WatchGuard Technologies has entered the fast-growing market for extended detection and response (XDR) solutions.
The security vendor’s newest offering, named ThreatSync and shipping now, is designed to do for XDR what earlier WatchGuard products have done as well, according to Andrew Young, the company’s senior vice president of product management and chief product officer: democratize a technology typically available only to large enterprises.
“Our goal is through our MSP community to simplify it and make it accessible to every organization in the world,” says Young of XDR. “It’s really sort of WatchGuard’s DNA.”
Like all XDR offerings, ThreatSync correlates input from multiple sources, including WatchGuard’s Firebox firewalls and EDR solution, and its endpoint protection, detection, and response (EPDR) solution, which supplements EDR with endpoint security. Future editions of the product will collect data from WatchGuard’s Wi-Fi security and multifactor authentication products too.
Unlike other systems, the company says, ThreatSync also prioritizes threat alerts and presents them in a more easily consumable format within a consolidated interface.
“Instead of having a barrage of hundreds of thousands of logs, we’ve simplified it down to a single one- to two-page report that has exactly what you need to know to make your decisions,” says Ricardo Arroyo, a principal product manager at WatchGuard.
ThreatSync can take action automatically on a technician’s behalf as well. “The product has automation policies that make a decision based on the circumstances,” Arroyo explains, noting that available responses include isolating hosts, deleting infected files, and blocking dangerous IP addresses on an end user’s firewalls.
The ThreatSync interface is now an integrated component of WatchGuard Cloud, the shared management interface for all of WatchGuard’s offerings. “We aggregate everything for all of your different customers and put it in a central location,” Arroyo says.
According to WatchGuard, ThreatSync’s heavily automated deployment process is nearly autonomous. “The entire system is configured in the background,” Arroyo says.
ThreatSync is now a built-in component provided at no extra cost to users of WatchGuard’s Firebox Total Security Suite as well as its EDR and EPDR products.
The system’s target market is MSPs without the sophistication and resources to run their own security operations center. “But they do a lot of ongoing security management for their customers” on a mostly break-fix basis, Young says.
They also badly need the kind of automation ThreatSync is designed to provide at a time of limited access to skilled security professionals and extremely low tech unemployment. “The biggest issue with all of cybersecurity today, number one, is always, always, always manpower,” Arroyo says.
WatchGuard’s portfolio has expanded steadily in recent years beyond firewalls to encompass MFA, DNS filtering, Wi-Fi security, and endpoint protection. XDR is the latest addition to that lineup.
Over 54% of organizations surveyed by Gartner a year ago had plans to adopt XDR by the end of 2022. Global spending on XDR solutions and services will climb at a 20.7% CAGR through 2030 to over $3.4 billion, according to Grand View Research.
Numbers like those have inspired a long list of security vendors—including Barracuda, ESET, Sophos, Trend Micro—to enter the XDR market.
