Stop cyber attacks with Kroll Responder MDR.
Definition
What is Managed Detection and Response (MDR)?
Managed Detection and Response (MDR) services bring together human expertise, threat intelligence and a range of network, endpoint and cloud detection technologies to help organisations detect and respond to threats, strengthen their security posture and reduce their risk exposure. MDR services enable businesses to achieve an enterprise-standard cyber security capability at a fraction of the cost of establishing the same capabilities in-house.
Kroll Responder is an outcome-focused MDR service that provides the frontline intelligence, high-fidelity detections and incident response support required to shut down threats across your organisation’s environments before they cause damage and disruption.
Page Contents
- Benefits
- How it works
- Features
- Coverage
- The Redscan Platform
- Why Kroll?
- Use cases
- MDR vs MSSP
- Case studies
- Contact Us
Benefits
The Benefits of Kroll Responder Managed Detection and Response (MDR)
Extensive threat visibility
Kroll Responder Managed Detection and Response (MDR) provides extensive threat visibility across on-premises, cloud and hybrid environments, 24/7.
Continual detection of attacks
Kroll Responder leverages the latest security tools and threat intelligence to ensure your organisation is prepared to respond to current and emerging cyber threats.
Eases the pressure on in-house teams
Kroll’s SOC experts deploy, manage and monitor all the security technologies included as part of Kroll Responder, reducing the burden on your in-house teams.
Unrivaled response
Kroll Responder significantly reduces false positives, and when genuine incidents occur, actionable mitigation guidance and automated response actions are provided.
Reduces time to maturity
Operating as an extension of your organisation, Kroll Responder helps to make processes more efficient and enables you to quickly elevate security capabilities to enterprise level.
Facilitates compliance
Kroll Responder MDR elevates your security capabilities to a level needed to help meet the requirements of the GDPR, NIS Directive, PCI DSS, ISO 27001, and more.
A leading global 24/7 MDR solution
Get in touch
How our MDR service works
The visibility to detect
The context and actions to respond
01
Ingestion
Telemetry is collected from across your networks, endpoints, and cloud environments, analysed using the latest machine learning and behavioural detection engines, then enriched with the latest threat intelligence.
02
Analytics
Detections are correlated and then grouped together by common attributes to create ‘cases’ – providing a more complete overview of security events.
03
Investigation
Cases are triaged by Kroll’s 24/7 Security Operations Centre experts, and those which require attention are raised to your security team as prioritised incidents.
04
Response
Clear remediation guidance and automated response actions are supplied to swiftly disrupt, contain and eliminate threats before they result in damage and disruption.
What Our Customers Say
4.8/5 - based on 54 Reviews
“Redscan staff are always on hand to provide swift, clear advice. They help us keep a constant eye on our network and respond quickly to incidents to ensure systems remain operational.”
IT Director
Private Healthcare Provider
“Redscan’s security experts work hand in hand with our in-house team, providing us with the insights we need to identify and eliminate threats across our environment 24/7.”
IT Security & Infrastructure Director
“Thanks to Redscan, we’re in an infinitely better place now. We have got more visibility than we ever had, and critically, in all the right places. I can now sleep easy knowing that Redscan’s expertise is protecting our business.”
Head of Technology & Cybersecurity
Housebuilding Company
“With so much organisational change, this is a time of incredible pressure on our small team. Partnering with Redscan is making it easier for us to address the security challenges of business consolidation.”
Head of IT Security
Global Plastics Manufacturer
“I can offer a higher level of assurance at board level about our information security now. Redscan gives us a broader lens on a complex and changing environment.”
IT Director
Global Asset Manager
“We now know we’ve got eyes on our critical assets and that those events are being looked at, scrutinised, triaged and qualified as legitimate or false positives. That is night and day in contrast with where we were before our relationship with Redscan.”
Head of Technology & Cybersecurity
Housebuilding Company
"Redscan's cost effective service gives us peace of mind that we are doing all we can to protect our clients, our business, our staff, our counterparties and other partners."
Head of IT Infrastructure
Asset Management Firm
“Faster incident alerting enables us to better understand what is going on in our network and react more quickly. From an advice side of things, it’s great to be able to talk to knowledgeable people and discuss solutions to help mitigate our security risks.”
Head of IT Security
Global Plastics Manufacturer
“With Redscan, we are able to understand and quickly identify any threats. Redscan’s support gives us the freedom to feel more secure and be more productive.”
Head of IT
Global Shipping Company
“By working in partnership with Redscan, we have significantly improved our operational resilience.”
Head of Cyber Security
Specialist bank
“Thanks to Redscan we now have a solution that gives us the ability to monitor, isolate and eliminate threats across our IT infrastructure.”
Head of IT
Private Hospital
“The personal approach is something I noticed from my first engagement with Redscan and it is still true today. We have 30 locations worldwide and it is valuable to have a third party being proactive in identifying potential security issues.”
Head of IT
Global Shipping Company
“Services like these are few and far between.”
Head of IT Infrastructure
Asset Management Firm
“I value the fact that Redscan aggregates insight about the cyber-attacks it sees on other customers and retrospectively applies it to other organisations, so we all benefit from that knowledge.”
Head of Cyber Security
Specialist bank
"Our partnership with Redscan has been one of the most successful that we have ever undertaken"
IT Director
Global Asset Manager
94%
satisfaction with threat detection
92%
satisfaction with speed of response
58NPS
MDR services rated 'excellent'
MDR Service Features
A turnkey solution for threat detection
Kroll Responder provides everything your organisation needs to detect and respond, 24/7.
View full service features table.
Experienced SOC experts
Our specialist team of security analysts and engineers work as a virtual extension of your team to ensure your organisation is always aware of security incidents.
High-fidelity telemetry
To achieve deeper threat visibility and enhance decision-making, Kroll Responder supports the integration of network and endpoint telemetry from a wide range of log sources.
Cyberoffensive intelligence
Real-world threat intelligence from our in-house research and offensive security engagements conducted by our Red Team ensures Kroll Responder is continually optimised to identify and help shut down attacks.
Best-in-class detection tools
Kroll’s agnostic approach to technology selection means that Responder includes the tools that deliver the best security outcomes for your organisation.
The Redscan platform
Our proprietary threat management platform is used by our SOC team to communicate incident information and mitigation guidance to your in-house team.
Integrated incident response
To facilitate incident response, Kroll Responder supplies actionable remediation guidance, automated response actions, and optional on-site support for priority incidents.
Rapid service deployment
Due to a streamlined on-boarding process, Kroll Responder can be protecting your organisation within a matter of weeks and easily scales up in line with future operational needs.
Scenario-based testing
In order to continually enhance threat visibility and coverage of adversarial tactics, Kroll Responder’s offensive security experts conduct simulated attacks aligned to testing frameworks such as MITRE ATT&CK.
Coverage
Threat detection and incident
response in the cloud
Continuously secure your cloud workloads with Kroll Responder MDR for AWS.
Maintain a constant view of your cloud infrastructure with Kroll Responder MDR for Microsoft Azure.
Secure your cloud workloads with Kroll Responder MDR for GCP.
Secure your cloud applications with Kroll Responder MDR for Office 365.
Gain visibility of your Google cloud applications with a Kroll Responder MDR service for G-Suite.
Benefit from 24/7 Hyper-V monitoring with Kroll Responder MDR.
Secure your cloud and on-premises workloads with 24/7 hybrid cloud monitoring.
Kroll Responder MDR brings together the best of machine intelligence and human expertise to swiftly identify and respond to threats, 24/7
Security orchestration
High-fidelity telemetry for threat awareness and decision advantage
Kroll Responder’s MDR experts integrate the most valuable security telemetry into your technology stack, benchmarking it against frameworks such as MITRE ATT&CK to minimise visibility blind spots. We enrich this telemetry with frontline threat intelligence to help improve real-time detection of the latest adversarial tactics and techniques.
More about threat intelligenceMore on MDR use cases
Cyber threat hunting
Seeking out known and unknown threats at the earliest stages of attack
Using a combination of manual and machine-assisted techniques, we continually search for indicators of compromise, tune security systems to better understand regular network activity, create watchlists and conduct scenario-based testing to validate the effectiveness of controls and processes.
Learn more about our SOCLearn more about threat hunting
events-based response
The security outcomes needed to rapidly respond
Kroll’s SOC analyses and triages all incoming security alerts and, once a genuine incident is identified, provides the actionable mitigation guidance and incident response actions to respond quickly and effectively. We offer remote and on-site support, as well as‘Events-based Response’ – automated playbooks to contain and disrupt a wide variety of threats.
Learn more about Cyber Incident Response
Chat with an expert
Get in touch
The Redscan Platform
End-to-end threat management, security analytics and reporting
The Redscan Platform™ is the threat management platform used to deliver our Kroll Responder Managed Detection and Response MDR solution. Redscan integrates with all the underlying technologies included as part of the service to enable our SOC team to provide swift and secure incident analysis, actionable mitigation guidance, automated response actions and clear service reporting through a single pane of glass.
Learn more about The Redscan Platform
MDR vs MSSP
MDR vs MSSP - what's the difference?
MSSP services can help organisations deploy a baseline security infrastructure without adding headcount, but these cost avoidance benefits are often offset by providing little value beyond incident alerting and failing to adapt to the changing threat landscape.
True MDR solutions go well beyond this, providing a turnkey service for threat detection, hunting, investigation and response. Utilising telemetry from across the enterprise, MDR solutions should be flexible and scalable, layering telemetry as secuity maturity evolves, while being transparent with detection and response processes.
Learn more
Meet some of our MDR team
“All of the SOC team undergo rigorous training to enable us to provide the best support and advice to our customers. Each of us loves what we do, which means we go the extra mile with every activity, from helping to tackle malware to forensic analysis.”
Juliette
SOC Team Lead
“Being technology-agnostic, we’re not limited by just one set technology stack. We use the best tools to deliver the optimum threat coverage and visibility for your business and integrate them seamlessly through our CyberOps platform.”
Jack
Lead Security Integration Engineer
“Staying on top of the latest threats is a constant challenge for organisations, but as your cyber security partner, we never take our eye off the ball. We use the latest open source threat intelligence to proactively hunt out threats to make sure you’re protected today and tomorrow.”
George
Head of Threat Intelligence
“To safeguard your business, you need to have confidence that a cyber security provider is putting your needs first. At Kroll, we give your organisation the attention it deserves. We work closely with you to support your security strategy over the long-term.”
Josh
Team Lead, Technical Account Management
Why Kroll?
Your trusted partner for
Managed Detection and Response
- A leading global MDR solution
- Rated 9/10 for overall customer satisfaction
- CREST-accredited Security Operations Centre
- An outcome-focused approach
- Red and blue team security expertise
- Technology agnostic
MDR FAQ
Frequently asked questions
- What is MDR?
-
Managed Detection and Response (MDR) is an advanced security solution that brings together threat detection, response and remediation activities in one solution to help organisations proactively hunt for, investigate, respond to and remediate threats around the clock. By gaining comprehensive visibility of threats through MDR solutions, companies are better able to enhance their security posture and reduce their risk exposure.
View the Kroll MDR Buyer’s Guide for more insight.
- How does MDR work?
-
An effective MDR solution combines the people, processes and technologies required to provide actionable insights and analytics and enable organisations to significantly strengthen their security posture. This supports greater incident awareness and faster, more reliable decision-making. A good MDR solution will apply a structured approach that should cover ingestion, analytics, investigation and response.
- What does MDR include?
-
An effective MDR service brings together many key security elements. It is defined by aspects such as real-world cyberoffensive intelligence, high-quality detection tools and experienced Security Operations Centre (SOC) experts who can act as an extension of an organisation’s team. Other key elements of a high-quality MDR service should include the integration of network and endpoint telemetry from a wide range of log sources, scenario-based testing to simulate potential attacks, and integrated incident response.
- How long does it take to implement a Managed Detection and Response service?
-
The length of time it takes to implement an MDR service varies according to an organisation’s scope, size and requirements. Rather than being defined by their underlying technologies, MDR services offer a turnkey approach built around defined outcomes and goals to address specific security use cases. This means they can be deployed in weeks instead of months, greatly reducing time to value.
- How does MDR facilitate regulatory compliance?
-
Taking a more proactive approach to threat detection is now an important element of achieving compliance with the latest regulations and standards. By providing this type of insight and detailed reporting, MDR solutions help organisations to meet monitoring requirements and standards, including those within the GDPR, the Data Protection Act 2018, the Directive on the Security of Networks and Information Systems (NIS Directive or Cyber Security Directive), Payment Card Industry Data Security Standards (PCI DSS) and more.
- What does a Managed Detection and Response service cost?
-
MDR solutions are significantly more affordable than the equivalent costs of setting up an in-house SOC. Because it removes the requirement to recruit a team of security specialists, deploy and manage a wide range of technologies and run a 24/7 monitoring operation, MDR offers organisations significant financial savings. The cost of an annual MDR solution subscription will be defined by aspects such as the type and number of technologies being deployed and the number of network assets and endpoints being monitored.
Get started with our MDR service
Shut down threats across your organisation’s environments before they cause damage and disruption. Complete the form to discuss your requirements with an MDR expert.
- 24/7 MDR solution
- Rated 9/10 for overall customer satisfaction
- CREST-accredited Security Operations Centre
- $1 Million incident protection warranty
Resources
Discover our latest content and resources
From the blog
From the blog Case studies Latest news
Ransomware on the rise despite law enforcement takedowns
A new report shows that ransomware activity grew in 2023 compared to 2022, despite major law enforcement operations against key ransomware groups.
Advanced phishing attacks soar by 341% in six months
New research has identified a 341% increase in malicious phishing links, business email compromise (BEC), QR code and attachment-based threats in the past six months.
70% of CISOs expect cyber-attacks in the next year
New research has found that 70% of chief information security officers (CISOs) think that their businesses will be at risk of a cyber-attack in the next year.
