Kaspersky NextXDR Expert
WhitepaperGame-changer, or an itch looking
for a scratch?
XDR: Extended Detection and Response

Who is XDR for?
XDR is for organizations with amature security posture, needinga single platform to give them acomplete and coherent pictureof what’s happening throughout
their infrastructure.

XDR will be a disruptive force — IDC

More devices, more applications,more network traffic, more data,
more threats…

It’s the acronym on many peoples’ lips, but like all relatively youngtechnologies, not everybody knows exactly what it is or what it can dofor their business. One thing’s for sure — XDR involves a strategic shift
from reactivity to proactivity, because ‘wait and see’ doesn’t washin cybersecurity. The smart money is on viewing XDR as a strategy
rather than just a product.
So is XDR just the latest tech-itch looking for a scratch, or a potential
game-changer? The itches are certainly there, from the global skills
shortage, overworked IT security staff, and a threat landscape thatnever stands still, to alert overload, disparate tools, weak threat
intelligence and the expanding attack surface. IDC says XDR will be“a disruptive force, impacting sales of SIEM, EDR, SOAR, network
intelligence and threat analytics platforms, as well as providersof external threat intelligence” 1, and Forrester believes thatdifferentiated XDR technology “will supersede endpoint detection andresponse (EDR) in the short term and usurp SIEM in the long run”2.

Who is XDR for — and whatchallenges can it resolve?
XDR is for organizations with a mature security posture, needing a single
platform to give them a complete and coherent picture of what’s
happening throughout their infrastructure.
The cybersecurity challenges these organizations face are consistentand well-established. ESG Research surveyed IT and cybersecurity
professionals3 at organizations with 100 or more employees,
over 80% in enterprises, across multiple verticals. Here are someof the key findings:

Difficulties keeping up
with the operational
requirements of SOC
technologies

Managing security operations is more difficult now than at any timein the previous two years, due to difficulties keeping up with theoperational needs of SOC technologies — scalability in the data pipeline,
load balancing processing engines, adding storage capacity, etc.

1Source: IDC, Global Security Products Analysis: From Power Point to Power Product, Where Is XDR Right Now? 2022

2Source: Forrester, Extended Detection and Response (XDR) — A Battle Between Precedent and Innovation, Allie Mellen, Senior Analyst, 2021

3Source: ESG Research Report, SOC Modernization and the Role of XDR, 2022

The growing andconstantly changing
attack surface and thethreat landscape overall

More devices, more applications, more network traffic, more data, morethreats. The threat landscape doesn’t stand still, and cyberthreats
evolve relentlessly in volume and complexity as new tools proliferate.
At the same time, the barrier to entry for hackers is lower than ever,with low-skilled buyers of cheap packaged threats on the dark web
on the one side of the spectrum, and highly skilled, patient hackers
building complex attacks on the other. And don’t forget insider threats
and supply chain vulnerabilities.

The high numberof manual processes
required to manage
security

There’s more security data to be collected and processed,
and processing it manually is inefficient and ineffective. This createsa perfect storm that impacts scalability, results on an over-relianceon direct human involvement, and degrades the efficacy of dealing
with threats in general.

An inability to develop
detection rules

An inability to develop detection rules, fine-tune security controls
and identify and deal with threats quickly and efficiently, due to a lackof time, resources and skills. Organizations don’t always have the rightskills or staff to keep up with security analytics and operations.
Which leads us straight to the next pain…

The very real global skills
shortage

Despite the global cybersecurity workforce being at an all-time highof 4.7 million professionals, there’s still a 3.4 million gap that needs
to be filled — but isn’t being filled. This gap is growing twice as fast
as the workforce, with a 26.2% year-on-year surge.4

4

Source: (ISC)², Cybersecurity Workforce Study, 2022

Tools not fit for purpose

Existing tools
often struggle
to detect and investigate
advanced threats, yetspecialized skills are needed
to use and manage them.

When the tools themselves become part of the problem, something
has to give. Existing tools often struggle to detect and investigate
advanced threats, yet specialized skills are still required to use andmanage them. Research5 shows that current tools are frequently
ineffective at correlating alerts, and IT security staff struggle withmultiple disconnected, disparate tools handling disparate data.
This is inefficient, cumbersome, messy and expensive. Anotherchallenge is that current tools don’t scale to deal with the expanding
attack surface, and there are big gaps in cloud detection
and response capabilities.6

Is it any wonder your CISO looks stressed?
The good news is that improving SecOps is a priority, and is funded —88% of organizations will spend more this year, 66% say that tools
consolidation is a priority, and modern applications development
and deployment has increased velocity, requiring new skills.7

What XDR doesof organizations will spend more thisyear on improving SecOps

Here’s how XDR can hit these challenges on the head.

XDR detects advanced threats better
XDR’s threat detection capabilities span endpoints, networks, and cloudenvironments. It uses machine learning algorithms and behavioral
analytics to identify sophisticated threats, including malware,ransomware, and advanced persistent threats (APTs).
say that tools consolidation is a priority

Automated response and remediation actions
XDR automates response and remediation actions, enablingorganizations to contain threats quickly and minimize any potential
damage. It can automatically quarantine or isolate compromised
endpoints, block malicious activities, and remediate vulnerabilities,
reducing manual effort and response time.

Integrates with endpoint protection tools
Integration with EPP is a key issue, and XDR leverages rich endpoint
telemetry and behavioral analytics to provide deep insights into
endpoint activities. It employs advanced machine learning algorithms
to identify suspicious behavior and indicators of attacks (IOAs),
facilitating early detection of sophisticated threats.

5

Source: ESG Research Report, SOC Modernization and the Role of XDR, May 2022

6Source: ESG Research Report, SOC Modernization and the Role of XDR, 2022

7Source: ESG Research Report, SOC Modernization and the Role of XDR, May 2022

Delivers real-time visibility
Where XDR fits into
the EDR, MDR, SOARand SIEM ecosystem
The clue is in the X — extended. XDR
extends the capabilities offered by
EDR to proactively detect complex
threats across multiple infrastructurelevels, and automatically respondto and counter these threats.

An integrated
approach is key
By integrating multiple tools andsecurity applications, and monitoringdata on endpoints, networks, clouds,
web servers, mail servers and more,
XDR does more to detect andeliminate threats while at the sametime simplifying information security
management by automating crossproduct interaction.
Forrester believes that in most cases,
XDR won’t outright replace security
analytics platforms, noting that “XDR
is on a journey, and [we] expect thatover the next five years, security
analytics platforms and XDR will collide”.
SIEM has use cases beyond threat
detection, and SOAR’s customizability
is useful, but when it comesto detecting and responding to threats,
the advanced analytics of XDR’s
enhanced protection are second
to none.

XDR provides real-time visibility into your organization's security
posture. It collects and analyzes data from various sources, suchas endpoints, servers, firewalls, and cloud platforms, to delivercomprehensive insights into ongoing threats and suspicious activities
into single console. This makes it truly proactive — proactive threat
hunting and faster incident response. An holistic view helps security
teams identify suspicious activities and potential security incidents
more efficiently.

Contextualizes data and threat intelligence
When it leverages high quality threat intelligence and a comprehensive
threat intelligence database, XDR provides highly useful contextual
information about threats and attackers. This enriched threat
intelligence simplifies investigation alerts and incident handling,and helps security teams understand the tactics, techniques, andmotivations of threat actors, facilitating more effective incident
response and proactive defense measures.

Enables streamlined security ops
Properly integrated, the best solutions will slot into your currentinfrastructure effortlessly to deliver the best results from automation,and give full visibility and awareness without having to replacethird-party security solutions already in use. And don’t forget thatby providing a comprehensive view of security incidents and user
behavior, integration supports compliance.

Clearly, XDR can deliver what it says on the tin:
control, stability and that all-important edge.
But not all XDR offerings are created equal…
How do you choose the one that’s right for you?

5 key things to consider when comparing XDRvendors and solutions
Here’s how XDR can hit these challenges on the head.

1

There is a direct link between the qualityof an XDR solution and the synergy
between the vendor’s EPP and EDR
An EDR solution for advanced detection andresponse to sophisticated cyberthreats at endpointlevel is a key element of XDR. At the same time, EDR
needs a robust Endpoint Protection Platform (EPP)
to automatically sift out huge numbers of mass
threats. It’s important to look carefully at theendpoint protection features, and check that thereis support for all kinds of endpoints — PCs, laptops,virtual machines, mobile devices, and various
operating systems.

2Up-to-date threat intelligence anda complete view of cybercriminals’
tactics and techniques are essential
to counter cyberthreats
It’s not rocket science — any XDR solution worth
its salt will offer both of these capabilities, together
with additional context to improve and speed-up
incident investigation and response.

34Integration with third-party solutions
is more sustainable and cost-effective

Independent reviews, global recognition
and independent test results matter

How well an XDR solution integrates with thirdparties is another absolutely critical issue,
because interoperability makes the purchasea more sustainable investment from the start.
An XDR solution that offers numerous andgenuine integration options will collect more data
sources and deliver a more complete pictureof what’s happening in your infrastructure.

When you’re investing in something as important
to your business as cybersecurity, don’t overlook
independent assessments. Ask for the resultsof independent tests. Check about internationalrecognition from the likes of Forrester, IDC andothers. Are the solutions implemented globally?
Ask for case studies.

5Is your investment futureproofed?
Technology doesn’t stand still, and especially for something like XDR, which is still a relatively young technology,
you should find out what a vendor’s roadmap looks like for ongoing development.

Why Kaspersky
Most tested. Most awarded. Kaspersky protection.
Kaspersky is an established global cybersecurity company with a strong track record of security expertise.
We’ve been protecting organizations around the world for over 25 years and have received countless awards
and accolades for our products and services. Between 2013 and 2022, Kaspersky products:

achieved 587 first places

achieved top-three finishes

participated in 827 independent
tests and reviews

In 2023, Kaspersky was named the Leader in the XDR solutions market by leading global technology research
and advisory firm ISG. ISG defines ‘leaders’ as having a comprehensive product and service offering andrepresent innovative strength and competitive stability.
Learn more

Learn more

www.kaspersky.com© 2024 AO Kaspersky Lab.
Registered trademarks and service marks
are the property of their respective owners.

#kaspersky#bringonthefuture