Binary Defense MDR Reviews

They co-manage our Sentinel SIEM instance, and they provide a Security Operations Center (SOC) with 24/7 coverage. They perform research and remediation. They have a separate team for phishing. That smaller team has rights to our Defender Cloud instance so that they can handle malicious emails and things like that. They have been very good.

They really learned our environment. We have given them rights, and they are in our entire Microsoft Defender for that part. They have the rights to that. We have moved our environment completely. We have Microsoft E5, and we have Defender for our Office 365. We have Defender for our endpoints. We have that integrated with our Sentinel SIEM instance and then Defender for Cloud Apps, such as email, and all those functions. They have been able to manage services and take care of them for us.

They have been fantastic in terms of integrations. We have some that are built into Defender and other Microsoft solutions, and we have had a couple of products for which they worked with us to build custom integrations.

We were able to realize its benefits immediately.

They helped us to reduce the overall amount of security alerts. They have been great for us because of our diverse environment. Healthcare IT is particularly catching up to the rest of the world for different features, and they have been able to work well with us. In the SIEM, we have alerts and things like that, but some healthcare behaviors act like malware behaviors. We have to tune the legitimate processes out, and they have been great with us.

Binary Defense MDR has absolutely had an effect on our security posture. We are in the middle of a month-long penetration test. So far, we have been catching everything the team has been throwing at us.

Binary Defense MDR has definitely reduced our IT team’s workload. We have three people, and it would be almost impossible for us to work 24/7 and 365 days monitoring our tools. They have rights to our system and have been taking care of a lot of the load that we cannot handle.

Binary Defense MDR has absolutely saved time. With the setup that we had previously for a little over about eight years, we were continually running into issues and not getting forward motion in our project. We improved just in the first couple of months of being with Binary Defense. We started building in April, and it has just been phenomenal.

We are a small team. There are only three of us in our organization. We switched to the Binary Defense team this year. With the previous one, we had them 24/7, but we still did most of the work. In the six months we have been with Binary Defense on this, they run with the ball. They take care of our problems. When we get a ticket, they do not just give us a report. In the agreement we have had with Binary Defense, we have given them the right to take hold of it themselves if we get an alert of some sort. They can go in and do possible remedies with it or generate tickets, and they do a great job. We are in a diverse hospital healthcare environment, so we have a lot of different business areas. It has been great. The Binary Defense team can handle context very well in our diverse environment.

We are going to have a meeting with them the following Monday. It will be our first quarterly business review. Half of it is going to be looking at new products and new functions that they are bringing out. So far, I do not have anything negative or a concern. There were two small mistakes that the technician made, and they were remedied immediately. Once we brought them to their attention, they were remedied. I do not have any complaints. They were just simple mistakes that anybody could make, and their response was a positive response. So far, I have not had anything negative to say.

The only area for improvement that I can think of relates to statistical analysis for SLAs. They are in the middle of moving to a new product called D3 which is going to do some backend work for them. I know they are working to improve some of the help desk statistics, such as the time the tickets open and the time they are closed. They are working on that function. It is going to be resolved in the next month or two. We have service level agreements with them, but they can use improved statistics for service level agreements. This is the only point of improvement I can identify.

I have been using MDR for over ten years.

The support from Binary Defense has been excellent. Our response times are phenomenal. Issues that previously took months to address are now being resolved quickly. They are suggesting new ways of doing things. 

Previously, tuning our rules would take weeks, whereas now, I go through my week, record suggestions, and send them on a Friday, and the suggestions are usually implemented by Tuesday the following week. From a business day, three days is amazing.

Positive

Prior to Binary Defense, we used QRadar as our SIEM and had CDW as managed services.

We have a Microsoft enterprise agreement, and we were required to go to E5, which includes everything in Microsoft. We had been dissatisfied with QRadar and the CDW support for QRadar. Our boss suggested that we look at Sentinel because we are already paying for Sentinel with the E5 Microsoft agreement. After we made the decision to switch to Sentinel as our SIEM, IBM announced that they would be going away a bit from QRadar. 

We had it up and running in less than a month. It was considerably easier. If I were to compare the functionality of our SIEM to the previous one, I feel we are much more secure and covered now than we were before.

We had a second stage with phishing, which was a separate smaller project. That one took probably a couple of weeks, and the main one probably took from mid-April to mid-May. The other project was late May to early June. Within a month, we were fully functional. We have continued tuning and things like that, but in terms of all of the sources that we requested and all the integration we requested, everything was done within a month.

The deployment was supported by a full team from Binary Defense. Binay Defense's support was great. They were able to accomplish everything we requested from a technical aspect, even some custom configurations. When we were having meetings, several dozen people participated at various levels of leadership and technicians. We had an entire team dedicated to our needs, ensuring our setup was successful.

In the past, we have had one dedicated person, whereas now, we have four to five people dedicated to us just for phishing. We are built right into their SOC. We are talking with them because we are crossing to the point where we may have a couple of dedicated people to us as opposed to their full SOC team. I do not even know what that number is on the backend from them, but it is considerable.

Binary Defense has saved us money compared to our previous contract while providing better results and support.

It has been good. We have saved money, and we have a better product.

We are a company that has become an enterprise from a small medium business in two years. Our company passed a certain dollar mark in revenue, so now we are considered a true enterprise company. At the same time, we are in rural western South Dakota, and we are in healthcare. We had to pay more once we got into that enterprise area for functionality and things, but from a price point, we are paying less than before. They save us money, but we have more features, more functionality, and more support. The quality of support is better.

Once we decided to go with Sentinel, we looked at different vendors who would do managed services for Sentinel. Two that floated to the top of our list were Binary Defense and Black Hills Information Security. There was also a company called BlueVoyant.

We did demos with them. We went through a long process of reviewing support on both sides. We made the choice to go with Binary Defense, and we have been very happy with it. They also have a sister company called TrustedSec. One is sort of the red team company, and the other is the blue team company. 

BlueVoyant is another company that co-manages Sentinel instances and things like that. We thought that Binary Defense's approach of being able to see Defender and Attacker was a much better fit for where we want to protect our infrastructure.

I would highly recommend Binary Defense to anybody running Sentinel.

I would rate Binary Defense MDR a nine out of ten.

Over the years, we've needed to shift our use case, which is actually an advantage. We use Binary Defense to supplement and extend our monitoring capabilities across our enterprise. They're very flexible. They use our tooling and they monitor escalated issues. They do threat hunting for us. They do threat research for us as well. They provide threat intelligence when there's a breaking zero-day threat or if something new is happening in the security space. They provide deep technical expertise in detection, threat hunting, and intelligence in a way that directly covers what I need.

Binary Defense really functions like an extension of my team. Their key individuals run functions like threat intelligence and threat hunting, and they stay very close to us. When we get into investigating something, and we're not sure, they'll put the issue in a team's channel to find out what it is. 

When Binary Defense is looking across all of their customers, and there's a new threat out there that they think could apply to us (since they know our environment), they'll tell us, and they'll explain it. They focus on that partnership to help us understand what's going on and communicate with us. They won't say, "Don't worry about it. We've got it." They say, "We're doing this for you, and here's why." If my team has questions or needs more advanced technical support in investigating the incident, we can call them.

The most valuable aspect of the solution is its flexibility. As my business changes and I change tools or I change staff, they have been able to adapt with me to fill in gaps and help ensure that I have a consistent line of defense even in the face of change.

The customization is awesome. A lot of providers will say, "Here's what we do," and then you have to customize it for the provider. Binary Defense is the opposite. It customizes to you. They take what you have, and they focus their development, inside their organization to be on the scale of your company. They do not force you to fit their model.

The Binary Defense MDR's ability to integrate with Jira or other applications is very high. All the solutions that we have asked for them to integrate with, they have.

It secures our infrastructure from end to end so that we can detect intermediate threats. They do a fantastic job. Once again, they have done the work to take the burden on themselves to adapt to me rather than pushing that load on me. So, as my business changes, they can maintain the same consistent service to me of detection and response. That's something I haven't seen from anybody else. Everybody else has required either their software or things to be done in a specific way. That may or may not match what I'm able to do.

With such close communication between our teams, my team learns from them. This gives our team the ability to do better research and investigate with more authority in the future. 

It's helped us reduce our security team's workload.

Our mean time to response has gone down. We're much faster with direct response and have more investigative capabilities than we did before. 

They help us write detection rules and refine our detection so that we can effectively drive down our false positives and spend more time on things that matter (and less time on things that don't). We're not chasing noise. We can hone in on things. We've been able to reduce our security alerts. When you drive down the false positives, you drive down the alerts, which lowers the agent workload.

Sometimes, something may not install right; however, whenever we have challenges, they are very solution-oriented and ready to figure things out.

While my understanding is that they're working on this, I would like to see some more of the quantification or reporting. They're working on better detecting the impact they're having and what they're working on. That's an area they should continue to focus on. Having those metrics will be valuable. 

They just need to continue to be focused on Open MDR, and on being open to many tools and being broadly compatible across tool sets if possible. That's unique, and it is a differentiator in the marketplace.

I've been using the solution for five years. 

We haven't witnessed any stability or performance issues. We had one off problems with the system here or there or a challenge here or there, however, overall, it's been quite good.

Initially, we had 40,000 employees. We went through some business changes, and now we're sitting at around 15,000.

The solution scales very well.

Their support is very solution-oriented. Some providers, when you reach out to a provider and say "We have a problem," their first reaction is to try and swat you away, to push you away and say, "No. You must be doing it wrong." And then you have to override that and get through that before you get to the real help. Binary Defense doesn't like that. When you call them and say, "I have a problem," they say, "Okay. What are we looking at?" And then they quickly bring resources to bear.

They are very transparent and quickly put the right people in to help resolve the issue.

Positive

We did previously use a different solution. They were not responsive, and they were not customer-oriented. 

The deployment wasn't too complex. The Binary team worked alongside us and helped us with any challenges. The deployment did not take too long.

The Binary Defense team is responsible for maintenance. 

We have witnessed an ROI while using the solution.

The pricing is very competitive; it's on par with or below others. For those sensitive to pricing, I'd advise that they be holistic in their evaluation and look for hidden costs in the systems from their side that they would have to modify to work with other providers. 

We did look at other options before choosing Binary Defense. Other providers required us to use either their security software or workflows. Once they identified an issue, you had to be in their systems to work with it. I already had workflows and didn't want to build more and then be locked into a specific vendor.

We have a great partnership with Binary Defense. They are like an extension of our team. I've never seen the level of commitment from any other provider.

I'd rate the product ten out of ten.

We use Binary Defense to secure our environment against cyber threats. The solution provides 24/7 live monitoring. The solution currently covers around 3,000 endpoints. 

We take great pride in our brand, and Binary Defense helps us protect it. If we had a data breach, it would significantly affect our brand and ultimately our revenue. 

Binary Defense helped us reduce our alerts. In the past, the tools we used were sending us thousands of extra alerts a month. We had to comb through those alerts, and 99 percent were false positives. Binary Defense is much smarter. It reduces the noise and our fatigue. Out of the thousands of alerts, there is always a chance that one of them is a genuine threat that you need to act on. You might miss that if you have all this other noise. 

It saved us a lot of time because we're not dealing with all those false alarms. Binary Defense provides round-the-clock cybersecurity analysis. I can't imagine how much money we'd spend staffing an in-house team to monitor 24/7 365 days a year, covering holidays, vacation rotations, etc. 

It's hard to quantify how many hours we save annually, but I know roughly how much time we spent responding to false alarms. It's around 500 hours annually.

The solution helped us improve our cybersecurity posture, especially in the detection and containment aspect. If a user triggers an alert, an employee in our organization can immediately isolate their computer. 

The most valuable part of Binary Defense is its team of cybersecurity analysts. Their analysts filter out the noise and only forward the critical threats that require a response instead of false positives. 

Binary Defense is somewhat customizable. We can do some whitelisting and tell them to ignore some alerts that are always false positives. They're flexible and can adjust their processes.

Their MDR tool runs across all our endpoints. Within that Open XDR strategy, we can ingest those alerts in various ways, but we tend to do things the old-fashioned way. However, we could bring that data into a SIEM if we wanted to. We haven't taken advantage of that feature, but we will soon. It would limit our ability to move forward with them if they didn't have that option. 

We should be able to isolate devices faster. They should shorten the time between clicking on a device to contain it and carrying out the action. That would be a welcome improvement.

We have used Binary Defense since January 2020, so it has been three years. 

Binary Defense is highly stable. I can't think of a time when the cloud or management interface had gone down. 

Binary Defense scaled pretty well. We had a significant surge in our business a couple of years ago, and we had no problem scaling when we added tons of new endpoints and facilities.

Binary Defense is in our backyard. They're based in Ohio, so we aren't limited to interacting with them through chatbots, and they don't make us do everything through a tech support ticket. We can call them, and they'll visit us on-site. They have periodic reviews to ensure they're delivering value. It feels like a real partnership instead of something transactional.

They become an extension of your team through their 24/7 SOC. The tool plugs into your environment, and you're getting alerts. It feels like they're in the trenches with you fighting the bad actors.

The deployment was straightforward. They provided us with the agent and instructions on how to deploy it using our existing tools. It was a few days of work, but we spread it out over a couple of weeks. 

Binary Defense helped us throughout the process. It was painless. We didn't need much help, but they were there to ensure the agents were correctly deployed and feeding data to the cloud. They also provided some training. It was a pleasant, positive engagement overall. Three people were involved: a project manager, a cybersecurity analyst, and a network administrator to deploy the agent.

After deployment, Binary Defense requires very little maintenance. The only thing we need to do on our end is update the agent when a new version is released. 

The easy ROI for us to calculate is the savings we realized by not having to hire staff to monitor 24/7. We would need at least four full-time staff to cover that. That's around $300,000 annually. At the same time, it's hard to put a price on the cost of a data breach or ransomware incident that could potentially cost millions. 

Binary Defense charges by the endpoint, and the price was cheaper than competing products. Their pricing model is fair. If you exceed the number of licensed endpoints, they will let you upgrade without charging you a penalty. 

If you're worried about the cost, I would recommend checking Binary Defense's prices. It's reasonable compared to what the other solutions are charging. It's hard to understand the value without trying an MDR solution. It's like not having a lock on your front door or your house. It's just necessary. 

We also looked at solutions by AT&T and Cisco. We chose Binary Defense because it's a managed solution with 24/7 monitoring. Many other vendors only provide you with the product but don't manage it. It's only a tool that you install. You need to configure the solution to filter out the white noise. That was the deciding factor. 

The price was another factor. Binary Defense brings good value. You get alerts about attacks minutes after they occur. I don't think the difference in response times between Binary Defense and competing solutions was huge. I don't remember precisely, but I believe Binary Defense was faster or at least competitive with the other products. 

I rate Binary Defense MDR a ten out of ten. If you're considering Binary Defense, I recommend looking at your cybersecurity program and deciding whether 24/7 endpoint monitoring will help you meet your objectives. Most people will find that Binary Defense fills the gaps in their cybersecurity and offers a better value than competing solutions.

We use it to get security notifications. There are only two security people on my team, and monitoring things 24/7 would take a team of 10 or 12. We use Binary Defense to help monitor things for us so that my team can work on the day-to-day security tasks.

They send us alerts and have done a really good job of eliminating the false positives. Early on, there were quite a few. But as they learned about our organization and the roles of individuals within it, that has drastically gone down. For example, initially, they would say so-and-so ran a script. Now, they know who our sys admins are and that running that script is typical for them.

The benefits are the visibility into current critical security events and the effect on our time to respond. Binary Defense has helped reduce our security alerts because we know where our trouble points are, or if we're missing things, and what we need to deploy. It has given us visibility into what to put in and that is how it has helped us the most. I would estimate it has reduced our security alerts by 60 to 70 percent. It has improved our security posture significantly.

And because they do a lot of the management for us, it has reduced our team's workload. We only have to work on the stuff that's identified as something we need to work on, so it has definitely helped performance.

Among the valuable features are the

• agent and continuous reporting
  
• dashboard.

It has all the features we need and we haven't had to customize it, other than turning on certain features that we wanted.

It's hard to think of anything that they need to improve on, but just to point out something, I would like to see them provide advanced XDR.

I've been using Binary Defense MDR for a little over three years.

It's very stable.

We have just under 2,300 agents deployed. I don't know how much it scales. I don't think we rank among the larger sizes of companies, but they thought we were a pretty big organization.

Their support is great. Our experience with them has been very good every time we've had to contact them. They are responsive.

Positive

We did not have a previous solution.

The initial deployment of MDR was straightforward and very easy. It installs automatically and we were pretty impressed with that. They had the right tools to give us to deploy it.

There were three of us involved in the deployment, and that includes me as director of our team, but I didn't do much. It was mostly one technician with some help from another, and it really was done mostly by that one.

There is no maintenance on our side. They automatically update the agents.

The return on investment is the amount of time that we're saving and the fact that we're getting a security analyst. Without Binary Defense, we would only have a team of two security analysts. We would need 10 to 12 analysts to do what they're doing and give us 24/7 coverage. Without them, we only have nine-to-five coverage.

The pricing is very good. They are definitely competitive and they were lower at the time that we went with them. That's not why we chose them, but it's always something you have to consider.

You need the right security tool. Cost doesn't matter if it's a little bit higher but it's the right solution for your business. You shouldn't skip on security for costs.

We did what we call a "battle card" and compared Binary Defense to CrowdStrike, Sophos, and other leaders. Our team's consensus was that they were the best fit for our organization. Compared to competing solutions, the response times from Binary Defense were equal or better.

We have not done an integration of Binary Defense with other tools. We're looking at integrating it with our help desk, but we don't use ServiceNow. We use BMC Remedy and that's what we have to look into. I don't think any issues with the integration would be limitations of Binary Defense, but there might be with our older ticketing system. Binary Defense can work with many open APIs, if I recall correctly.

They also have a great open XDR strategy for securing infrastructure, although we haven't started using it. Early on, I talked about it with the owner of the company who was part of the technical team. It was definitely on their road map and something they knew they had to do and they were working on it.

Overall, our partnership with Binary Defense is excellent. If someone at another company that is using MDR doesn't think that their provider is an extension of their team, they have the wrong provider. Maybe they don't have Binary Defense, because it shouldn't be that way.

We're a small business, but we have a large number of endpoints to control. For an analyst, it's a large task if you have a thousand endpoints. So, we use the BDS tool, and we use them as a SOC for our tier one and tier two support. They take all our alerts and vet them, and then only give actionable ones to either my analyst or myself.

We're a Cisco shop. I'm kind of old-fashioned, so I've got layered security in the organization. We've tied that all into the MDR solution, so not only do I have their tools, but I have our tools mixed in there. We have a very good view of the whole organization. If something were to happen, we should be able to catch it before it gets to the second endpoint if it's able to get that far.

I'd have to easily hire four FTEs to replace what we have with Binary Defense and their tools. From a SOC perspective, from a reactive perspective, and from a prevention perspective, the automated part of their tool offering gives us the ability to stop things before they happen, and there's no way just one or two humans with some alerts could do that.

They have helped reduce our actionable security alerts. They vet every single one of them before we get them. We no longer see all of the false alarms and all of the smaller things that looked like something bad but weren't. Last month, there were 3,700 alerts, and out of those, we had zero sent to my admin or me. They were all handled by Binary Defense.

It has enhanced our security posture greatly. From a CISO perspective, I sleep at night. When it was just me and one analyst and the phone went off in the middle of the night, we had to respond to the alert that was coming from our SIEM whether or not it was an actual alert or whether it was a false alarm. I don't get false alerts anymore. I only get alerts when they're actionable, so from my standpoint, our stress level has gone down greatly. 

It has saved us time. Once a quarter, they get together and tell you how much they do. They have statistics on how many hours they work. If they weren't doing it, it would be either me or my one admin. I know one month was extremely busy. We had a change of CEO back in January, and we had probably three times the activity on our firewalls and endpoints than we ever had before, but there was no uptick in my calls at all. They handled it all. That one month, they saved me about 126 hours. That's a forty-hour workweek. That's at least one FTE full-time, and you need at least two or three realistically if you're on a 24-hour schedule.

The speed at which their services are reactive is valuable. Nowadays, when a threat hits an endpoint, you've got minutes, not hours or days. Their average response time is about four minutes on an alert. For anything that needs to be sent to us, it's about fourteen minutes, which is pretty good. They're the third SOC that I've used in fifteen years. By far, they are the quickest ones to act. When you're looking at prevention, that's a key factor.

I've not run into any limitations when it comes to customizability, so it's pretty good. We don't even use the same SIEM that they use, but they were able to work with us and ensure that the alerting gets into our system and to theirs. I consider that pretty positive.

I've not had any issues with integrating it with anything that's under support or current. The only real issue we've had is with older legacy systems, which means anything that's prior to 2008 servers and older operating systems that are out of support. In some parts of the IT world, you don't have the time or the money to replace something because you're getting rid of it, so you just let it die on the vine.

This is my third SOC. I have never had anybody react as well. So, it's hard for me to provide something that they could do better because I'm really happy with them. I just signed another three-year contract with them.

I don't find any downside to them, but if I have to put one, it would be consistent manpower or staffing. The only area where the solution can be improved is going to be with people. As they grow, they are struggling with the same thing that every other company is, which is getting talent and getting that talent to stay, but they've just revised their tiering system to go from a flat analyst and manager to a three-tier solution where it goes through two or three before it gets elevated. That seems to have worked out well, so if one level misses it, the next one picks it up, and it works out fine. Consistent staffing is the only challenge they have because when you're hiring level-one analysts, you go through them pretty quickly. You'll probably hire them at 50K or 55K, and after they do it for a year, they find out they can make 85K somewhere else, and they bounce. So, their turnover is a little high, but that's it.

We have been using this solution for a little over three years.

It's very stable. We haven't had any issues with it at all.

As long as you got the licenses, no problem at all.

Their communication's fantastic. Their response is good. In three years, I've only had one issue with them. It was with communication from a level one analyst before they did the tiering. Within six hours, they had a VP on the phone with me making it right, and it has never happened again. Everybody's fallible. Everybody makes a mistake, but when you step up, admit the mistake, trace the mistake, and resolve it within a short period of time, that makes a customer feel pretty good.

Overall, I would rate their technical support a nine out of ten.

Positive

I used two other well-known SOCs before. We switched because of slowness to respond to actionable issues, this same thing that happened a year ago with Binary Defense. When I reached out to them at BD they reacted immediately, remedied, and followed up. In stark contrast to the other SOCs which were apologetic, they didn't do anything about it. At the other SOCs, we didn't get any more analysts, we didn't get solutions on missing alerts, and they kept missing the boat. When they miss alerts once or twice, that's one thing, but if they miss a couple of weeks' worth of alerts, and there's no response to the tickets, I lost confidence. I had a conversation with both previous SOC presidents and decided to get legal involved. We broke the contract, and I went to Binary Defense. 

We use the cloud solution with tools on each of our endpoints. They host it for us on the cloud. Whether they're servers or our users' endpoints, they all have the Binary Defense product on there for detection and response. We tiled that into Cisco, so we've got the full pane view. With a phone call, we can work with the SOC, and if it's really bad, they have the ability to push a button and take that endpoint offline completely, and then we can contact Binary Defense and get a reverse proxy into them and clean it up.

My admin was involved in its deployment. We had an initial issue with some of the images we had on the desktops. For any of the newer PCs that were imaged properly, we were able to get the install and update fairly easily, but we had some images that weren't done so well. During that tuning process, they worked with us. It took us about two weeks to figure it all out, but they gave us a number of packages for the installation to overcome the issues that we had. They were really good at communicating and working with us. In the case of Rapid7, for instance, everything you have has to meet their expectation for it to work, and they will not make changes for you, whereas Binary Defense people were like, "Let me get so and so on the phone." They got together with our SCCM expert and my admin, and within a day or two, they had that issue worked out with the pushouts, the updates, and the installs, and it worked. We've been able to change all the platforms out by now. The images are pretty solid now, so we don't have that problem.

In terms of maintenance, we pushed out the updates when needed before it went to the cloud, but now that we're using their cloud, it pushes out all the updates and everything for us. It doesn't require anything from us. We have to do the original installation. When we get out a new laptop, it's part of the image, and then it connects to the cloud and gets the updates. That's all we have to do.

We worked with Binary Defense from an administrative perspective and for the initial setup. Our experience with them was very positive. I had a relationship with the folks at least six or seven years in advance of going to them, so I knew the salespeople. I knew the pre-sales and post-sales engineers. I knew the SOC manager, so I felt very comfortable with the people I was dealing with. I'm a retired Navy guy, so I speak clearly and concisely. If there's a problem, I'd communicate it right away. When we had images that didn't accept their client, I communicated that to them, and they resolved it immediately. From their perspective, they told us in the beginning that when we start this, take the time, and let's do this right, and I did that. I took that advice, and that helped us out greatly. That communication was part of it.

On our side, we had probably four people. On the Binary Defense side, there were two or three people depending on the issue, whether it was a server or whether it was a desktop, laptop, or endpoint.

Other than FTEs, I don't personally believe security gives you a return on investment. It's a business expense. You probably don't hear that a lot out of CISOs, but I tell the Board of Directors the same exact thing. You're going to pay for security. It's not going to pay you back, but if it prevents one, two, or three breaches, at what level do you say you're paid up? Based on the numbers over the past three years, I know for a fact that we've had at least five or six breach attempts that we've reverted. That doesn't count the number of emails that get through the system and somebody clicks on it and another tool stops, or somebody is off-site and connected to an open Wi-Fi, and they do something in their personal email, but they're on my PC, so I stopped it and took it offline. 

It's valued at the right price. Even with the number of endpoints we have, we don't feel that it's a lot more than any competitor. In fact, it might be less expensive when you look at the fact that you're getting a full flex SOC out of it along with the tools.

To someone who is looking at purchasing a managed detection and response (MDR) solution but is concerned about the cost, I'd say that it's worth it. I don't know how you put a cost for sleeping at night, but I can tell you that for the first seven years, I was hands-on and concerned about every alert. I had to do the digging in the SIEM and through the tools to figure it out, and most of them were false positives or a piece of software that made it look like it was a threat but it wasn't, or a QA was using a new tool that we didn't know about. A lot of different things happen and you have to respond to them and then you find out at two o'clock in the morning, after you get out of bed and log in and sit for a half hour, that it was no big deal anyway, and you could have slept. They take away all of that issue. As long as you put the time in those first six months and work with them and make it the product that you want, you're going to be happy in the long run with the cost. We did away with a security product once the MDR was in place, and we're getting rid of a second one right now. So, I've been able to justify pretty much a flat spend over a two or three-year period of time by discontinuing things that were doing the same thing that the MDR does in terms of alerts, searching, and things like that, so in the long run, it wasn't any more than what I was spending.

I looked at multiple companies before we went to Binary Defense. I know a lot of people from Binary Defense in the IT community here in Cleveland. It's a pretty close-knit community, so I've known the folks of Binary Defense for probably ten years or more. I know a lot of their customers. They were a little more expensive than the people I came from, but I now see why. They're worth the money.

We looked at CrowdStrike and Rapid7. We're a small company in a small town, and we're a Cisco shop, so it's very simple for us to find Cisco talent to work for us, but it's not easy to find Rapid7 or CrowdStrike. We've already had a contract with Cisco, and we had their security suite in place, so why pay Cisco for their tools where you're committed to them and then go to CrowdStrike or Rapid7 and integrate their solution in there as well? It didn't make sense. Binary Defense was willing to take us out of the box as a SOC first, and then we were able to integrate the MDR solution as a second step. It gave us time to tune the product, set up the alerts, and work with the SOC. We got to feel comfortable with them and got to know them a little bit more. The pricing was less than some of the other solutions.

Technology and gadgets are wonderful things, but customer support is probably more important than the technology itself.

Our partnership with Binary Defense is fantastic. It's my third company, and I appreciate them as much as they appreciate me being a customer.

To someone at another company who doesn’t think that their enterprise MDR provider is an extension of their team, I'd say that they are wrong because there's only so much you can do as an organization, especially if you're a nine-to-five business without a second shift or third shift. This is 24/7/365. They're always looking at your company, and they've got your back and your best interest in mind. That's how they keep you as a customer.

We spent six months working with them to tune everything up to be specific and actionable the way we wanted. If you are looking at implementing it, one of the biggest things I can tell you is to take time on the front end of the engagement to tune your systems to set up the alert you want to be set so that they're tested in the first six months. Once it's going, it's almost set-and-forget. You have to test them every once in a while, but they catch every one of the tests that we give them.

I don't think anybody's perfect, but they're pretty close to a ten. So, I would rate them a ten out of ten because I'm pretty happy with them.

We use Binary Defense to monitor all our devices, including our servers, laptops, and environments. 

We began seeing benefits as soon as MDR was in place, and activity started returning on the endpoints. However, I don't think we realized the full value. We added some other things and refined the configuration to ensure we got all the reports and caught everything. 

Binary Defense helped reduce the volume of security alerts, which varies significantly. There were about 4,000 to 15,000 attempts to log into 365 accounts. We isolated five user accounts that threat actors were exploiting. If they choose another user to mask, we can mitigate those on the spot without returning to them. 

We've hardened our security posture. Instead of observing the things that come through our network, we can actually act on them. We have a team behind us to notice what they're doing. We save money by not hiring a team or relying on one person for security. With MDR, we have a team behind us, enabling us to respond more efficiently instead of just watching things happen.

While Binary Defense doesn't necessarily reduce the daily workload, it reduces our stress because we had to bootstrap solutions to prevent some things from happening. Now, we have Binary Defense protecting us. Binary Defense helps identify real threats instead of flagging activity that might be construed as negative. Their team takes much of the stress and guesswork out of how we execute our security program. 

Binary Defense is comprehensive. We see most of the questionable activity. Once you see things a couple of times and are familiar with the processes, you know what those are. The level of activity is definitely favorable. 

We haven't customized the dashboard much. The default settings are sufficient for what we need, and the tool is easy to navigate. We haven't needed to customize it much. Binary Defense seems to integrate with our environment seamlessly. The agent installs silently, and the combination of the MDR team and their reporting apparently works well because we haven't missed anything yet. 

We have used Binary Defense for about six months. 

Binary Defense has been fairly stable and doesn't affect our systems much.

Binary Defense is scalable. We can add as many endpoints as we need. It's configured so that the agent installs as soon as the employees log in. 

I haven't opened any tickets with Binary Defense, but I've sent them questions about setup and tuning. We've exchanged emails. The solution has been low maintenance, and they were proactive about ensuring each deployment stage has gone smoothly. They have regular events and appointments to touch base with us and hash out anything that we have an issue with. 

Deploying Binary Defense was super easy. We could do it in one day in five minutes if everyone had their laptops online. We're a remote workplace, so it took a few days to cover all the endpoints. The whole process was seamless. We had a half-hour meeting where they gave us the commands to install the agents on our servers and push them out to the employees. 

Binary Defense is reasonably priced, considering that it saves us from hiring personnel and deters threats that could cost us. At the same time, it may look a little expensive to decision-makers who do not understand the value of a tool like this.  

You must consider how much you're not spending or what you would need to spend to recreate Binary Defense's capabilities on your own. You should also think about what you would pay to recover your data in a ransomware attack or how much it would cost to mitigate other threats that get into your system. 

I rate Binary Defense MDR 10 out of 10. We're partial to Binary Defense because they started in Ohio, and we're an Ohio company. We pride ourselves on staying local, and they've grown exponentially over the past few years. You get what you paid for. This is a pretty good deal for the level of service and product quality Binary Defense provides. I have a special connection with Binary Defense, so I feel they're a part of the team more than somebody else probably would.

We're a big company with a small IT shop, specifically when it comes to IT security. We needed a partner that could be an extension of our existing team.

Binary Defense MDR has been that "bolt-on" that we need, giving us extra visibility into our environment and things that may or may not be seen by our existing products. That was really the goal of bringing an MDR in. We have a lot more visibility into things that we didn't before. It has made security operations a little easier, and that was the goal. Automation is king for smaller shops.

It has allowed us to have a little more peace of mind because we know, if somebody knocks on the door or gets on our network or even from the perimeter, Binary Defense is listening. They have adequately detected things and been able to let us know. Even if some things may not be actual threats, they're out there monitoring and letting us know when we might have an issue to look into. The biggest issue for most organizations is that they have people who don't know what to look for or who don't get enough visibility, especially internally on their network. Having a partner that is able to say, "Hey, you've got A, B, and C going on here," and actually filter what's an actionable threat versus what is just white noise, has been a great benefit for us. That was a big problem with our previous MDR: we got way too much white noise.

With every MDR, you go through a period of white noise first for a month or two. That period, for Binary Defense, wasn't anywhere near as long as it was with our last provider. There were reports that we would get from our last MDR that just weren't valuable, on a regular cadence. We also have other tools that Binary Defense integrates with, like Microsoft's Defender for Identity product, and they are able to respond at a faster rate. And there isn't a pile of noise that we have to go through and waste people's time. It's not just done with AI, but they actually have someone looking at a ticket and saying, "I've got X, Y, and Z," or "I've got possible indicators of compromise. Let me escalate to somebody."

Using Binary Defense has saved our organization time. I wasted a lot of time going through white noise tickets from our prior MDR. On average, I would see 10 or 12 tickets from them per day and, 90 percent of the time, they had no valuable information. They were things that really didn't need to be brought to my attention or that somebody in their SOC didn't really look at closely or correlate the data. Their white-listing time period was really long, and I gave them that feedback a lot of times in our one-on-ones.

With a new MDR, you expect a time period where you're going to get hit with white noise. We really didn't have that when Binary Defense flipped the switch. Sure, we've seen a little bit of white noise here and there, but nothing on the scale that we saw from our previous provider. We had a few oddball tickets, but they actually had valuable information, things that I didn't know were going on. We were able to change processes around those. That has been pretty helpful.

For example, our pen tester likes to be sneaky. They used one of our help desk tech's credit cards to create an account to do their tax with, and Binary Defence caught it. Through the purple test, we were able to identify that we needed to see this information. We changed our process so that when those tickets come in, we're able to copy our help desk so that they can verify things.

Binary Defense has definitely helped reduce our IT team's workload. It allows us to focus on things that are high-priority security issues. Our last MDR would just toss stuff over the fence. But this service has helped to reduce the footprint of escalations from a security perspective, and if something is a "911", they'll call and say, "You need to look at this immediately." That is very valuable because we're not wasting people-cycles trying to chase little things that may or may not be important.

Also, I've had phone calls from their SOC team where I have been shocked at how fast they have responded. For example, suppose one of our admins escalates somebody's rights. They have called me directly and said, "I've got a user here that's doing these changes," and that was within a few minutes of them detecting it. That is A1 customer service, especially when time matters from a security perspective. I believe the pitch that Binary Defense gives people is that they respond somewhere within 13 to 15 minutes, but they've always met or beat that.

Compared to our past MDR, their time to alert has been fantastic. Before, we had a lot of scenarios where we just weren't getting effective alerts. Binary Defense also has honeypot tech deployed and that has been really great. I've had some really good feedback from other ops folks about that. 

Their processes and the way they document their tickets have been really valuable to us too. With our prior MDR, they would say, "Hey, we see this," but there would be no technical details. We're a very technical group because we're so small. We have to have experience in a multitude of things. The tickets from our prior MDR just weren't valuable. With Binary Defense, we don't just get an alert, but also a detailed rundown of why they're alerting us on it. They tell us what was executed, or the username, script, or IP. That way, we're not wasting time investigating.

Customizability with Binary Defense is better than a lot of companies that I've seen in terms of modifying their playbooks and tooling them the way you need them. We've done a few things, especially after doing pen tests and purple tests, and we have been able to tighten or customize a rule. That has been really great. With our last provider, one of their failures was that they didn't really want to talk about their playbooks and there wasn't that level of customization that Binary Defense has. I definitely give them top points for that.

Their integration with other applications and tools is not something I would call a complaint, but it is something they need to work on. In my experience, a lot of our integrations are done through APIs. A lot of what I've seen so far from Binary Defense—not all of it—seems to be beta integrations.

For example, their Duo and Proofpoint integrations aren't really what I would call ready for production. They have probably been working with those vendors to work out the kinks, but they're really not 100 percent production ready. And while there isn't really anything valuable we would get from Duo from a reporting standpoint, sometimes Proofpoint's SIEM tool or SOC can see something that might be valuable. We already get alerts from Proofpoint, so it's not a "make or break", but I have given this feedback to Binary Defense: This is something that should go the API route.

Their Microsoft integrations are top-notch and they do some third-party stuff really well for log ingestion, but I would like to see Binary Defense's development team change over to an API connection, versus how they do it today.

Also, if I were shopping for an MDR solution today, I would not only look for a company that has the ability to alert, detect, and remediate, but also the ability to integrate vulnerability management. That's a big thing that they're lacking today. We offset that with another product, but that should be part of their product offering. I've given this feedback to our account manager too.

Another point is that maybe they should have their own SIEM offering. Today, they offer AT&T's AlienVault, which is a good product in its own right, but it's not something that they offer directly from themselves. It's the same thing with Azure Sentinel. They just started offering that as a product you can buy as part of their service, but it's not their own SIEM. I would be interested in seeing them build out their own SIEM and offering that as a product you could buy. That would be very valuable to their customers because they would not have to rely on their folks learning another system.

We've had Binary Defense MDR for about seven months.

So far, the stability has been good.

The feedback we got from another company that had passed on Binary Defense was that they thought it had good scalability, but they didn't think it would work for them. The reason that it wouldn't work for them was that they had too many kinds of devices. They not only had workstations and servers and endpoints, but they had a lot of specialized manufacturing devices that they needed to monitor.

That is no fault of Binary Defense. That kind of customer isn't really their target audience. Their target audience is shops that are purely Linux/Macintosh/Windows, that don't have specialized industrial products.

Their support varies on who you get, but in comparison with other companies that I've dealt with, like Rapid7 and a few others, I would give Binary Defense's support an eight out of 10. There are definitely some improvements that could be had, but those are more around training. I think they're going through expansion right now, building out their product and adding more folks.

My only call-out would be that they have some techs that need to take a closer look at account notes for customers. They may need to work with some of their newer folks and get them to be a little more attentive or a little faster in their responses.

I've had a couple of tickets where the replies were delayed, but those things happen when you're hiring new people or training them. Sometimes that slips through the cracks and there's nothing you can do about it.

Also, I can't say that Binary Defense has changed our security posture because our relationship, at least so far, has not been like that. They should probably add an SME or an adviser to each account. We have regular cadence meetings with our account manager, but other MDRs that I have PoC'd would always have, as part of their product stack, a time period where somebody from the SOC would say, "Hey, these are the things we saw." That's something our account manager does, but those other services would give recommendations on goals, from a security perspective, that we should look toward.

In terms of our partnership with them, I would give it a grade of 90 percent. Obviously, there are days when things fall through the cracks, you always have to calculate for human error, but it has been a great partnership so far. A year from now—and this is what we do with every product—we will reassess and evaluate and do a pen test to make sure that we're getting the security operations that we expect out of our products and teams. I would suggest that anybody in the midsize company space that needs a good partner to keep an eye on their environment, one that can be flexible in that environment, look at Binary Defense.

Positive

We had a prior company for a year called Arctic Wolf that we were not happy with at all. One of my colleagues who is a pen tester had suggested Binary Defense, and we ran a PoC with them. They did really well, scored really high, and they have been a great partnership so far. 

When we did the purple test with Arctic Wolf, they failed really badly. We gave them an opportunity over the course of a year to improve but they just weren't improving. They were wasting our time by pointing out things that were more "busy work" instead of actually addressing their problems. The big buzzword that they used was in saying, "Well, this is in beta." I would say, "Well, you're a production-level company. Everything in your playbook should not be in beta." I would hit them with random pen tests and, in almost every instance, they would fail. They might catch one or two things here and there, but they were things that I would have expected anybody to catch. And the things that they failed on were things that any MDR product that's worth its marketing should be able to catch.

We don't have anything in the cloud, we have some other sensors on-prem, but we do have their agents deployed everywhere. That means we have some Azure assets that have their agents installed. We have API integrations with all of our Microsoft products and some third-party stuff such as Proofpoint and Duo MFA. All of our servers and workstations have their agents deployed and we have the AT&T AlienVault SIEM set up. We have logs from our firewalls being sys-logged up to that and a few other products. We're somewhat blended but it's mostly on-prem.

In terms of the initial setup, my career path has been engineer-level, so for me, it was pretty straightforward because I'm familiar with how their configurations work. Someone who is, say, only five years in, might have a little more of an issue. But their documentation is done really well, once you get access to the portal. They have links that walk you through it step by step to do the configuration. Obviously, there is an expectation that you are at a certain level of IT experience to install and deploy it. But it was well within my expectations of what an MDR deployment process should be. 

The follow-up, from an implementation standpoint, could have been a little more fine-tuned. For example, with Proofpoint, Binary Defense doesn't use an API integration. They use some script with a VM to ship that data off to their cloud ingestion. I think there's a better way to do that but I can't fault them for that because that's what they're getting from Proofpoint. Overall, the complexity of the setup, between one and 10, was a seven or eight. For me, it was really easy.

The only maintenance that I've seen is agent-based, and that's all done through the cloud.

I worked with Binary Defense to implement the system. They have an implementation team, a few engineers and a product manager, who walk you through the process. Our experience with them was good. It was better than my last MDR deployment, in terms of how they ran the process.

Near the end, it was our team pushing forward certain things, but the things we were griping about were things that are out of their control, waiting for third-party vendors to address. But that is something I would have liked to have been apprised of earlier in the process, that they really didn't have a great integration with this or that. 

But overall, it was a night-and-day difference in comparison to Arctic Wolf.

We have seen ROI with Binary Defense, and my leadership is in agreement with me on that. Our CIO and our director of infrastructure both said they have had a really good experience with them, especially when compared to our last MDR. 

It has saved us a lot of time, headaches, and money overall. Today, it's not if you're going to be breached or attacked, it's when. That's the reality of the security space, so monitoring and having those insights are key. There will always be threat actors who try to exploit something. For example, as soon as the SVB failure happened, there were reports of phishing attacks increasing exponentially for customers of that bank. The threat actors understood they had a little bit of a window to attack these folks because they were vulnerable to a phishing attack. That's something you have to address in this space.

With our prior MDR, there would be three or four days during the work week, and sometimes weekends, where I was wasting time responding to tickets. Now, going into the evening or the weekend, the only time we get a call is for something that has actionable intelligence. That has been a relief for our team. We know that if something crazy is happening, they will call us and tell us we need to address it immediately.

All IT companies inflate their pricing to some extent. But sometimes companies don't have a big budget. The provider comes in with a high number and then they whittle it down to what both parties can accept. 

Binary Defense is hindered by the fact that the SIEM they are offering is a big part of their price point and they have to eat it, sometimes, when they try to get a midsize or small company. They either have to filter down their log ingestion or lose some of those logs at the end of the month to meet their cap. That was one of the only positives with Arctic Wolf. I don't know who they were using, but they claimed to have an unlimited monthly amount, and then had cold storage for 90 days.

That is one thing that is lacking for any MDR. It's not necessarily an issue specific to Binary Defense. It's just how their pricing structure has to be.

From the initial cost that Binary Defense came in with, we pared it down quite a bit over the course of 30 or 60 days. My leadership would say that their cost was high, but realistically, they were in line with the market.

They have a good product offering in terms of their XDR strategy, but they could retool it a little bit. I've talked to CSOs and other people in the security space— and this isn't just a problem for Binary Defense—but they have what I call the "package problem" where they try to "line-item" things. I understand they're a service and trying to make money, but the big players like Binary Defense and CrowdStrike need to talk with their marketing and product line people and say, "We need to offer an all-in-one solution."

Binary Defense also offers things like deep web scans and a new product that is a collaboration with ExtraHop Networks. They should look at providing their own product. And that deep web stuff should be in an all-in-one package. The reason that we didn't go with that is I didn't think the cost was worth it when there are third-party or even free tools that you can use to supplement that. It just didn't seem like the value was there. If it had been an all-in-one package, as part of the MDR, there would be more value in that. Maybe a larger company that has a bigger spend might be more inclined to mix and match and buy parts of it, but a midrange company like ours needs an all-in-one solution.

We PoC'd, Binary Defense, Rapid7, and a third product, but we eliminated that last one pretty quickly because it didn't meet our needs. Rapid7 had what looked like an okay product offering but we got some feedback from some CSOs and other people in the security space who were not happy with the product overall.

I wasn't happy with Rapid7 because they would not let us PoC their SOC. They would only let us PoC their MDR bolt-on. Near the end of the process they said we could PoC their SOC, and that really annoyed us because they had wasted our time saying that we couldn't do that.

At the end of the day, from a technology standpoint, Binary Defense met our needs for an MDR provider and checked all the boxes. They went above and beyond and that really played into our final decision. I also got some feedback from pen testers who said they had gotten really great feedback on that company and that influenced our decision as well.

You can't just take response time into consideration. The information that they respond with is just as important. But Binary Defense succeeded in both those aspects every time. During the PoC, their response time was really fast, within a few minutes. In my experience, they have been in the 89th to 90th percentile for response time, given what I would expect from MDR.

With Arctic Wolf and Rapid7 as examples, they would alert within a pretty decent amount of time, but the information wasn't as valuable. They would link to MITRE ATT&CK documentation, but that doesn't do you any good. I want to know "who, what, where, when". That's essentially what I get from Binary Defense, the meat and potatoes information that is most valuable to me as an IT professional. 

There are two types of MDR and security solutions today. There is the kind that deals with IT people who want to see a certain level of information so that they can investigate things on their own, and they need the right information in front of them. Other solutions are for IT folks who are at a certain level but they only want just enough information to allow them to check off a box. 

The playbooks for Arctic Wolf and Rapid7 were not that impressive. Rapid7's technology was a little better than Arctic Wolf's, but neither was anywhere near as complex or as well thought out, as a product stack, as Binary Defense.

Anybody who is looking for an MDR needs to have a serious conversation with their leadership about their needs or what problem they are trying to solve. That's what we did. In our case, the problem was that we didn't have enough people to keep our eyes on every single bit of day-to-day operations from a security perspective. We needed a partnership, an extension to our staff. And it has been great.

The big "gotcha" is you need to figure out what you need and what your expectations are for the cost. You have to weigh what it would cost to pay a full-time security person throughout, because they're not cheap. The market is screaming for security people right now. There are hundreds if not thousands of companies looking for security people. IT leadership has to say, "We can either pay X dollars per year for a SOC service to help us manage things, or we can get a manager and a handful of SOC analysts to bolt on to our existing staff and pay them 2X dollars a year."

Another driving factor is cyber security insurance. That space has changed a lot, especially in the last five years. That was a big talking point within our organization because we needed to tick the boxes or we were not going to be able to get cyber insurance.

Another factor to be aware of is long-term stability. Mandiant was on our shortlist when sourcing our prior MDR solution, and we didn't go with them because they were way overpriced. But what ended up happening was that the company was split up. So that was a concern of ours with Binary Defense. You see that in the market. There are companies that are really hot, they do really well, and then they get to a certain level and they're bought by a larger company. That was a conversation we had with our account manager. We asked what their "five-year" looked like and what their growth looked like.

That was the big concern for our CIO: Are we going to be replacing you in a year or two? Are we going to reevaluate this conversation because the relationship has changed or the quality of the product has changed because you've decided to have a third party invest in you and now you're not giving us the same product stack or customer service that we had? That has not been an issue so far. Based on the outlook that they gave us, it seemed that it was not going to be an issue.

Binary Defense provides us with Security Incident and Event Management (SIEM), managed by their third-party SOC team. They are our MDR provider that provides MSSP services; they review the alerts coming into our SIEM from all our devices across the globe, then translate those into alerts and incidents, and elevate them to my internal team, and we take care of it from there.

Our environment is global, with three primary regions: Asia-Pacific, Europe, and North America. We have several remote sensors in each area, with intrusion detection sensors at some locations.

The solution improved our organization because we have a very small information security section augmented by a great team at Binary Defense. There's no way my small staff could handle the volume of work they do; to sift through the 23 million plus alerts, do the analysis, address them promptly, and provide 24/7 support. The service is truly remarkable.

The product helped reduce our security alerts; when I first came to the company, they hadn't had a security person for about six months before I arrived. Binary Defense was dealing with the lion's share of the load on the outside, and when I came in, we reduced the alerts through our collaboration. Since then, we've also streamlined the filtering and notification process, which has been integral to updating processes on our side. The Binary Defense team is just as responsive if we see a possible improvement in their operations to improve their service for us or other customers.  

Binary Defense helped reduce our IT team's workload, mainly by streamlining the processes and reducing the volume of notifications and alerts, which equates to less time spent on false positives, etc. My team can focus on actual alerts rather than false ones, and that's integral. Regarding time saved, we went from having close to 300 alerts when I first got here, and we're now down to about half that. That's a 50% time saving due to the analysis the solution provides and how it now tunes out all the noise.  

The most valuable features are the SIEM and the ticketing function; the latter is very smooth and easy to read and understand. We don't have any issues looking at the ticketing information when we're trying to identify what's going on.

I love how customizable the solution is; the Binary Defense team has been integral in ensuring we get the right alerts etc. They're super responsive; whenever we reach out to them, we have never waited more than 30 minutes to get a reply to an email.  

Binary Defense MDR's ability to integrate with other applications and tools is incredible; their team's knowledge of the platform and their ability to integrate it into our environment is outstanding. Their capacity to work not only with me but, on occasion, directly with my users across the globe to assist and fix problems has been remarkable.  

The solution is excellent for securing our infrastructure from end to end so we can detect and remediate threats. We're a very small shop with three staff on the operations side of information security. As such, we lean heavily on the provider that provides MSSP services tool and relies on the logging solution to keep an eye on the situation as well as it does. The way the Binary Defense team can change with the environment, how alerts are happening, and even the log sources have been fantastic. 

The most significant area for improvement is in support for non-English speakers; we're a global organization, so many of our users are not English speakers, which can make interacting with them a challenge. There's no Chinese language support, so we must rely on what we can do with the internet. We don't expect Binary Defense to build a language staff, but details can get lost in translation when we assume the whole world speaks English.

We have been using the solution for just over three years. 

The solution is highly stable; the only stability-related issue we ever had was on the AT&T side when they pushed updates, but that's unrelated to Binary Defense. Binary Defense provides 100% stability; we haven't had a day without support.

A testament to the scalability is how we have deployed the solution globally, and it's very flexible in this respect. We have moved sensors left and right to adjust to the network or structure change; Binary Defense is very scalable.

The implementation team is there to help us whenever we have an issue, and I rate them nine out of ten. We only once had an issue, so minor I'm hesitant to call it an issue, and overall, we're delighted with the support we receive.

Positive

Binary Defense is the first solution of this kind I have used. I wasn't involved in choosing the product, but I did decide that we would stay with it. I reviewed some other solutions, but none would provide the same level of support we get with Binary Defense. It's tough to find a product that can match its combination of SIEM and MDR provider that provides MSSP services.

I wasn't involved in the initial setup, but I worked with the Binary Defense implementation team to deploy the product's sensors, etc. They're outstanding; they're always there to help us if there's an issue with a sensor or a portion of the program, deploying to remote areas as we do. Whether filtering the program down or tuning it, we always have access to their support.

Regarding maintenance, general tuning is the most significant aspect we spend time on, which is the case for most solutions in the security environment. Specifically the tuning out of false positives so we're only focusing on the true positives. We have two internal staff responsible for maintenance, and on the Binary Defense side, their implementation team has at least three managers with staff under them.

We see an ROI all the time; the fact that my team is free to work on other projects and security initiatives alone is worth its weight in gold. To quote my manager in our last budget meeting, ''There is no service out there that could compare to what we're receiving from Binary Defense. Binary Defense is a supplier that we must maintain and retain going forward in this company.''

The solution's price is spot on; if anything, it's slightly below the norm for most services. Compared to building the same team internally, it would cost more to create the same amount of capability than what we get from an external team. Price-wise, Binary Defense is in a great spot.

I rate the solution eight out of ten based on AT&T's portion, as they have to be ranked together because of the integration. Regarding the Binary Defense portion of the product, it's nine out of ten. AT&T sometimes doesn't consider how their updates apply to everybody else, which is a typical IT problem.

My assessment of our partnership with Binary Defense is ten out of ten, and I wouldn't want anyone else to be doing it.  

To those looking at buying a managed detection and response solution but concerned about the cost, every information security professional is likely aware there is a general lack of money spent in the industry on information security. It is an easy budget for organizations to cut, and it can be challenging to expand it. Although the cost is somewhat high, Binary Defense provides two services quoted as one. I cannot overstate how much of a load the combination of SOC and SIEM provided by the MDR provider that provides MSSP takes off an internal security team, freeing them up for other security projects. You spend some money but make a lot more in the end.

Comparing response times from Binary Defense versus competing solutions is challenging as I have yet to experience competing solutions. However, if we were to remove the SOC element that manages alerts, which many solutions either don't have or integrate as well, then the time spent looking at false positives would increase so much that we would lose any benefit from the service. A provider who can't offer the SOC and SIEM integration Binary will always be at a loss to them because the way those two elements work together can only be found in their product.

I advise anyone evaluating the solution to do a POC; you won't be sorry. The product offers peace of mind that can't be found with a singular solution alone.

With Binary Defense MDR we check and handle security issues, closing ones that are okay and acting fast on potential problems. It is all about keeping things safe and responding quickly to any cyber threats.

The alerts from using Binary Defense have been a significant benefit. They help us identify potential problems, prompting further research to determine if there is a cybersecurity incident.

Binary Defense has helped reduce security alerts by providing weekly recommendations on actions we can take to decrease them. It has significantly strengthened our security posture.

It has reduced our IT team's workload by handling entry-level tickets, requiring less research from our side.

The most valuable feature is reviewing tickets and the notes added by technicians. It helps us decide whether to close a ticket or if more research is needed. It is a straightforward way to understand and take action on what happened.

We are very satisfied with Binary Defense's XDR strategy for end-to-end infrastructure security.

The only area I see for improvement with Binary Defense is their service portal. It could benefit from some enhancements.

I have been using Binary Defense MDR for a year.

We have not had any stability issues with the solution.

The support is very timely and accurate. I would rate the support as a nine out of ten.

The response times from Binary Defense have been in line with the agreed-upon statement of work. They have consistently followed through on the features and promises outlined in their quotes and statements of work.

We are pleased with our overall partnership with Binary Defense and hope to see the relationship continue to grow.

A good enterprise MDR provider, like Binary Defense, should feel like an extension of your team. Their approach makes it seamless and ensures the client feels supported, which might not be the case with other providers.

Positive

We were using Tech Mahindra as our third-party SOC before Binary Defense. We decided to switch because we moved from QRadar to Sentinel, and Binary Defense was a better fit for that transition.

The initial setup was quite straightforward. We worked with Binary Defense for the initial setup and implementation of the system. There is some maintenance required after the deployment. Ongoing updates to data collectors are needed to stay current with software versions and patches.

Binary Defense is fairly priced. I would say that Binary Defense is flexible in negotiating and tailoring a solution based on your specific needs. They can work with you to customize the MDR solution, potentially saving you money on features you may not need. They are customer-friendly and flexible in that sense.

I would advise new users to research at least three vendors to ensure they find the best fit. While Binary Defense works well for us, it might not be the ideal choice for everyone. We are satisfied with it, but it is crucial to compare it with at least two other options before making a decision.

I find Binary Defense to be less customizable. While they are flexible if we need changes, the current product we use doesn't offer much room for customization.

Binary Defense doesn't currently integrate with other tools, but they are working on it. While it is not a problem now, the fact that they are actively addressing it is reassuring.

Overall, I would rate Binary Defense MDR as a nine out of ten.

We are a small cybersecurity team for a medical advice company. We use an MDR platform, which gives us access to a team of security analysts in a SOC. The analysts send us daily reports of security events, which they rate as critical, high, medium, or low. They also work with us to determine what threats we need to be most concerned about, such as those that could impact our Google Workspace or AWS environments. The analysts then create playbooks to help us respond to these threats, and they monitor our environment 24/7. We communicate with the analysts via Slack, and they call us if they identify a critical threat. Overall, the MDR platform has been very effective in helping us to multiply the force of our small team.

Binary Defense's cloud-based SIEM solution is fully deployed in the cloud. They collect logs from AWS and Google Workspace and then integrate those logs into their data lake. They then use the cloud to integrate their data lake into their SIM solution. Finally, they put the SIEM solution into a user interface, which is where users interact with it.

Binary Defense MDR is primarily integrated into our AWS environment, but it is made up of multiple components. My technical lead said that it was very easy to integrate into our Google Workspace environment. I did not have much involvement in the integration, but my subject matter experts said that their integration was very seamless.

Binary Defense offers customizable event detection and response. For example, if we have a confidential file, we can tell Binary Defense to flag any emails or other communications that contain certain keywords. This type of customization allows us to focus on the specific events that are most important to us. Binary Defense also offers 30-day retrospectives and monitoring for employee terminations, so we can be sure that our data is protected.

The Open XDR strategy made my life so much easier. It helped us to secure our infrastructure from end to end so that we can detect and remediate threats quickly and effectively. One of the biggest benefits of Open XDR is that it allows us to rely on a single partner to monitor our systems. This frees up our time so that we can focus on other aspects of security. Another benefit of Open XDR is that it is incredibly communicative. We have a Slack channel where we can quickly and easily communicate with our partners. This has been invaluable in the event of critical incidents.

Binary Defense MDR improved our organization by multiplying our security forces. They filled a huge security gap by providing end-to-end monitoring of our Google Workspace and AWS environments. This gives us peace of mind knowing that someone is watching our systems 24/7.

Binary Defense MDR significantly improved our security posture. They filled a major blind spot in our security program by monitoring our systems 24/7. They have also been a valuable asset to our team, helping us to pass our SOC 2 audit with flying colors. Additionally, they helped us to comply with a variety of regulatory requirements, including those of the FDA, GDPR, and HIPAA. Overall, Binary Defense MDR has been a tremendous asset to our organization and has helped us to improve our security posture significantly.

We have a dashboard that shows us all the cases that Binary Defense handles. Without looking at it, I would say they handle 90 to 98 percent of our low-level alerts. This means that when they bring something to my team or me, we know that it is worth looking at. They have already looked at it and determined whether or not it is something that needs to be escalated to the client. If it is not, we can simply mark it as closed and move on. We only need to analyze about three percent of the alerts that Binary Defense looks at. This is because they automate the process of reviewing low-level alerts, freeing up our team to focus on more complex issues.

Binary Defense MDR significantly reduced our IT team's workload. We could not do without them. Their services allow us to monitor a large number of alerts seamlessly and completely automated. Without Binary Defense, we would not be able to maintain our strong security posture.

Binary Defense MDR saved our organization a significant amount of time. We no longer have to spend hours manually searching for and investigating security threats. Instead, Binary Defense's team of experts does this for us 24/7. This freed up our time to focus on other important tasks, such as developing new products and services.

The case interface is Binary Defense MDR's most valuable feature. When we receive an event that needs to be escalated to the client, Binary Defense MDR handles 90 to 95 percent of the cases internally. This saves us the time and effort of having to manage our own case or event management system.

We have great visibility into their Google Workspace, but there are some limitations. I'm not sure if they're on our end or Google's end, but we haven't been able to integrate our Gmail system with Binary Defense's. We did the analysis, but it would have been too cumbersome and noisy. So we're monitoring Google on our side. That's something we haven't been able to automate yet.

I have been using Binary Defense MDR for one year.

Overall, Binary Defense MDR's stability is good. We found a couple of bugs in the user interface. The service has never been down, and they are very communicative about when they will be doing maintenance, as we would expect. This maintenance is very limited. When I found bugs or clunkiness in the user interface, I communicated the issues to Binary Defense, and they were fixed quickly.

Binary Defense integrated so well with our organization that we have not needed to scale our security operations. I am hesitant to speculate on how their service would look for a giant enterprise, but for our medium-sized organization, they are perfectly scaled to our environment.

We have had very few interactions with Binary Defense's support team. I think there have been two or three instances. In one case, they fixed a problem very quickly, within a couple of hours. In the other cases, we just asked them clarifying questions. I mainly work with one person, who is one of their leads. I deal with him several times a week. If I have a problem, I just tell him about it and he usually fixes it right away. Only a couple of times have I had to submit a ticket, and that was only because I didn't want to bother my contact. In those cases, they were still very responsive and fixed the problem quickly.

Overall, I have been very impressed with their support team. They are always quick to respond and they are always willing to help.

Positive

Before we brought in an MDR provider, we were very scattered. We had to look at three different screens on AWS, two different screens on Google Workspace, and five or six different tools for vulnerability scanning. This required a lot of time and attention, and we weren't able to correlate all of the information together. Even for minor alerts, we had to look in three different places on two or three different platforms. Now that we have Binary Defense, we have a single pane of glass for all of our security information. This saved us a lot of time and effort, and it made it much easier to identify and respond to threats.

The initial setup was very straightforward. From a technical perspective, we integrated the system in a couple of days. Binary Defense then had to do some work on the back end, which took a few weeks. During that time, we had weekly meetings for one or two hours each day to discuss the integration. This was mostly to dial in different systems and get our team ready to work. The technical integration was straightforward, and we were able to migrate to their newest system in just two hours.

As the director of information security, I organized the team on our end and made sure we had the right engineers. It took two engineers to complete the integrations. We had one engineer for AWS and one engineer for Google Workspace. They did independent integrations on their systems. I was responsible for the meetings and other tasks.

It took a couple of days to get everything wired up. It then took about 20 to 30 days to start getting valid cases and to denoise the data. We are constantly denoising, but I would say the technical integration took a couple of days. The full integration, however, took about 30 days to really get the engine running. During that time, we were meeting with Binary Defense every week for about two hours. Now we meet with them every other week for an hour to discuss high-level cases. We have constant communication with them. Overall, I would say the full baked-in integration took about 30 days.

I consider Binary Defense to be part of my team. I interact with two of their employees on a regular basis. They are as communicative in our Slack channel as I would expect from any of my internal subject matter experts. I literally treat them as part of my team. For me, they are an absolute partner. They don't just disappear once we're integrated. They are a very dedicated team. I'm actually surprised by how dedicated they are. They are a fantastic partner for us.

Binary Defense MDR saved us at least two or three full-time analysts. We would have needed to hire these analysts in-house, as well as a security management tool like Splunk. These costs would have been significant.

In addition to the financial savings, Binary Defense MDR has also given us peace of mind. We now have much better visibility into our network systems, which was not the case before. This has been a valuable asset.

If I had to cut any budget, Binary Defense MDR would be the last line item I would cut. It is a valuable service that saved us money and gives us peace of mind.

After we acquired this platform, we met with a number of different vendors. Binary Defense came in with a proposal that was surprisingly affordable. In fact, we were able to recoup the cost of their services within a short period of time. This is because Binary Defense is able to provide the same level of security as a team of two or three in-house analysts but at a fraction of the cost. As a result, Binary Defense is saving us an estimated $250,000 to $300,000 per year.

I give Binary Defense MDR a nine out of ten.

We are a small to medium-sized organization. For us, the pricing was very advantageous. We were incredibly happy with the pricing. I think that for a larger enterprise, the cost would be considerably more. However, given the pricing that we have, I would imagine that it is very competitive pricing for an enterprise customer. I would have no problem recommending Binary Defense to a company of my size or, say, twice my size. However, for larger enterprises, I would recommend doing your due diligence. I don't know how Binary Defense's pricing scales, but I'm sure they have a system in place. I just don't know what that pricing would be. For our size organization, I would pay double the price and still have an advantage. Overall, I was very happy with Binary Defense's pricing.

We integrate two of our main systems: our corporate system, which is Google Workspace, and our main production environment, where we interact with customers. Our product is deployed on AWS. These are our two locations. However, they are all brought together into a single unified platform, which is the Binary Defense UI that we interact with.

My manager is a Cyber Risk and Control Manager. He does the initial triage of incidents. I then review the incidents that he has triaged. I reach out to three different stakeholders in the system, and I raise issues with them a few times a week. We do this via Slack. If we need to investigate an incident, the stakeholders log into the user interface. In addition, we have a few other people who have access to the system in case of an emergency. I would say that there are about five people who use the system regularly. My manager and I use it every day, and the other three people use it a few times a month. We are able to triage most incidents via Slack.

Maintenance on our end is a process of removing noise. We are constantly adjusting settings and making sure everything works properly. This includes our biweekly phone calls with the platform's developers, who are always working to improve the system. We believe that maintenance is essential to get the most out of the platform, and we are committed to investing the time and resources necessary to keep it running smoothly.

For organizations that don't think their MDR is an extension of their team, given the size of the organization, if they are not getting the quality of service and the quality of reports and cases, I would immediately recommend Binary Defense. I would share our experience with them and give them access to our reports and cases. If they are not getting the same quality of service, I would recommend Binary Defense as a perfect fit for our size organization.

No system like an MDR or a SIEM is perfect. It is only as good as the data that is input into it. Our team must be prepared to work with the MDR provider to ensure that the data is accurate and relevant. The MDR provider cannot read our minds and know what is important to us. They need our help to filter out the noise and identify the real threats.

To get the most out of our MDR solution, we should be prepared to dedicate some time to working with the provider. This may include:

• Meeting with the provider regularly to discuss our security needs and goals.

• Reviewing the alerts that the provider generates and providing feedback on their accuracy.

• Working with the provider to develop and implement remediation plans for any threats that are identified.

MDR is not a hands-off solution. It is a partnership between our team and the MDR provider. By working together, we can create a more secure environment for our organization.