WHITE PAPER

Turn your MSP into a Profitable
MSSP with Stellar Cyber
Powered by the Stellar Cyber Open XDR Platform

Cybersecurity has evolved over the past
30 years, moving from perimeter defenses(firewalls) to more holistic approaches thatincorporate security for email, endpoints,applications, servers, and cloud. With thisevolution have come a huge array of discrete
tools that provide protection in each area, so
now a typical MSSP has dozens of individual
tools to manage. The challenge is that each tool
has its own data format and its own console,
so analysts must move from one console toanother and manually correlate alerts among
them to discover today’s complex cyberattacks.
As new tools emerge, MSSPs must find more
expensive, scarce analysts to run these tools’
consoles, adding complexity and cost to thewhole cyber defense effort.
XDR is a response to this challenge. By unifying
most or all security tools under a single
interface with a single data lake, XDR makes
it easier to spot complex attacks and enables
analysts to respond more quickly. XDR also
reduces the number of analysts required to run
the cybersecurity system, thereby reducing costs.
This paper explains how Stellar Cyber’s OpenXDR platform helps MSPs become MSSPs

with the fastest, least expensive, and mostcomprehensive XDR solution.

Executive Summary
Cybersecurity is top-of-mind for most ITmanagers, but many mid-sized enterprises
can’t afford to deploy a full-fledged security
operations platform on their own. Rather,
they are turning to Managed Security Service
Providers (MSSPs). Managed Service Providers
want to become MSSPs to get into the highdemand managed security business, but like midsized enterprises, they lack the resources to do
this using traditional, stand-alone security tools.
Each tool has its own license fee, its own console,and its own data format, which makes creating asuite of such tools expensive and complex.
Today’s cyberattacks target multiple vectors(user logins, servers, firewalls, etc.), but whenanalysts are forced to manually interpret andcorrelate data from many different consoles,
it is difficult to detect and respond to attacks
in a timely manner. Many organizations only
discover cyberthreats after they have been in
the network for weeks or months.

MDR, EDR and XDR Services and Attack Surface Coverage
360º Visibility

www.stellarcyber.ai

sales@stellarcyber.ai

XDR is a promising solution to these challenges.
It unifies multiple security tools under a single
interface, making threat signals easier tospot and interpret. Stellar Cyber’s Open XDR
solution goes beyond other XDR products todeliver 8X faster Mean Time to Detect and20X faster Mean Time to Respond. It unifies
all the data from multiple tools, automaticallycorrelates that data, displays a prioritized listof actual cybersecurity incidents for immediate
action by analysts, and responds to many
threats automatically through the appropriate
network systems.

Defense in Depth has caused almost every
customer to purchase a different mix ofsecurity technologies. Supporting a diverse setof technologies can be extremely costly andchallenging. Many MSP and MSSP partners
have standardized on a set of products theircustomers must purchase to get their MDR
service which can lead to vendor lock-in. In
today’s market, that’s not realistic – you are
reducing your addressable market with thatstrategy. Customers won’t readily abandon
their existing investments just to purchase an
MDR service.

This paper discusses the challenges for MSPs
wanting to become MSSPs and shows how
Stellar Cyber’s Open XDR platform addresses
them, providing the fastest route to creating afully functional Security Operations Center.

Most MSPs find it nearly impossible to attractand hire analysts to man their SIEM, SOC, orother security tool. What many MSP partners
also do not realize is that providing managed
security services requires them to offer a fullsuite of tools, including NDR, MDR, EDR, SIEM,
UEBA and TIP. Leveraging machine learning andautomation in the Stellar Cyber Platform, youcan provide all these services with one-third ofthe staff required for traditional SOC tools.

Why MSPs are Becoming MSSPs
Many MSPs are looking to offer MSSP services.
Cybersecurity is in the news daily, and attacks
are occurring every minute of every day. Everyorganization wonders if it will be next. By
evolving from an MSP to an MSSP, a provider canbroaden its customer base, increase revenue,and, most importantly, improve margins.
Stellar Cyber’s Open XDR platform is the fastest
and most cost-effective way to transform froman MSP to an MSSP.

Barriers to Becoming an MSSP
MSPs have been told for the last several years
that if you cannot afford to build a SOC, you
should outsource the MSSP services to a larger
partner or manufacturer that does. Most of themanufacturers are understaffed and provide
little more than lists of alerts to respond tofor your customers. We talk to hundreds ofMSP partners that are frustrated with theircurrent providers. It has been very expensive
to purchase a SIEM and SOAR, and to staff a
24x7 operation. At Stellar Cyber, we believe theexact opposite is true: you should not trust yourcustomers with a third party that does not havethe history or relationship with your customerthat you do.

To compete in an increasingly crowded
marketplace, the MSP must build a
differentiated MDR service, yet the output
from most SIEMs is inconsistent and generates
a lot of false positives. MSSPs need a “wow”
factor to succeed, and Stellar Cyber provides
high-fidelity, actionable alerts that are
correlated into incidents automatically. We
don’t stop there. The platform also includes
response capabilities directly from the alert.
No more logging into your customer’s VPN andlooking up their firewall credentials – your teamwill be able to not only respond manually, but
to develop playbooks to respond automaticallyto routine threats.
Finally, to retain customers, an MSSP must
prove its unique value, which is normally done
through reporting. In traditional SOCs, crossenterprise reporting is difficult because eachsiloed tool produces its own data formats andits own reports. By normalizing the data as weingest it, we create a standardized record of allalerts. This data can be built into any reportyour customer will need with no limitations.
www.stellarcyber.ai

sales@stellarcyber.ai

Auditors really like not having to review
multiple spreadsheets.

Stellar Cyber’s solution
Stellar Cyber’s Open XDR platform wasdesigned from the ground up to address thesechallenges by solving five key security needs:
Visibility, Automated Detection, AutomatedResponse, Comprehensive Reporting, and Cost.
•Visibility – In addition to its internal
capabilities (NG-SIEM, NDR, UEBA andTIP), the platform has been built withmulti-level multi-tenancy from the ground
up. It integrates data from other popular
security tools with the goal of presenting acomprehensive picture of any organization’ssecurity posture. Collecting log data fromas many sources as possible is criticalto piecing together today’s multi-vector
attacks. Stellar Cyber does this through afamily of sensors, parsers, and APIs. Wehave hundreds of parsers to ingest datafrom local devices on your customers’

Stellar Cyber Virtual and Physical Environments Ensuring 360-degree Visibility•networks – all you need to do is configure
them to send them to the correct port on
the sensor.

1. Supervised Machine Learning allows you
to train a detection to look for something
specific like a brute-force successful login.

Automated Detection – Siloed security
tools often produce logs in their own data
formats, which makes analysis and reporting
very difficult. The Stellar Cyber platform
ingests data from all security tools andautomatically normalizes that data into astandard JSON format stored in its data lake.
It then automatically correlates that data toreveal complex, multi-vector attacks. Finally,
it uses machine learning to automaticallyanalyze that data against a dynamic set ofrules that become more intelligent as theplatform is used:

2. Unsupervised Machine Learning significantly
reduces the amount of time spent byanalysts building custom notifications forspecific customers. These models learn
the normal behaviors of each tenant andthe users in it – when they typically log in,which machine does the user normally logs
into, where they normally log in from, andwhat applications we normally see themusing. This allows us to detect even the mostsophisticated attacks, even if they are moving
low and slow within the environment.

www.stellarcyber.ai

sales@stellarcyber.ai

Stellar Cyber’s advanced AI Engine Ensures Analysts See Context In all Security Data

3. Finally, we leverage Graph Machine
Learning (GraphML) to correlate alerts
into contextual, prioritized incidents. The
platform scores them based on their severity
and ranks them in order of severity. This
helps analysts quickly focus on the things
that matter the most. Stellar Cyber is theonly platform currently leveraging this typeof machine learning in our platform.
•

Automated Response – The platform
includes fully integrated response
capabilities. First, you can take a manual

response directly from the alert in ourplatform – setting a block rule on a firewall,for example. Normally, an analyst would
need to log into their VPN and look up
the credentials for the firewall to finally
set the rule. In Stellar Cyber, we create anencrypted connection between the DataProcessor and the Sensor on the customer’ssite. This allows you to send a block requestfrom the Data Processor to the Sensor,
which sends it to the firewall locally. This issignificantly faster, and seconds count when
there is a serious incident.

Stellar Cybers Open XDR Platform Normalizes, Enriches and Processes
Data Driving Automated Incident Correlation, And Response Capability

www.stellarcyber.ai

sales@stellarcyber.ai

Finally, anything we can do manually in theplatform can be automated in the form ofPlaybooks. Anything we can detect on theplatform or any detection you can dream up
can be run on the data. Rules can run on youroverall environment, on groups of tenants, oron individual tenants.
••

Reporting – Because it normalizes all thedata it ingests, the Stellar Cyber platform
allows you to create any report you wantwithin our platform. Auditors really likeour platform because once we normalize
the data, we can consolidate multiple
spreadsheets of compliance controls into asingle report.
Cost – The Stellar Cyber platform is soldunder a single license. It includes an NGSIEM, NDR, UEBA, and TIP functions plus afamily of four different sensors for servers,logs, networks, and security, all at a costthat’s typically lower than the license for a
SIEM alone.

Making the Transformation
Stellar Cyber has created a high-speed onramp
to becoming an MSSP called our Jumpstart
Program. We have a three-step process:• Step 1 – Deployment & Training – The Stellar
Cyber platform can be deployed in lessthan an hour. Thanks to our single-console
interface, most analysts can be trained on it
within an hour or two. There are two simple
virtual enablement courses for architects
and analysts.
•

Step 2 – Onboarding Customers – The
platform has built-in multi-tenant capabilities
and customer templates. Once the firstcustomer is added, you can use templates
to further speed the onboarding process
for successive customers. We also provide
transition assistance to get your first coupleof customers onto the Stellar Cyber Platform.

•Step 3 – Matching customer services withcustomer maturity – less mature customers
will not need the advanced features of theplatform. The subscription cost per asset

Phased Approach to Building a Full SOC Service
MSP to MSSP Program: Staging the Transformationwww.stellarcyber.ai

sales@stellarcyber.ai

includes all the features in the platform
whether you are using them or not; there
are no surprise upcharges for the advanced
features in the platform. As you add more
complex services, the additional amount you
charge will go straight to your bottom line
and more of your customers will purchasesecurity from you.

Where to Begin?
To facilitate your business transformation fromMSP to MSSP, Stellar Cyber offers its Jumpstart
program, which assists you through the steps
outlined above. To get started, go to https://stellarcyber.ai/partners/become-a-mssppartner/ and click Apply Now.

Stellar Cyber’s Open XDR platform delivers Everything Detection and Response by ingesting data from all tools,
correlating incidents across the entire attack surface, delivering high-fidelity detections, and responding to threats
automatically through AI and machine learning. Our intelligent, next-gen security operations platform greatly reduces
enterprise risk through early and precise identification and remediation of all attack activities while slashing costs,
retaining investments in existing tools and accelerating analyst productivity. Typically, our platform delivers a 20X
improvement in MTTD and an 8X improvement in MTTR.

www.stellarcyber.ai | sales@stellarcyber.ai
www.stellarcyber.ai

sales@stellarcyber.ai