: collect the logs, enrich them, put an experienced human in the loop, remediate, and keep it all retrievable. Most vendors do two of them well, and only inside their own stack. Three questions tell you which two. All three are in the episode, and in the description below.

Timestamps

(00:00) - The MDR reality check: expectation versus practice

(01:33) - What buyers think they are buying

(03:35) - Single pane of glass, and why nobody has one

(06:40) - Why no vendor is paid to support a competitor's logs

(07:42) - Log retention: when everything becomes hot storage

(11:06) - Three questions to ask every MDR provider