Adding EDR to my stack and how to sell it.

[thecomputerguy]

The majority of my income at the moment is coming from recurring monthly billing through my MSP clients and my Software stack includes:

RMM (Syncro)
BitDefender
DropSuite for M365 Backup
SMTP2GO for SMTP
All clients are on Ubiquiti Equipment that I manage from my Ubiquiti console

I also still have have a healthy hourly clients (and some residential) that I sell my stack to for $250 a year which includes my RMM and a BitDefender License.

I am looking to add EDR (Huntress) mainly to my MSP clients. My cost is going to be $3 per endpoint per month.

I 'could' create a package for my non-MSP clients that include it for $349 per year but I doubt that will sell well to Grandma.

Regarding my MSP clients ... I see the value in having an EDR and a second set of eyes (SOC) on the security of the devices. But I'm curious as to the sales techniques to sell it and possible arguments I'm going to run into.

I feel a lot of clients will see it as another Anti-Virus, which on some level it is so I can sort of see the conversation going like this.

Here's a new software I'd like to add to your system it does this this and this and costs this.
Oh so it's like Antivirus? I though we already had that
You do, but It's more of an active software with a professional (SOC) team constantly monitoring active infections on a minute by minute basis for clever cutting edge attacks
So what were using isn't good enough? Then why are we even using what you provided to us in the first place I thought we were already protected this seems redundant and ITS EXPENSIVE!
You are but BitDefender isn't this. BitDefender is no where near as sensitive as EDR when it comes to protection, It's more of a traditional AV that protects against existing threats, and threats after they have entered the system but will not protect against cutting edge attacks.
Ok but everything has been fine up to this point and if something goes wrong we have YOU to fix it why do we need someone else?
A second set of eyes the solely focus on active security of endpoints on the network with the constantly changing security breaches and requirements is a great to have in the toolbox.
Doesn't BitDefender do that? Isn't that what AV is?
Well no, BitDefender doesn't protect and disconnect devices from the network in the event of a breach against clever cutting edge attacks
Then why have we even been using it at all up to this point if it doesn't seem to protect us in an adequate way? Why do we need both?
Well basic AntiVirus is always good to have this is just another layer on top of that that plays a more active role in security

Essentially I'm feeling like it might be hard to sell as another layer of security. Some of these clients I've had for 10 years and they believe I am providing them with the best possible stack, but now I'm saying what I'm providing isn't good enough.

I will get a license for $3 and probably try to add it to the stack at $6 per endpoint which would make it my most expensive per unit piece of software in my stack.

I can just see the day when a client gets hit with ransomware and not only is it my Job to fix it but it's my fault because my security (BitDefender) failed to intervene and I'm on the hook for unlimited time to fix it due to my MSP Guidelines. Some of these clients are paying upwards of $2,500 a month for my stack + unlimited remote support or my stack + unlimited onsite support.

I'd like to think I'm an MSP but as years go on I'm realizing I've created a job for myself (that does VERY well financially) that has me on the hook for anything and everything at any time. While I do make a lot of money I'm solely responsible and basically have pigeon holed myself into never being able to take any time off so I'd like to protect myself and my clients as much as possible.

 

[SAFCasper]

Biggest selling point to our clients has been the 24/7 SOC. Usually pitch an example revolving around a device getting compromised on a Friday evening. BitDefender could scream and alert us all it wants - we don't work weekends so would potentially go unnoticed until Monday morning.

Huntress on the other hand (or any good EDR) their SOC would step in to block and isolate that device within minutes. Followed by sending an incident report on precisely what was detected, what files were involved, what potential damage it has done and any required steps for remediation. All from fully trained security specialists, which we are clear we are not.

If worried about comparing BitDefender don't be afraid to point out they also sell their own EDR which is what this should be compared to.

Also we are frequently seeing EDR as a hard requirement for cybersecurity insurance. These companies spend millions on research so if they deem something important enough to be a requirement it's for good evidence-backed reasoning.


My own advice - ditch BitDefender and use MS Defender with Huntress.
It's what huntress works best with and is most heavily integrated. Now you aren't selling an additional service, just a slightly more expensive one.
You can always use Defender for Endpoint paired with Huntress for those needing the extra security.

 

[YeOldeStonecat]

We also changed from BD.....we went with SentinelOne Core for our basic protection now, although I very much like Huntress on Defender...that's a great choice.

Anyways, to my point, just...raise your rates, and say, due to the need to keep up with security/protection, you switched your endpoint protection product to a better one. We're going to completely get rid of our BD GravityZone account...so any clients that don't want to stick with us....they'll just have to...go with plain Defender or find someting else.

Only very recently...like last year...did I start talking with the gang about some plan to regularly raise our prices, instead of...sitting at the same prices for too many years. And the way we're going to do this is....pitch "security stacks". Our security stack for 2023 was blah blah blah..and cost blah blah (think our primary change was adding DNS Filter Pro agent to each workstation). For 2024 we're now using SentinelOne for endpoint. For 2025 we're adding SaasAlerts to Microsoft 365. And maybe Octiga.

Selling it as...adding tools and services to keep up with technology. Mandatory for our managed plan clients.

 

[HCHTech]

This topic is bubbling up for us this year as well. We are using BD + EDR for most of our commercial clients, and I'm trying to solidify my pitch to go to MEDR and increase the price to cover the cost + margin on the "M" bit. I am not in the camp that believes EDR replaces AV, so that isn't going to happen. Plus, from a selfish perspective, I don't want to give up the margin we have on the AV.

I think where we're heading is to stick with the AV for residential customers and replace [BD + EDR] with [Defender + MEDR] for commercial. I have more thinking to do on this, but I think we have to do it one way or the other.

 

[Sky-Knight]

M365 Business Premium includes Defender for Business, which is an MDR and Content control as well as an attack surface reduction tool.

Why have another tool in the stack when you can just let Defender do the lifting? The tool automatically feeds the SIEM (Azure Sentinel) when it comes time to scale to that too.

Sentinel One is nice... but behind.
Huntress is WONDERFUL but not really an EDR. It's more like an XDR / dedicated DOC... but still that's not quite right either they have an utterly unique service that adds tremendous value no matter what org grabs them.

BD isn't an EDR, and I hate they get away with calling themselves that. Unless you regress your definition of "EDR" to that of a managed anti-malware tool. Which even Microsoft has done, so I guess that's the world we live in.

Note... according to Microsoft:
EDR > MDR > XDR

Endpoint Detection and Response > Managed Detection and Response > Extended Detection and Response.

This flow according to others can be:

EDR > XDR > MDR

Microsoft assumes the "managed" label when the endpoint is "managed by a console". Other organizations assume the managed label when the endpoint is "managed by a human".

So depending on who you're talking to, the featuresets described when you discuss MDR and XDR CAN FLIP! Know your audience.

 

[YeOldeStonecat]

Huntress can be bolted onto pretty much ANY endpoint (AV) you want...be it Defender, or BitDefender, or Eset, or Symantsuck, or SentinelOne, or...or....

Great service. Saves a lot of time for the MSP....especially good for MSPs...Huntress spends time in the management portal, so you don't have to.

IMO SentinelOne isn't behind...it's just that...Defender for Business....has gotten that good.
Easy to roll out.
Careful if you want to tread into ASR land....be prepared to spend your life under that hood....
BUT...not really a satisfying (to me) centralized management yet..for multi tenant. Yeah Lighthouse for 365 gives you "some" insight...but you're still spending gobs of time to go in and manage things. Which is why I still like having S1 as our primary...for the rest of our guys...it's just 1x multi tenant dashboard to dial into and fiddle...

I do have some clients out there on Defender for Business only....I kind of keep them to the side, happy with the product, if they need something..it's me out of the 6 of us who goes into to fiddle.

 

[Sky-Knight]

@YeOldeStonecat That is basically the story of M365 isn't it?

We have tools, but for the most part each estate is a monolith. Defender is very much so by design.

The thing with all the Defender products... and oy they are many is they are all intended to feed Sentinel. And once the SIEM is online, you have a SOC monitoring. We do that for SMBs as well as enterprises... but THAT is where the MS product really outshines everyone else.

Sentinel One tries to pretend it's a poor man's SIEM, and it offers too much false security in that area which is why I call it behind. But that's a poor description because you're right, as an ERP it's competent! It's very easily manageable in a multi-tenant scenario. The issue I have is more that it tends to make you think you're more protected than you actually are if you're the one doing the managing. False security is the worst kind of security! And experience engineers have the constant problem of unlearning old bad information because things changed. That subtle hint of SIEMness seems to catch way too many otherwise very good people, and I've watched it burn them down. It's not fun!