Microsoft Threat Detection and Response: Five Key Pitfalls (and How to Address Them)

How to Alleviate the Challenges of Cloud Threat Detection and Response

Effective MDR services can deliver the talent, processes and expertise to ensure your organization gains the greatest value from solutions such as Microsoft Sentinel, Microsoft 365 Defender and Microsoft Defender for Cloud. However, not all Microsoft MDR providers are capable of delivering the caliber of experience and insight required to address the potential pitfalls.

To help avoid the risks, some of the criteria for assessing potential MDR providers include:

• Microsoft-Certified Security Specialists
  Look for a provider whose services are delivered by security experts certified in Microsoft Security competencies such as AZ-500 Microsoft Azure Security Technologies and SC-200: Microsoft Security Operations Analyst.
• Microsoft Commercial Marketplace
  Check that your prospective provider is in the Microsoft Commercial Marketplace. This makes it easier for existing Microsoft businesses to select and onboard MDR service providers using their existing enterprise plans.
• Response Beyond Containment
  While MDR has become an effective approach for addressing the security skills gaps around detection and response, organizations have been disappointed with the “response” provided by most MDR vendors. This is because it often stops at containment, putting the onus on the client to remediate and investigate. Rather than leaving your organization hanging, response should cover the whole incident response lifecycle and enable continuous improvement. This means closing the gap between merely containing the threat to actively removing it across all affected systems and quickly understanding the root cause, so that it doesn’t happen again.