Cybereason Managed Detection & Response Reviews

I am part of a reseller with two roles. We are a Managed Service Provider ourselves, and in a way, we compete with managed detection and response with the MDR product. 

In our managed service, we use the NGAV product and mainly the EDR product to provide our service. In some situations, we resell all three products or even four. We resell NGAV and EDR to customers who want to run it on their own, and we resell these products, including MDR, with a managed service from Cybereason, where the customer prefers that. 

When we sell the XDR product, MDR is always included. This depends on the customer situation. We resell MDR when the customer is price-sensitive and needs real 24/7 service. The Cybereason model is more economical than ours. We are more flexible but more expensive.

The quick reaction and the ability to restore the state before within a short time are significant. It is quick to detect, quick to react, and able to bring back the state to get rid of the damage. It's very reliable. When something happens, they see it.

If the language barrier was addressed, it would lower the barrier for a number of German customers. It would take away a unique selling point for our own specialist managed service. I'm a bit hesitant, however, this would improve the product or the offering. Detection time already is very quick. The completeness of the offering was integrating more data. I am discussing with a customer who wishes to include identity data. Detecting early when someone tries to compromise your ID would be a nice feature.

I have been using the solution for four years.

I haven't heard of problems there. I might not give a ten. That's maybe typical German, so I would say nine out of ten.

We do have very small customers, which is rather an economical limit. I would give it a seven out of ten. It scales very high. It doesn't always scale down, so there's a certain minimum amount.

I think of situations I know. There's a technical account manager, and the customers are very happy with it. I would give it an eight out of ten.

Positive

As far as I know, there are mainly two things to do. One is the settings and the control screens, and you get guided by the Cybereason onboarding team. They explain which choices to make, what the choices would mean, and do it with the customer. The second thing to do is to roll out the sensors, and that's fairly easy. There are rarely heard of problems, so I would give it an eight or nine out of ten. Eight is good.

During my experience, they added the coverage for the XDR product series, including additional alerts from firewalls. They grew their offering and adapted it to current threats and current countermeasures. When the Log4j bug got public, they were quick to provide a hunting query, showing how quick they are to react for all customers. 

Indeed, I would rate the overall solution eight out of ten.

Positive

My company uses Cybereason Managed Detection & Response for incident response, and whenever there is a breach, we support some clients. In short, we also manage it for our company's clients.

The most valuable feature of the solution is endpoint management. Though I can't remember what it is exactly called, it is the isolation feature that allows you to isolate malware as soon as the tool detects it, especially when it doesn't respond to quarantine. The investigation feature allows you to search and see what has happened in the logs.

My company's issue with the solution stems from the fact that for every client, we have to spin up a new Cybereason instance, so there is not a single Cybereason instance where you can manage all your clients. For every new client or every new case, my company has to spin up a new instance, because of which there is a new URL. My company has to invest in enrolling people again and add all your new IOCs back into each instance. There is no centralized way to manage multiple instances of Cybereason, which is probably the biggest issue that wouldn't allow onboarding someone new, causing a lot of effort in the initial setup, maybe through a whole different web interface at times.

I have been using Cybereason Managed Detection & Response for two and a half years. My company has a partnership with Cybereason, and we also help others implement part of the solutions from Cybereason.

I cannot say that we have encountered any stability issues related to the solution in our company, but there have been some integration or interoperability issues, especially in cases where there is an antivirus or any other security tool. The tool itself is pretty stable. There are just more interoperability issues when there are other tools in the environment.

I rate the stability of the solution an eight out of ten.

My company has not encountered problems with the solution running in large environments. My company shows that multiple detection servers are linked in larger environments.

My company caters to small and medium-sized businesses, but we're also partnered with two international telecoms to whom we provide IR services, and they use it. Individually, the international telecom companies have around 25,000 to 50,000 employees.

The solution's support team is quite good at giving us feedback if there is an issue.

I rate the overall support an eight out of ten.

Positive

The initial setup of Cybereason Managed Detection & Response was easy since it provides good documentation for each use case or where there are problems.

The solution is deployed on the cloud. Though the solution is deployed on-premises, it is mostly deployed on the cloud. For most of our company's clients, we deploy the solution on AWS Cloud, and for our clients in South Africa, we deploy the solution on Azure Cloud.

My company completes the initial deployment, especially if it's a Cybereason IR, within 48 hours at the key affected areas. If it is a managed server that my company deploys, then the deployment may take up to weeks. With Cybereason IR, the deployment process is rapid since you need to be quickly deployed.

I had compared the pricing of Cybereason Managed Detection & Response with the other products we deal with in our company. Cybereason's pricing depends on the way it is hosted and how it is hosted in an IT environment. In South Africa, the local telecoms host the tool on Azure as a part of a larger managed service, making it less expensive. If some smaller companies have Azure to host the solution separately, then I get a bit expensive. There are other idiot providers in the market providing both the cloud and the endpoint costing together. Price-wise, Cybereason Managed Detection & Response is effective for larger companies, but if you have a small company with less than 1,000 employees, then it gets expensive.

I rate the overall tool an eight out of ten.

We use Cybereason Managed Detection & Response for general security and monitoring of our environment. This includes threat detection and response to ensure we are aware of threats that are in our environment.

The pricing is valuable because we do not need to have our own data center and software licensing for monitoring. The response from the service provider is quick and responsive. They inform us of threats even before we are aware, through reports. Automated information on zero-day threats is provided without us needing to ask. Another feature we like is that they can detect threats and alert us even when we are not at work.

The interface, particularly the dashboard we use for looking at alerts, could be improved. The ease of use of the dashboard and accessing security reports needs enhancement.

I have been using Cybereason Managed Detection & Response for a year, which is approximately 12 months.

There has been no downtime with Cybereason Managed Detection & Response.

The tech support is relatively helpful. They respond to our queries on time and are always available when we have concerns and questions.

Neutral

We previously used an on-premises SIM solution. Moving to Cybereason was easier to deploy and less costly compared to more extensive SIM solutions.

The setup required ensuring all devices were standardized and ready for monitoring by the MDR solution, which took some time.

We have experienced fewer successful incidents, leading to a more stable environment with the MDR solution.

The valuable aspect of pricing is that we do not need our own data center and software licensing, which reduces costs.

We evaluated several options, including larger SIM solutions. We decided on a SIM Lite solution like XDR and eventually chose a managed service that was easier to deploy and less costly.

I recommend considering the cost of maintaining your own data center versus using a service like Cybereason MDR, which leverages expert resources and AI-powered solutions for threat detection. On a scale of one to 10, I rate the solution as a seven because they meet many of our requirements but could improve services to match higher-cost providers.