WatchGuard Managed Detection and Response (MDR)

24/7 Detection and Response Without the Overhead.

Download PDF

WatchGuard Products

WatchGuard Managed Detection and Response Service - 1 Year

WatchGuard Managed Detection and Response Service - 1 Year - 1 to 50 licenses

#WGMDR30101
Our Price: $75.00

WatchGuard Managed Detection and Response Service - 1 Year - 51 to 100 licenses
Minimum 51 quantity

#WGMDR30201
Our Price: $65.00

WatchGuard Managed Detection and Response Service - 1 Year - 101 to 250 licenses
Minimum 101 quantity

#WGMDR30301
Our Price: $55.00

WatchGuard Managed Detection and Response Service - 1 Year - 251 to 500 licenses
Minimum 251 quantity

#WGMDR30401
Our Price: $45.00

WatchGuard Managed Detection and Response Service - 1 Year - 501 to 1000 licenses
Minimum 501 quantity

#WGMDR30501
Our Price: $40.00

WatchGuard Managed Detection and Response Service - 1 Year - 1001 to 5000 licenses
Minimum 1001 quantity

#WGMDR30601
Our Price: $35.00

WatchGuard Managed Detection and Response Service - 1 Year - 5001+ licenses
Minimum 5001 quantity

#WGMDR30701
Our Price: $32.50

More pricing below, click here!

Overview:

MDR for MSPs, Without the Overhead

The WatchGuard SOC, operated by seasoned cybersecurity experts armed with security analytics, industry-leading machine learning/AI, and threat intelligence, keeps MSP customers safe. The team constantly monitors, hunts, detects, and contains threats lurking in their endpoints around the clock while assessing their attack surface to strengthen security posture and improve their resiliency to threats.

As the cyber threat landscape continues to expand and grow in sophistication, companies struggle with serious security risks, inefficient cybersecurity posture management, and a scarcity of skilled personnel. So, companies are looking to outsource their protection to managed service providers (MSPs) with the technology, staff, and expertise to address these challenges.

However, managing complex security challenges and the expanding threat surface most companies face today requires skilled people and a lot of investment, making it difficult for MSPs to offer managed detection and response (MDR) services in an effective, economical manner. That’s why WatchGuard introduced WatchGuard MDR, a managed service that helps security service providers overcome these problems. By leveraging our thorough detection and response service in their offering, MSPs can meet customers’ needs without the overhead of building and maintaining their own 24/7, in-house security operations center (SOC).

WatchGuard MDR provides 24/7/365 cybersecurity services to our partners and their customers, offering endpoint security monitoring, threat hunting, and attack detection, investigation, and containment, with guided recommendations for remediation. The offering is managed by an elite team of cybersecurity experts and powered by AI. It requires no investment in a traditional SOC infrastructure, advanced technologies, or scarce security experts, which addresses the global pressures of scarce cybersecurity professionals and funding.

Adopt MDR Without Huge Investments

We partner with you as the frontline of customer cyber defenses. The service lets you concentrate on your core business while we maximize your customers' proactive cybersecurity posture and take over the worry of threat actors slipping into your customers' environments.

Extend Your Team with Our Experts

Our highly skilled security analysts and threat hunters are an extension of your team, always ready to stop attackers while keeping you in the loop. The team of experts knows how threat actors compromise organizations, keeps updated on attack techniques, and develops new analytics to detect them promptly.

Rest Easy with 24/7 Coverage

The WatchGuard MDR staﬀ is always on, whether monitoring the activity at your customers' endpoints, investigating abnormal behaviors, hunting for new threats, or mitigating attacks. WatchGuard’s team watches over your customers every hour, 365 days a year so that you can rest peacefully.

Defend Your Customers with Expert Threat Hunters

At WatchGuard, threat hunting is at our core. It forms the backbone of our endpoint security products and our MDR service. Our 24/7 security operations staﬀ – including threat hunting, intelligence, and analytics – helps you stay ahead of attackers and defend your customers more proactively, reducing time to detection and response.

Build Trust with Customer Engagement

Conﬁdently demonstrate service value through monthly and weekly reports that help you reinforce your client's security posture and provide an overview of MDR activity. In the event of an attempted attack, detection reports inform you of the impact and guide you to eﬀective recovery.

Team up with our cyber experts for top-notch MDR

A WatchGuard skilled team of cybersecurity experts keeps your customers’ endpoints safe with 24/7 security monitoring, threat hunting, attack prevention, detection, and containment.

In case of a potential cyberattack, the team guides you through the containment and remediation process to stop and remediate threats immediately. For your convenience and to minimize the time to respond in case of an attack, you can also delegate the containment to us. We automatically detect and block the adversaries in their tracks for you to gain time to analyze and remediate the compromised attack.

Additionally, as part of onboarding the service, our team assesses the attack surface at the endpoints to strengthen their security posture, improving their overall resiliency to cyber threats immediately.

WatchGuard MDR supports you with automatically delivered periodic service activity and security health status reports that help you to provide preventive and attack surface reduction services.

Our team of experts from WatchGuard SOC transforms endpoint monitoring and 365- day telemetry into actionable security analytics, augmented by industry-leading, trusted security machine learning/AI, and up-to-the-minute threat intelligence operated around the clock.

At-a-glance

Experience the power of proactive cybersecurity and gain peace of mind knowing that skilled security experts protect your customers. WatchGuard MDR provides:

100% MDR for partners – 100% of the time
Service onboarding to minimize endpoint attack surface
Continuous endpoint activity monitoring
365-day telemetry retention in the Cloud
Around-the-clock proactive hunting, behavioral detection, and investigation
Immediate incident notification to your preferred point of contact by email or phone
Detailed attack reports leveraging MITRE ATT&CK framework
Tailored playbooks for automated containment filtered by endpoints
Mitigation and remediation guidelines
Continuous attack surface assessment
Weekly endpoint health status reports
Monthly risk status, monitored activity, detections, and responses reports

Benefits:

With WatchGuard’s MDR, our MSPs can seamlessly deliver top-tier cybersecurity capabilities without the burden of building and managing their modern SOC. We empower their business and leverage our expertise to provide their customers with comprehensive threat hunting, detection, and response, significantly reducing the risk of cyberattacks and safeguarding their valuable assets.

Stay ahead of the curve and capitalize on the MDR revolution with WatchGuard’s MDR. Transform your security operations and drive unparalleled customer value, ensuring a resilient defense against today’s ever-evolving cyber threats.

MSP Benefits
WatchGuard MDR

Keep competitive by expanding your managed service portfolio
No investment is required. Get access to a modern SOC without building yours
Extend your team with skilled cyber experts
Rest peacefully night and day. We have you covered around the clock
Provide 24/7 hunting, threat detection and response to sophisticated threats
Tailor the response with flexible containment rules
Consolidate your customers’ security stack, including managed services

Customer Benefits
MDR from Their MSP

Proactive approach to stop threats in real time
24/7 monitoring, detection, and response to minimize breach time to respond
Knowledge and expertise of skilled cybersecurity professionals
Scalability for changing threat landscapes
Flexibility in deployment options and business growth
Threat and attack surface visibility enabling security improvements
Meeting compliance and regulatory requirements

Deployment:

The power of efficient prevention, hunting, detection, and response

Prioritizing the combination of prevention and attack surface reduction and proactive detection and response is crucial for enhancing your customers’ cybersecurity posture. These security strategies are all interconnected. Prevention efforts aim to minimize incidents and associated costs, while detection and response address threats that slip through preventive measures, minimizing the time to detect and respond to them to reduce the overall security cost.

WatchGuard MDR maximizes automated threat prevention, detection, and response by utilizing WatchGuard EDR, EPDR, or Advanced EPDR and its managed services. The Zero-Trust Application Service autonomously minimizes the malware attack surface, enhancing security posture and enabling scalable detection and response. Skilled cybersecurity analysts leverage the Threat Hunting Service to investigate IoAs and weak signals, uncovering complex cyberattacks. The continuous Security Health checks in the service evaluate configuration and attack surface exposure. Our cybersecurity analysts provide guidelines to minimize endpoint attack surfaces, fortify security controls, fine-tune settings, and recommend timely patching.

By combining attack surface reduction, prevention, and effective detection and response strategies, WatchGuard EDR, EPDR, or Advanced EPDR and WatchGuard MDR empower MSPs with a robust cybersecurity framework.

How It Works:

WatchGuard MDR provides 24/7 monitoring of the threat activity registered at endpoints, enabling correlation of suspicious activities to detect, investigate, and respond to cyber threats promptly and effectively. Here’s how the service works:

Service Onboarding: The onboarding process initiates immediately upon MDR service activation in the subscriber’s account. WatchGuard SOC analysts collaborate to define response types & ensure optimal service. We’ll confirm WatchGuard EDR, EPDR, and Advanced EPDR setup and work together to validate the functionality of your security controls, ensuring containment and response readiness.

24/7 Endpoint Activity Monitoring and Data Collection: WatchGuard MDR leverages endpoint data collected from WatchGuard host sensors and then stored for 365 days in our Cloud SOC. Processed in real time and retrospectively via machine learning and advanced analytics, our threat hunters explore new patterns to enhance cybersecurity.

24/7 Proactive Hunting and Detection: We use machine learning to analyze this data and detect suspicious activities and anomalies that could indicate the presence of a threat. We map all indicators of attack(IoAs) to the MITRE ATT&CK framework to quickly understand the threat actors. Our MDR personnel proactively seek endpoint threats, reducing detection time and enhancing security efficacy.

24/7 Investigation and Validation: Investigation and validation are key elements within our MDR service. Aided by machine-learning algorithms trained on real cyber incidents, our experts correlate IoAs into incidents, investigating and validating them to swiftly address potential threats and minimize impact.

Immediate Incident Notification to Partner Teams: Upon confirmation of a security incident, WatchGuard MDR promptly notifies our MSP partners with post-incident validation, sparing them the task of reviewing unconfirmed cases. Notifications detail investigative insights and impacted machines, empowering fast, informed response actions by partner teams, thus mitigating threats and minimizing potential damages or data loss efficiently.

Mitigation and Remediation Guidelines: When security incidents arise, the WatchGuard MDR team collaborates closely with MSPs to provide clear, actionable guidance for incident response and damage mitigation. This includes detailed recommendations for containment actions, remediation, and future security posture enhancement. Our guidelines aid partners in quickly and effectively responding to threats, minimizing incident impact, and enhancing clients’ overall security posture to prevent similar incidents from happening again.

24/7 Response and Mitigation Executed by WatchGuard or the Partner’s Team: Our MDR experts create custom automated playbooks to mitigate and contain validated threats, including those that involve potential endpoint isolation. If partners opt for their own teams to lead containment efforts, the WatchGuard MDR team provides guided support.

Response and Remediation Executed by the Partner’s Team: Led by partners with WatchGuard guidance, the post-incident containment or remediation phase addresses attacker traces, data restoration, and vulnerability patches. It may also involve enhancing existing security setups or implementing new security controls to forestall similar incidents going forward.

Weekly and Monthly Reporting: WatchGuard MDR experts deliver weekly and monthly security reports to partners, covering detected IoAs, investigations, identified incidents, and a security health analysis to anticipate potential threats. Partners can customize reports to enhance customer engagement with their MDR service.

Benefits for our partners
Features	MSP Benefits
24/7 monitoring. data collection at WatchGuard SOC in the Cloud	Capitalize on the MDR opportunity without investing in a modern SOC.
24/7 detection, hunting, and investigation by WatchGuard’s experts	Augment your team with cybersecurity-skilled staff to provide 24/7 MDR.
24/7 unattended threat containment	Entrust us with round-the-clock containment of uncovered threats.
Immediate notification to the MSP team	Take the lead in your customer relationships while we ensure you're always informed.
Mitigation and remediation guidelines	Access security knowledge and best practices that provide a competitive edge.
Service onboarding and periodic health checks	Prevent attacks from improper security or unmanaged endpoints.
Weekly wellness status and monthly activity reporting	Enhance customer security by staying ahead of threats exploiting vulnerabilities.

MDR Model and Use Cases:

1. MDR from an In-House Security Operations Center (SOC):

An in-house SOC is a dedicated facility and team within an MSP responsible for managing and responding to cybersecurity issues in their customers’ environment.

Control: Full control over all processes, tools, and data.
Cost: High – involves investing in technology and skilled staff.
Scalability: Scaling requires additional investments in staff and technology.
Management: Entire management and operations are handled internally.
Use Case: Best for large organizations with substantial cybersecurity budgets and high-security requirements.

2. MDR from a SOC as a Service (SOCaaS):

SOCaaS is a service that provides outsourced cybersecurity monitoring, detection, investigation, and response from a third-party MDR.

Control: Limited control as processes are handled by the MDR provider.
Cost: Lower – operational expense rather than a capital investment.
Scalability: Can be scalable, depending on the chosen service.
Management: Managed by third-party cybersecurity professionals.
Use Case: Suitable for small and midsize businesses or organizations with limited cybersecurity budgets and staff.

3. MDR from a Hybrid SOC:

A hybrid SOC model combines in-house and outsourced SOC functionalities to balance internal and external cybersecurity capabilities.

Control: Moderate control – internally managed but leverages external resources.
Cost: Can be optimized according to the balance of in-house and outsourced functions.
Scalability: Higher – internal efforts can be augmented with external capabilities.
Management: Involves both internal management and thirdparty management.
Use Case: Ideal for organizations seeking to augment their existing SOC capabilities without substantial investments.

4. Automated MDR (Services)

In an automated MDR context, technology plays a pivotal role in bolstering cybersecurity defense by streamlining and often automatically handling various functions to enhance efficacy and responsiveness.

Control: Detection and response activities are automated. Enables IT teams to focus on strategic, complex, or escalated concerns.
Cost: No additional expenses are necessary, as all technologies, including AI in the Cloud, skilled personnel, tools, and threat intelligence, are included in the product cost.
Scalability: Facilitates easy adaptation to the evolving scale and complexity of organizational environments.
Management: Offers a systematic approach to threat detection and response, minimizing the management effort.
Use Case: Automated MDR services are key for businesses with limited cybersecurity staff/budget, providing robust, affordable defense.

Documentation:

Download the WatchGuard Managed Detection and Response Brochure (PDF).

Download the WatchGuard Managed Detection and Response Datasheet (PDF).