For organizations that lack resources to build and maintain a SOC, MDR represents an opportunity to transfer the risk of both headcount churn and alert investigation. However, many MDR providers leverage their own platforms and analytics, and they may lack transparency or force organizations to default accept the providers’ risk investigation level rather than determine their own as they would do with an in-house SOC.

Why Not Both?

The value of SOAR and MDR may be similar, but it’s not the same. For those with the budget for products and services but not headcount, there are ways to utilize both.

While SOAR has “security” in the definition, organizations can use it to add value in other areas. As the senior director of product management at one of my company’s partners discussed in a recent presentation, nonsecurity use cases include certificate management and new employee onboarding.

They can also leverage SOAR to act on alerts escalated from the MDR service. By parsing alert escalation emails, many SOAR platforms have the flexibility to integrate with several systems outside the scope of MDR providers, including ticketing, Active Directory, HR and payroll, which can allow analysts to respond faster to alerts that have already been reduced by an MDR provider.

Qualifying SOAR Or MDR

Once you understand the benefits and fit of each technology, the following questions can guide your discovery of the correct solution, though additional criteria will be necessary to qualify the correct SOAR or MDR provider:

• Does the organization have the resources to implement and maintain a SOAR? If not, it may be better to leverage an MDR that doesn’t require the implementation of a separate product (outside of those necessary to monitor).
• Can the organization maintain the resources necessary to upkeep the SOAR platform? After the implementation, the platform will still require care and feeding, or it risks becoming unused shelfware. MDR providers are responsible for maintaining trained personnel necessary to deliver the MDR service.
• Does the organization have the resources to provide 24/7 monitoring if needed? An MDR typically provides 24/7 coverage to investigate and respond to security alerts.
• Is there a potential for automation outside of security to get additional use from a SOAR? A SOAR can provide value to parts of the organization by acting as an API interpreter between platforms.
• Will the organization be able to act on the alerts generated from the SOAR? Some organizations have the staff necessary to respond to alerts already reduced by the SOAR.
• Does the organization have products supported by the preferred MDR provider? MDR providers rely on technical and procedural integrations to deliver service and may only support a limited number of technologies that provide the necessary capabilities.

With the expanded capabilities of SOAR and the headcount provided by MDR, there is a play for both to be used in some organizations without realizing substantial overlap. MDR mitigates the risk of shelfware and unused products by providing a turnkey service. SOAR automates tasks beyond security that aren’t handled by MDR services. The current headcount shortage is more acute for security personnel but may soon encompass networking and infrastructure. Identifying creative ways to leverage multiple orchestration and automation solutions can enable businesses to provide IT services at scale.