There is a common misconception when it comes to cyber security that implementing Endpoint Protection (EPP) alone is enough to keep your company safe.
While that may have been true a decade ago, it is now no longer a case of if your company will be hit, but when. The simple fact is that attacks are becoming more sophisticated and the attack surface much larger.
Detect and respond
In order to continue protecting your company to the highest level, it is now crucial to build an EDR capability on top of your EPP protection. There are two simple reasons for this: detection and response. While EPP allows you to receive notifications that malicious files or suspicious activities have been blocked, EDR takes things one step further. Firstly, EDR lets you see exactly what happened before EPP blocked a malicious file, giving the admin an understanding of the broad context of events.
This is where EDR moves from detection to response. With more information about events, EDR can react before malicious or destructive activity can take place. “Once something happens, then the response aspect becomes more critical. I hope that people don’t end up there, but if you do then you really need the advanced response capabilities of EDR,” Ville Korhonen, Senior Sales Engineer at WithSecure, admits.
By combining the detection and response capabilities offered by EDR bolted on to EPP, you can identify and react to a breach as it happens, offering the complete solution in a single pane.
Is EPP dead?
So, does this mean EPP is now obsolete? “Definitely not,” says Suvi Silvanto, WithSecure’s Director of Product Marketing. “You need EPP to provide a base level of security. However, threats keep on emerging and we must react to them with more powerful solutions,” she continues.
Korhonen agrees. “The vast majority of cyber attacks use Windows admin tools at some stage and that is where EPP does not have enough visibility.”
Unfortunately, many companies tend to opt for EDR after they have been breached, as only then do they realize how important overall visibility is. “If you don’t have EDR in place, it becomes super costly; if you're a smaller company you might not even have the means to get back on track for a long time, which can impact business continuity,” Silvanto insists.
“I would say around half of IT professionals really know and understand that they need more visibility, while others still believe that by having EPP they are ‘covered enough’. However, we need to educate people and explain what they are missing from a visibility perspective,” Korhonen explains.
What happens next?
If you already have WithSecure Elements EPP, adding EDR takes less than five minutes. Once installed, security events begin to flow and are automatically analyzed using continuous machine learning combined with the latest threat intelligence data. Suspicious events are combined into Broad Context Detections, which are given a severity rating so that admin members can focus on only the most severe detections.
“At the end of the day, EDR needs to provide advanced security but also help the user's everyday work,” Silvanto believes.
At this point, you need to consider your response to possible detections, and this is where WithSecure's EDR places you firmly in the driving seat. Our 24/7, built-in automation allows you to respond immediately to real advanced threats and attacks, offering the ability to slow down or even stop attackers from reaching their objectives. This is achieved by enriching forensic artefacts from endpoints to help kickstart the fightback. We’re also with you all the way, providing the guidance and experience necessary to improve your team’s focus.
While threat detection is a superpower we can all have, we’re aware that smaller companies may not have the experience or in-house expertise to process all this information.
That’s why we created WithSecure Elevate. With a single click in the management portal, you have 24/7 access to our cyber security detection and response team. They can guide you through any breach with expertise and confidence.
Elevate’s first level involves a threat evaluation being performed to see if you need to respond. Next, a deep-level investigation brings recommendations and response guidance. If Elevate isn’t enough, you can then call in the cavalry: the on-site WithSecure Incident Response team.
Learn more about Elements EDR
WithSecure™ Elements Endpoint Detection and Response
WithSecure™ Elements Endpoint Detection and Response solution provides enhanced detection capabilities and security against cyber attacks and data breaches.Read more
Get your free 30-day trial now
Try Elements for 30 days. Let’s start you off with our award-winning Endpoint Protection and Endpoint Detection and Response.
Here what’s to expect from our market-leading cyber security service:
- Industry-leading Windows, Mac and Linux workstation security
- Immediate visibility into your IT environment
- Detect cyber attacks and data breaches in minutes
- Respond to threats using automation and guidance from WithSecure experts