How Managed Detection and Response Helps Small Businesses Fight Cyber Threats

Enterprise IT and security teams face a constant challenge: defending their organizations against increasingly sophisticated cyber threats while managing limited budgets, staffing shortages, and a growing attack surface.

For many organizations, hiring and retaining the highly skilled professionals required to operate an in-house security operations center (SOC) is difficult or simply too expensive. Meanwhile, cybercriminals continue to refine their techniques, with successful attacks capable of disrupting business operations, exposing sensitive data, and causing significant financial losses.

To stay ahead of these risks, organizations need a proactive cybersecurity strategy that combines prevention, detection, investigation, remediation, and accurate threat intelligence. When building these capabilities internally is not practical, security-as-a-service provides a scalable alternative.

Small and midsized organizations have long benefited from technology delivered through managed service providers and cloud computing. The same approach can now provide access to advanced cybersecurity expertise through managed detection and response (MDR) services.

MDR gives organizations proactive, expert-led threat monitoring, detection, investigation, and threat hunting without the cost and complexity of maintaining an elite in-house SOC. While MDR was once considered expensive and difficult to implement, it is becoming an increasingly practical option for smaller businesses.

In a recent conversation, ESET Threat Research Director Jean-Ian Boutin discussed how threat research and intelligence support the MDR process. The conversation also explored how combining advanced security technology with human expertise can deliver practical benefits for small and midsized organizations.

What Small Businesses Gain from ESET Threat Research

What can small business customers learn from ESET Threat Research, and how does that experience change when they use ESET MDR?

ESET operates a geographically distributed threat research team. Researchers are based across Europe, the United States, and Canada, including Montreal. This global presence helps the team monitor cyber threats and develop a broad understanding of how attackers operate.

Much of this research is publicly available through WeLiveSecurity publications, as well as presentations and discussions at cybersecurity conferences around the world.

ESET business customers also receive additional threat intelligence, including information about threat actors, their tactics, techniques, procedures, and evolving campaigns. This insight helps organizations better understand the risks they face and take steps to strengthen their security posture.

Managed detection and response and threat intelligence are important parts of this process. They help detection and response teams understand how attackers operate and apply that knowledge to protect customers from breaches.

What Happens Behind the Scenes in an MDR Service?

We have discussed the visible benefits of MDR, but what happens in the backend of the service?

Alerts that appear in a security console may represent endpoint detections requiring additional investigation. ESET’s threat research team works to ensure that new malware samples, attack techniques, and emerging threats are analyzed and detected across customer environments.

Researchers continuously investigate new trends and samples so that security controls can be updated and customers can be protected against evolving attacks. This process is a critical part of effective MDR.

ESET also organizes threat intelligence related to cybercrime, ransomware, advanced persistent threat (APT) groups, and nation-state actors targeting organizations around the world. Researchers use this information to connect new incidents with previous cases and identify recurring patterns.

This intelligence can help determine the severity and purpose of an attack. It may also provide customers with greater visibility into what happened, whether a breach occurred, and which threat group may have been responsible.

How MDR Enhances Endpoint Protection

What does MDR add to existing ESET endpoint protection?

MDR extends endpoint security by adding continuous monitoring, investigation, threat hunting, and expert-led response. Instead of relying solely on automated endpoint alerts, organizations benefit from security analysts and threat researchers who can add context, investigate suspicious behavior, and help determine the appropriate response.

The intelligence produced by ESET’s research teams supports multiple products and services, helping strengthen protection across the broader security portfolio.

Are Small Businesses Targeted by Cybercriminals?

ESET Private Reports have also received attention. How relevant are these reports to small and midsized businesses? Are smaller organizations targeted by nation-state actors?

Threat profiles vary from one organization to another. Nation-state attackers generally pursue specific strategic objectives and focus on victims that align with those goals.

Cybercrime, however, is much broader. Many criminal campaigns target organizations at scale, including small businesses. Information stealers and ransomware remain common threats, and attackers continually develop new tools and techniques.

The role of threat research is to understand how these groups operate and identify new technologies or methods as quickly as possible. This allows security teams to improve detection and disrupt attacks before they cause serious damage.

Because there are so many threat actors and malware families, protecting customers is an ongoing process that requires continuous research, monitoring, and adaptation.

Using Threat Intelligence to Investigate Attacks

ESET security analyst James Rodewald has described the value of “triangulation”: observing activity, hearing from affected customers, and validating the findings through threat intelligence. How does this work in practice?

Close collaboration between threat researchers, MDR analysts, and customers is essential when investigating an incident. ESET’s threat research team examines telemetry collected from endpoints to identify unusual activity and cases that may improve overall protection.

Sometimes, an MDR investigation reveals activity associated with a threat actor or campaign that researchers have encountered before. This historical context can provide a deeper understanding of the attacker’s tools, objectives, and operating methods.

For example, a case involving FamousSparrow highlighted the value of combining customer telemetry with established threat intelligence. When MDR teams maintain a close relationship with a customer, they can better understand the organization’s infrastructure, assess the impact of an incident, and provide more targeted assistance.

Insights from individual investigations can also help protect other customers. By correlating incidents across organizations, researchers can expand detection coverage and improve their understanding of emerging threats.

Why Collaboration Between MDR Analysts and Researchers Matters

How does working directly with MDR analysts and detection and response teams improve threat investigations?

MDR creates an established relationship between security analysts, threat researchers, and an organization’s security leadership. This makes it easier to determine the scope of an attack, understand what occurred, and identify why an attacker targeted the organization.

MDR environments also provide significantly more information than a standard endpoint deployment. This additional visibility gives researchers valuable insight into an incident and helps them understand attacker behavior across the customer’s network.

MDR and Supply Chain Security

Recent attacks against large organizations have demonstrated how outsourced help desks and other third-party providers can become entry points. Should small businesses involved in supply chains be concerned?

Supply chain attacks represent a serious cybersecurity risk. Threat actors frequently look for weaknesses in third-party providers with limited security controls. By compromising an IT service provider or another supplier, attackers may gain an initial foothold in a larger organization’s network.

Small businesses can be both suppliers and customers, which makes supply chain security especially important. A compromise at one organization can create risks for its partners, customers, and other connected entities.

MDR can help by providing broad visibility across endpoint activity, detections, and alerts. Continuous monitoring makes it easier to identify subtle anomalies that might otherwise be overlooked. Security teams can then investigate suspicious activity and respond before an attacker progresses further into the environment.

Although no organization can completely eliminate third-party risk, effective monitoring and rapid response can significantly improve resilience against supply chain attacks.

The Business Benefits of Managed Detection and Response

What difference does MDR make for customers, and how does it compare with operating without an MDR service?

MDR improves continuous visibility into an organization’s environment. If a business is affected by a cyberattack, MDR can help security teams piece together the attacker’s actions, determine how the threat moved through the network, and understand what data or systems may have been affected.

From a threat research perspective, this deeper visibility is one of the greatest benefits of MDR. Another important advantage is response speed. Because a secure communication channel already exists between the MDR provider and the customer, analysts can quickly contact the appropriate people and recommend actions to contain the threat.

Is MDR Too Complex or Expensive for Small Businesses?

What would you say to organizations that believe MDR is too complex or expensive?

MDR can function as an important layer of cybersecurity protection, helping organizations identify threats such as ransomware before they become major incidents. Attackers may use initial access brokers or other methods to enter an environment, but early warning signs are often visible when organizations have the right monitoring and expertise in place.

Although paying a ransom is not recommended, recovering from a ransomware attack can be costly, disruptive, and complicated. MDR supports business continuity by helping organizations detect, investigate, and contain threats while allowing employees to remain focused on core operations.

For small and midsized businesses that cannot build a full in-house SOC, MDR offers access to security analysts, threat researchers, and advanced detection capabilities at a more scalable cost.

Sponsored and written by ESET.