What is an AI-driven XDR solution? AI-driven Extended Detection and Response (XDR) is a specific approach for advanced threat detection and automated response. AI-driven XDR extends continuous threat detection and monitoring across an organization’s endpoints, cloud workloads, applications, and the network.
Not all XDR solutions are created equal. For instance, an AI-driven XDR offering leverages artificial intelligence (AI) and machine learning (ML) to scale and bring efficiency to their detection and response efforts. These capabilities enable security teams to quickly understand the entire MalOp™ (malicious operation) from root cause across every affected device and user.
Unlike pseudo-XDR offerings that are really just EDR tools with a cloud extension, an AI-driven XDR solution does not require that valuable telemetry be filtered out due to a platform’s inability to handle the volume of intelligence available. Yes, they can seem like they have some of the functionality that an AI-driven XDR solution delivers–maybe even enough to successfully get through a POC with a prospect–but they can’t actually deliver what they are selling in the marketing materials.
Where AI-driven XDR stands out is its use of artificial intelligence and machine learning (ML) to automatically correlate telemetry from across organizations’ disparate assets. This explains why some refer to AI-driven XDR as Advanced XDR. AI-driven XDR automatically delivers the context and correlations that security teams need for obtaining a unified view of their organization’s environments.
They can then use that view to investigate legitimate security concerns regardless of where they exist in their employer’s infrastructure. Analysts don’t need to go about gathering context manually with an AI-driven XDR solution, nor do they need to waste their time chasing down false positives. They have all the relevant information to visualize an entire attack sequence and shut it down quickly using automated response playbooks.
AI-driven XDR doesn’t suffer from the challenges plaguing other security tools that can’t predict or understand data across the entire environment. Take Security Information and Event Management (SIEM) tools as an example. These solutions require the use of a data lake structure and cloud analytics, with their value and effectiveness hinging on the sources of data to which they have access. They also generate false positives and too many alerts, contributing to a sense of “alert fatigue” among security teams.
Security Orchestration, Automation, and Response (SOAR) solutions pose the same obstacles as SIEMs. But they come with some additional hurdles, as well. For instance, SOAR solutions need integrations so that infosec personnel can streamline their threat detection and security analytics capabilities across their employer’s infrastructure. Additionally, they need to set aside some upfront investment for building automated workflows and response playbooks in the beginning.
Next, Endpoint Detection and Response (EDR) prioritizes continuous threat detection and monitoring as well as automated response. But it does so at the endpoint level only. As such, EDR solutions can’t provide insight into attack campaigns that don’t involve endpoint devices. They also can’t yield visibility into sophisticated operations that involve endpoints as well as resources in other parts of an organization’s infrastructure.
Finally, there’s Native XDR. These types of platforms provide limited XDR functionality by only integrating with other security tools produced by the same vendor. Native XDR might make the buying process more straightforward, but they might also lock organizations into a partnership with a vendor that doesn’t meet all (or any) of their security requirements.
By comparison, AI-driven XDR doesn’t need a data lake structure or cloud analytics. It reduces false positives by providing context into security issues. It comes with the necessary integrations built into the platform, allowing it to collect telemetry from across an organization’s infrastructure automatically. And it works with all technologies in an organization’s security stack regardless of the vendor, thus not requiring any replacement solutions.
AI-driven XDR is necessary today due to the growing sophistication of digital attacks. In the words of Forbes, “the sophistication of threats [in 2020] increased from the application of emerging technologies such as machine learning, artificial intelligence, and 5G, and especially from greater tactical cooperation among hacker groups and state actors.”
It was a similar story in 2021, with Microsoft having written that cybercrime became more “sophisticated, widespread, and relentless” as malicious actors upped their attacks against critical infrastructure organizations and embraced other techniques.
Such sophistication lengthens the time it takes to detect an attack, ultimately increasing the cost of a breach. The Cost of a Data Breach Study 2021, for instance, found that it took organizations an average of 287 days to identify and contain a breach. That’s a problem, as data breaches that take more than 200 days to detect cost an average of $4.87 million. By comparison, the price tag lowered to $3.61 million when organizations detected a data breach within 200 days.
Cybereason AI-driven XDR combines MalOp, which analyzes over 23 trillion security events a week, with Google Cloud’s ability to ingest and normalize petabytes of data. These capabilities yield planetary-scale protection that organizations need to take an operation-centric approach to detection and response.
With this methodology, security teams can understand an entire attack chain regardless of where it’s occurring. They can then take automated and guided response actions quickly to quickly remediate an incident. This advantage highlights the following lesson to keep in mind when performing detection and response: telemetry is the key to effective detection and response strategy, but when telemetry is incomplete, it can ruin those efforts.
For instance, if the sources of telemetry are not properly tuned, the tools might generate alerts that are not actually indicative of a security incident. Those false positives could end up wasting a security team’s time and effort.
False positives can also contribute to a sense of alert fatigue, a sentiment which diminishes the overall effectiveness of infosec professionals. If security teams repeatedly determine that there’s no threat at the end of an investigation, they might be less inclined to respond to future alerts. This increases the likelihood of an organization suffering a digital attack.
Some vendors are forced to resort to "data filtering" where they eliminate huge swaths of telemetry before they send the data to the cloud for analysis. This data could be useful for returning a timely detection or understanding the scope of an attack. But if this telemetry is never collected or analyzed, the solution will produce an incomplete snapshot of an organization’s security posture, and will not answer the question: “Are we under attack?”
An AI-driven XDR solution enables organizations to embrace an operation-centric approach to security that delivers the visibility organizations require to be confident in their security posture across all network assets, and the automated responses to halt attack progressions at the earliest stages.
In addition, an AI-driven XDR solution should provide Defenders with the ability to predict, detect and respond to cyberattacks across the entire enterprise, including endpoints, networks, identities, cloud, application workspaces and more.
Cybereason is dedicated to teaming with Defenders to end attacks on the endpoint, across the enterprise, to everywhere the battle is taking place. Learn more about AI-driven Cybereason XDR here or schedule a demo today to learn how your organization can benefit from an operation-centric approach to security.