Cyber security has long been built around keeping attackers out. But as automation and AI allow criminals to probe more organisations, more quickly, the assumption that every attack can be prevented is becoming increasingly difficult to sustain.<\/p>\n\n\n\n
For Conscia security architect Jan Bervar, the answer is to change the mindset: assume an attacker will eventually get in, and concentrate on making sure the resulting incident is detected and contained before it can become a serious breach.<\/p>\n\n\n\n
\u201cThe biggest issue that we’ll have to deal with is the autonomy of the attacks and the speed of the attacks,\u201d he said. \u201cIf you have the speed at your disposal, then obviously you can do more. You can cast a wider net, and you can also be very fast in moving from that initial compromise to the impact in the customer’s environment.\u201d<\/p>\n\n\n\n
That acceleration, he argues, is the most significant development in the threat landscape.<\/p>\n\n\n\n
\u201cI don’t really believe that there is significant change over time in terms of attackers using some superhuman techniques and completely unfathomable attacks against our environments,\u201d Bervar said. \u201cThey are simply inventing new business models.\u201d<\/p>\n\n\n\n
The techniques themselves are evolving gradually, he says, but criminals are increasingly using automation and AI to increase their speed and scale. That means virtually every organisation is now a potential target.<\/p>\n\n\n\n
\u201cTen or fifteen years ago, you could comfortably live somewhere in the back woods of the internet and say it’s extremely unlikely that they will ever find me,\u201d he said. \u201cThis has not been true for a couple of years. And this is even less likely to be true because things will get automated to the point that everybody will be exposed simply because it will be so easy and relatively fast to find whatever resource you have exposed.\u201d<\/p>\n\n\n\n
That changing risk profile is putting greater emphasis on managed detection and response (MDR), which Bervar describes as one of the most effective capabilities available to organisations once basic preventive controls such as firewalls and antivirus are in place.<\/p>\n\n\n\n
The reason is that prevention increasingly leaves a grey area where technology alone cannot reliably determine whether activity is legitimate or malicious.<\/p>\n\n\n\n
\u201cPreventive controls like antivirus and firewalls are black and white,\u201d he said. \u201cThey can basically block things or not block things. But in the last couple of years, attackers are moving increasingly into that grey area when we cannot have a technology decide whether something is good or bad.\u201d<\/p>\n\n\n\n
MDR fills that gap by continuously monitoring suspicious activity, investigating it and taking action when it is identified as malicious. It also brings the scale and economics of a specialist security operation within reach of organisations that could not realistically build one themselves.<\/p>\n\n\n\n
\u201cIf you want to do detection and response yourself, you obviously have to have a 24-7 team working on that,\u201d says Bervar. \u201c24-7 teams mean investment, which is like five to six salaries, which is typically outside of the range of a lot of companies.\u201d<\/p>\n\n\n\n
A managed service can deliver that round-the-clock capability at a fraction of the cost, while also providing access to specialist expertise and knowledge gathered across multiple customers.<\/p>\n\n\n\n
For Conscia, the response is therefore not simply to detect threats but to contain them as quickly as possible.<\/p>\n\n\n\n
\u201cThe promise of MDR is to make every incident small,\u201d says Bervar. \u201cWe are saying assume breach. You will have incidents, but we are here to stop every incident within the first couple of minutes as it penetrates the outer shell of your organisation.\u201d<\/p>\n\n\n\n
That approach also shapes how Conscia views the technology underpinning managed detection. Bervar argues that organisations need broad visibility across their environments and says Conscia favours extended detection and response (XDR) as the primary technology for that purpose.<\/p>\n\n\n\n
For organisations, managed security should be viewed as more than another technology purchase. Bervar says continuous monitoring should also provide a mechanism for steadily improving the underlying security posture.<\/p>\n\n\n\n
\u201cIf you observe the customer continuously, you notice things that need to be changed in that environment,\u201d he said. \u201cAs part of our service, we always try to have this intimacy where we are every month providing recommendations or co-implementing those recommendations with the customer.\u201d<\/p>\n\n\n\n
The objective is that the organisation should not simply be better protected against the next incident, but materially more secure than it was a year earlier.<\/p>\n\n\n\n
Ultimately, he says, cybersecurity needs to be treated as a broad risk-management discipline rather than a collection of isolated products.<\/p>\n\n\n\n
\u201cCybersecurity should not be seen as a point solution, but more of an all-encompassing umbrella of risk management activities,\u201d he says. \u201cMDR perhaps is the most important tool that we have in combating cyber crime.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"
As cyberattacks become faster and more autonomous through AI and automation, prevention alone is no longer enough. Discover why Managed Detection and Response (MDR) is emerging as a critical cybersecurity capability, helping organisations detect, contain and minimise threats before they become serious breaches.<\/p>\n","protected":false},"featured_media":0,"menu_order":0,"template":"","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"global_solutions":[4,5,18,9,11,19,22],"global_partners":[],"global_industries":[25],"global_business_outcome":[40,41,42,43],"global_types":[],"class_list":["post-2247","news","type-news","status-publish","hentry","global_solutions-ai","global_solutions-automation","global_solutions-conscia-services","global_solutions-cybersecurity","global_solutions-managed-service","global_solutions-soc","global_solutions-threat-intelligence","global_industries-all-industries","global_business_outcome-governance-risk-compliance","global_business_outcome-managed-detection-response","global_business_outcome-operational-efficiency","global_business_outcome-security-operations"],"acf":[],"yoast_head":"\n