Name: MDR, Please: Finding the Right Flavor of Managed Detection & Response
Uploaded: 2025-10-07T17:16:13.794Z
Duration: 44 min 48 s
Description: MDR, Please: Finding the Right Flavor of Managed Detection & Response

Transcript for "MDR, Please: Finding the Right Flavor of Managed Detection & Response": I like that. I am Oz. That's funny. It's a great and powerful I was just gonna say that. Hey. We got five people on already. One of them snacks. Okay. Thank you everybody joining so far. We're gonna get started in just one more minute. Okay. We're gonna go ahead and get started now. Thank you everybody for joining. My name is Jared Hackett. I'm a channel engineer for Sophos. And on with me today, we have Eric. Go ahead. Eric? Yeah. Thanks, Jared. Eric Holmes, security solutions specialist here at CDW supporting our nonprofit vertical. Awesome. Thank you. We're excited, for all of you to be with us today. Today, our agenda, we're gonna, spend a little bit a little bit of time. Eric is going to cover how CDW and Sophos are better together, and then we're gonna jump into what is managed detection, cover a little bit about what's going on in the threat landscape today, why why MDR is needed, what are the different types or flavors of MDR, and what makes Sophos different as an MDR provider. And we'll also go through expected outcomes and business value. What should you really be getting out of MDR? What level of engagement is available to you? And, you know, then in a lot of cases, customers will say, well, MDR sounds great. You know, we we probably do need it, but how can we fund it? And then we'll open up the time for any questions. So, Eric, over to you. Yeah. Thanks, Jared. So, wanna take a couple minutes and a few slides to just really talk about, Sophos is the brand, CDW is the brand, and and our partnership is is Jared had mentioned. We we can read the slide, but, you know, Sophos defends and CDW empowers. Really, what that means to me, you know, I I've been here twenty three years at CDW, the last twelve on on the security side, and I've been selling Sophos solutions for as long as I was an account manager and then, supporting, the CDW brand on on the security side of the house. And, really, what, you know, Sophos brings to the table is is the ability to operate securely, innovate boldly, achieve more. What that means to me, we can help protect your everything on your network and help you sleep at night, and and do the other things that you need to do on the security side of the house rather than just manage alerts all day. So when we talk about Sophos, they are the largest provider of managed detect and detect and response services in in the industry and the market. So you're you're when you look at Sophos as the brand as and as an MDR partner, you're really getting, someone with the know how and the legacy capability to provide that solution. And Sophos and a lot of customers maybe don't recognize this, but, Sophos is recognized by Gartner, for their customer choice and also as the g two leader for for multiple categories. So that's endpoint protection, firewall, MDR. So when you go with a company like Sophos, you're really getting a a full brand, which kind of leads into the next point, and I'll talk about this in another slide or two. Sophos does have the largest AI native platform in the industry, which means that they're compatible with virtually any environment. That's gonna be really important when we start talking about everything you need to ingest with an MDR solution and all the telemetry you need to look at in your network because gone are the days when you have three or four security products. You need to be able to integrate everything into your platform. And as I alluded to before, Sophos has the most expansive portfolio of world class solutions in the market, including managed security services. So as as I said before, you're you're not just going with an endpoint partner. You're really getting a a full platform. A little bit about the the the CDW side of it. We are, a couple brag slides here in in endpoints, I'd like to say, but, CDW is the largest reseller of Sophos globally. What that means for you as our our customers and everybody that's joining the webinar today is that we get, the best discounted pricing. We also have tons of resources available for you. So we put on things like this webinar. We can do demos. We can get technical with you. It's really more than just a, transactional partnership. We can really help you with the Sophos portfolio. What goes along with that is is CDW has Sophos certified engineers, and that's really that purple box that you see on the right hand side. We can do more than just sell you that solution. We can help you implement it, deploy it, and train you on it as well. That's a little bit newer to the CDW stat, but certainly a capability. And all of that put together is part of the reason why CDW has been a a six time Sophos National Partner of the Year. So when you look at Sophos and CDW, you're really getting, you know, strong partnership. So, Jared, if you can move to the next one. And, for everybody that that's joined us today, I'm sure you've heard this from your account managers, so a little bit more about CDW. Why why do we stand apart? And when we look at that, it's really our scale of our services and the breadth of our capabilities. So I'm sure many of you have have seen something like this or heard this from your your AM or another specialist like myself. CDW is an industry leader whether you look at market size, number of customers, our partners, network. We do I'll cover this in the next slide. We have the the largest selection of really the leaders in any category that you look at up and down the security stack or networking, data security. And so that means that we have access to the best pricing and the best availability. A lot of the Sophos solutions are going to be more services based, software based, Not necessarily as important, but still, I like to highlight it when we talk about CDW as as the brand. And then the breadth of our capabilities as I've mentioned. Our workforce development team, that's the team that can help train our customers on a Sophos solution. So you're not just buying a product and we say, good luck. I hope you can get this set up or you know how to run it. We can get you trained on that. And I'll skip over physical security because it's not really important for this webinar, but, CDW does offer 24 by seven managed services, whether it's this particular solution that we're looking at or other ones up and down the security stack. CDW is there to help out with that. So, next slide, please. There are a lot of numbers on this slide. I'm not gonna go through everything. This really just speaks to, a little bit of of the problem of security, and you might think that's a little bit funny. But, we'll we'll tell you why that that is in a second. You know, we have on the left hand side, those are all of the different practices that sit underneath these the CDW security practice. So we can help you with all of those things. We have a thousand different professionals just focusing on security at CDW, whether that's a solution specialist like a presales resource like myself, our delivery engineers, our thought leaders, or the the people that work up and down that stack of solutions on the left. Where this becomes important is our our vendor partnerships. We have over a 150 different vendor partnerships. We did 10,000 service engagements last year with those with our customers. We have 3,000 different unique customers. All of this is to say, when when you partner with CDW, you partner with Sophos. You're getting a couple legacy brands that have been in the industry a long time. We've done this before. The last number I'll highlight on here, CDW Security Practice, just as a stand alone organization, did $4,000,000,000 in security solutions and services. So if we were our own company, it would be a 4,000 sorry, $4,000,000,000, entity. So, a little pat on the back for CDW, but when but as I mentioned, when you look at that partnership, you're really getting, a strong integration between the CDW and the Sophos side. So if we can go to the next slide, we'll kinda tie all of this together. So this is a very busy slide. You're not really meant to look at all the little pretty pictures on here. But when we look at, you know, security and why I said is is all of those partnerships the the solution or part of the problem, there are 16 different security, categories that are listed on this this placemat looking thing. It's endpoint security. It's information security. It's network security. There are subcategories underneath that with fifteen and twenty different partners under there. Security is confusing. It's difficult. There are a lot of different sources of telemetry alerts. Alert fatigue is real. And so you can try to get the best of breed in every single solution, or you can get a single pane of glass for a lot of these things, but you're still gonna end up with ten, twenty, forty, fifty different security products in your network. And you gotta figure out how to take all of those alerts, triage them, let's figure out what's important, why did I get this alert, where did it come from, can I stitch it together? And I've got one more slide before I turn it over to Jared to kinda get into the the Sophos MDR solution. But, we've seen research from a couple different places where we look at, like, percentage of ticketed in incidents from telemetry sources, and this really boils down that last slide into seven different categories. And everybody that that's done security or networking or or wears that IT hat has seen this. We know you get logs from your routers and your switches on your network. Your firewall is sending alerts. If you're in public cloud, you're getting alerts, from GCP and Azure or your firewalls in the cloud and your SaaS apps and your endpoints, your identity solutions. So you've gotta take all of that, put it together, like I said before, stitch it together, correlate it. What's important? What's what's an alert? Where did this come from? How do I fix it? You can have all of those products that I showed or products in all those categories that we showed two slides ago. You still need a way to kind of put that all together, manage it, and a lot of our customers are choosing to get help from custom from, sorry, partners like Sophos to, integrate all that. So with that said, I'll get out of the way and let Jared talk about the Sophos MDR solutions. Hey. Thank you, Eric. That was great. That was a really great insight into what CDW can bring from the services side of things and and how we are better together. Just gonna start off with a really quick definition so we can have a common ground. So when when we're talking about managed detection and response, or as I'll say, MDR a lot, just because, it's faster that way. It's a cybersecurity service that combines technology and human experts to proactively hunt and respond to threats twenty four seven. Also, I forgot to mention, if you do have any questions as we go along, please feel free to put them into the chat. I mean, the the question the q and a section, and if possible, we'll just address them when they come. But moving on, so we're gonna talk a little bit about the threat landscape and why it's important to have a service like MDR. Traders are most nervous about. Ransomware is still really big, and it that's not really going to go away. Same thing with data theft. Those two things kind of go in hand in hand, and and we'll talk about why that is. But, there is a lot of stuff going on with cyber criminals where they're innovating in how they can use data theft for extortion methods. We also have cybercrime as a service. It it used to be within with, you know, within the realm of cybercrime that you had to be really smart and know how to write kind of your own malware, do all of that kind of stuff, you know, figure out how to break in or find a vulnerability on your own. Now you can just go on the dark web and sign up for these tools and for expertise just like you do with your cybersecurity tools. You could sign up for phishing as a service. You can sign up for malware as a service. And if you're having trouble running the campaign or executing anything, they're they have help desks that will help you be more successful as you're as you're trying to fish and break in and steal people's data. So it really lowers the, the gate of entry into getting into doing these things, which is why you see it just kind of, you know, every it's happening all the time now is because people are seeing this as a way to make quick money. They really are. Dual use tools has gotten really big. Dual use tool is something that is a legitimate tool like remote desktop protocol that is used by hackers. And what we've seen over the last couple years is that they are leaning more and more on dual use tools to evade detection and to evade, you know, any kind of detection or security practices in place. Because if they can get a PowerShell script to run and and it's not too crazy of a PowerShell script or it's not encrypted or something like that, that can often get by, security tools. And then social engineering. Social engineering has has become really popular as well. It's it is really hard to find vulnerabilities and exploit those. It is much easier to trick a human. And and we're gonna we're gonna dive in a little bit more specifically into those. There is one good statistic that's come in from Sophos' surveys and and, stuff that we've been doing over the last year is that we've seen over the last year that there has been a 29% drop of of data encryption rate in the last year. But what has actually happened is that while that while the encryption rate has dropped, the data exfiltration has doubled. So instead of just encrypting your data and then asking for money, they are stealing the data as quickly as they can to try not to set off any any alarms or alerts, and then they try to extort with that data. Like, hey. You'll have to pay us a a subscription fee so we don't release this sensitive data. So while while the files may not be getting encrypted, they are being stolen more. So it is it is good and bad in those ways. So a couple of recent more recent examples of this. So when we're looking at the nonprofit, the Jewish the Jewish Federation of Greater Washington, had had an issue a little while ago where they were they were allowing employees to leverage personal computers for their work, you know, as a cost savings measure, and there was a breach that ended up happening. We don't have a lot of information in this other than the the FBI got involved with it, and they had to go in and, like, completely overhaul all their security protocols and do a full audit. But, typically, when when these types of things happen, it's, you know, somebody was leveraging a VPN. And, if they compromised the personal computer, then they had full access to the VPN to get into the system. And then they've and then they had full access to do whatever they wanted, which in the in the case of the Jewish Federation of Greater Washington, over time, the hackers siphoned out about $7,500,000. And so these are these are the kinds of things that, you know, there would be anomalies and systems would be being accessed at different times and, like, off hours times that an MDR would be able to see that type of behavior pretty quickly and all the lateral movement and put a stop to that. Another one, is One Treasure Island. This is a nonprofit out in San Francisco. They were working with Mercy Housing of California, and they were working on setting up some funding for an, for a low income housing project. And what ended up happening was the hackers, phished one of the bookkeepers and got in between both of the entities. So when hackers do this type of a thing, business email compromise, they'll often set up a whole bunch of inbox rules that will hide everything that they're doing and allow them to control the traffic of what's going on on the emails. So the hacker essentially sat in the middle and said, hey, One Treasure Island. Here are some different wire instructions because your bank is under because the bank we normally use is undergoing an audit. And so they they wired the money to the wrong bank. And then on the Mercy Housing side, they said, hey. Your payment's going to be delayed for a few days because the bank is undergoing an audit. And they had no idea that this was going on. They both just thought there were a couple of delays, and it wasn't until they were sitting in a meeting that that, Williams from the, 1 Treasure Island side told the people at Mercy. She said, great. You're you're all paid. And they said, no. We haven't received anything. They had no idea that anybody was even in in between. And that resulted in in a loss of $650,000 in that in that sense. And this is some this is something where Eric was talking about all these different telemetry sources, like email is a really important one. Those types of things, the behaviors of what the hackers are doing are all very sim similar, and that's the kinds of things that MDR teams are are looking out for. Just one more quick one. It's a it's a similar similar story as the previous one, but it was business email compromise. The hacker actually got in, took over an account, and started creating fake invoices for solar panels for health centers in Pakistan. They ended up losing 1,000,000 in that. I I just I'm adding this so you guys can understand that this isn't just small, not like small businesses or nonprofits or anything. Both, Google and Facebook over a multi year period fell to this type of hacking to a combined damage of over 120,000,000. And you would you would think this that this would be really sophisticated groups that would have this type of information and know what they're going against, but, really, it's there there's a lot involved with it. There's a lot of that social engineering aspect that, you know, we discussed as part of that threat landscape. So moving on. Now there are different types. I'd like to say flavors. I love ice cream, so we're gonna relate it to that for now. But there are different flavors of MDR that that have kind of come out historically. You have endpoint focused MDRs. These these are the the companies that really specialize in just respond responding on endpoints. And and you may say, well, that's, you know, that's that's really not looking at that whole picture that Eric just described, and it's really not. It is a very important piece of that picture because that is where the data ultimately sits is on the endpoints and the servers, but it is incomplete. And if if you're at all familiar with Sophos, Sophos historically was an endpoint focused MDR offering back when we used to call it, MTR, Managed Threat Response. That was several years ago. Then there's network centric, where they focus much more on looking at the network because, you know, at some point, the hacker has to jump around and move around the network and get in. Pure play is the definition that they give to companies that are just focused on purely managed section and response services. And what Eric said, is true. Sophos is actually the largest pure play MDR provider that's that that exists at this time. And we'll talk about why why that's beneficial to you in just a minute. And then there's obviously cloud, but, really, the way I define Sophos is is down at the bottom, is that we are the all in one, flavor for everything. We have comprehensive protection across all of them. And this is so to me, instead of having to pick a flavor with Sophos, you can have it all. And, yes, that is AI. That is an AI picture. That that's that's what I use AI for is generating funny pictures like this. But, Sophos, we do we have a we have an incredible industry leading Sophos MDR solution that your peers love. We have a lot of, nonprofit customers that are on Sophos MDR, and they love it. We also have amazing products within that stack, and and we leverage that to create the best platform and experience possible. So we do have, we have the first MDR optimized firewall that our MDR team can can work with in in a response if needed, and many other things. But what allows us to have that is, for those of you unfamiliar, we did acquire a company called SecureWorks, a little while ago. And so the combined portfolio of both SecureWorks and Sophos looks like this. So down on the bottom, we have our Sophos x ops threat intelligence. Sophos does have is a tier one provider of threat intelligence, in the world. We have over 250 threat analysts that they're just researching what, what hackers and cyber criminals are doing all the time. And we do provide that threat intelligence throughout the cybersecurity community. We also have our own in house AI team that is developing AI tools for these products. Our endpoint protection and our platform leverage over 50 different AI models for detection, response, and all sorts of stuff. Then what I'm really wanna call is is in the middle in the platform, with SecureWorks and what we're bringing in. Before we could bring an endpoint email firewall, and we had some integrations that were that we were working pretty open. We had about 50 as Sophos alone. With SecureWorks, we're bringing in over 350 integrations along with the new NextGen SIM capability. So if you have SIM requirements, we can fulfill that. Identity threat detection response, we've added to that as well, and SOAR capabilities that are accessible by the customers. And then we have, you know, the services that tie along and play really well with what CDW services are offered as well. So just as a quick glance, we're only gonna spend a couple of seconds on this. Historically, the the platform was called Tejas. It is Sophos XDR. I just didn't have time to change it on the slide, but I just wanted you to see what some of those integrations were. Now really quickly, I am gonna touch because one of the things that when we combine the companies was we we were bringing in Tejas XDR, but we were keeping the Sophos endpoint. Now as a as a Sophos MDR customer, you have the capability of keeping any endpoint that you want. If you have another endpoint vendor and you love it, that's great. Stay with them. We can layer in our world class MDR on top of that and and still provide the best service that's available. But it is Sophos endpoint is included, if if you if you're looking for it. And just a couple of quick things about that, just to kinda brag about our endpoint really quickly is we do have the best ransomware protection in the market. And what that really comes down to is that we stop remote ransomware, which is ransom the ransomware running from a different endpoint than than the one that's being attacked. In that case, according to Microsoft's report last year, over 70% of successful encryptions occurred in remote ransomware. Sophos is the only vendor that really protects against remotely run ransomware. It does it really well. And we also have automatic file rollback, which is proprietary. We will take a just in time backup of your file right before the encryption happens. And if we deem that encryption malicious, we'll kill the process, take out the hacker, and restore that file exactly the way it was right before the encryption happened. Adaptive attack protection. We're the only vendor that's doing this where, through our AI models, if we detect a hacker that gets on one of your systems, that hands on keyboard, they're in there moving around, we turn up the protection on the endpoint. If you can if you can imagine a bank heist video that you've watched when the criminal runs in and, and they finally trigger an alarm and, like, you know, all the bars come down over the windows and it really blocks them in and and and keeps them stuck. That's essentially what adaptive attack protection does. Stuff that was at one time available to an administrator is no longer available because criminals aren't breaking in their logging in, and we can tell by their behavior whether they have malicious intent, and then we start blocking that. And then anti exploitation. We have over, six we cover we our anti exploitation techniques are the most complete out of any vendor. We we have them published. We will tell you all the ones that we do. There's over 60 of them. Just to contrast this, and I'll I'll pick on Defender because it's it's just built in with everything. Defender out of the box only has six anti exploitation techniques that are running out of the box. With expert tuning, you can get up to 37. Sophos, by default, turned on right out of the gate, it's over 60. So that's that's one thing about our endpoint that really helps in in keeping you protected. Next slide. I have to move over there. So what value should MDR be providing to you and your IT team? Well, I like to think of it this way. Hackers and the Grinch are a lot alike because they both like to steal your data and encrypt all your data in the middle of the night. They aren't going to attack you during the day. They they they know they'll watch and see when you're working, when you're not, and they'll and they'll they'll save it their their biggest impact for when they think they can get the most done, which would be, like, Christmas morning or 2AM on a Sunday or something like that. So with MDR, having a team that is going to be watching twenty four seven, three sixty five, And not just alerting, but taking action on it will really help you sleep better at night. And I used AI on this one as well and put a red hat on him because he's a Linux admin. And then if you feel kind of like you're a one man band that you're trying to run everything, you're trying to reset, you know, a password and do your security, posture analysis, and re you know, and fixing the printer, bringing in MDR immediately gives you another team that is handling all of those threats and that for you, which which leads into the next part of the value is not only that you're getting a skill set and a full team added for you, but you you will now have more time to focus on some of those other more value add, IT projects that are important for your organization. Instead of having to eat your lunch at your desk and keep working, you will have more time for those things taking that security and that threat, that alerts triage off of your plate. And so getting more specific into this, when when you when you're talking to organizations about MDR like Sophos and and some of our competitors, we always like to talk about what does response really mean. Some vendors, when they say response, all they are going to do is isolate an endpoint. They'll they'll alert you to the fact that there is something going on in your environment, and they will isolate the affected endpoints. With Sophos, we will not only isolate the endpoints, but with triage all the alerts and and threats. We'll remove malicious artifacts, code, programs, processes, we'll remove persistent access or other methods of access that the hackers have brought in. We'll disable compromised accounts and revoke sessions. So if somebody falls for a phishing kit and they've hijacked the sessions, we'll take care of that. We'll apply host based IP blocks. And if if you have a Sophos firewall or if we have the specific level of integration, our team can even inject IP blocks into your firewalls and those types of things. Direct call and support during active incidents, full incident response, root cause analysis, identification of compromised assets and remediation support, and a dedicated incident response lead. That's from the response side of things. That's that's what you're going to get if something happens here in your environment and we're seeing it. K? And we are very fast. I didn't put this slide in. I didn't wanna have try to have too many slides. But, our team on average will detect, triage, and respond to threats within thirty eight minutes. So we really aren't giving time for the hackers to really affect anything. We we actually even had a customer whose CEO was traveling abroad and fell for a phishing scam, and they got in in into the SharePoint, and they started messing around in the SharePoint. And within twenty minutes, we detected that hacker's behavior and, revoked the session and the, disabled the account and then worked with the customer to get the password changed and the access changed and get them back in all within twenty minutes. So we do work really fast. And then from a proactive value side, there's that threat hunting that's out there. So our team will be constantly threat hunting across, the Sophos customer's environment. And what threat hunting is is that we're looking proactively for any kind of stealthy movements, any type of new and novel techniques that are going on that hackers are leveraging that maybe just isn't well known yet. So for example, in the last three months, when looking at our threat detection our threat hunting statistics, there have been over 67 threat hunts with 48 of them resulting in new detections that get worked into the product and the processes of our MDR team. And then we have monthly intelligence briefings where you can join, and our MDR teams will tell you about what what's going on, what what threats there are currently so that you can be more up to speed and aware of what's going on. Having an MDR team will also not just improve your security posture, but also lends to that fact. So the Sophos MDR two is SOC two, type two compliant, which if you have those types of requirements, having an MDR team that offers that gives you that type of posture as well as part of it. And then there's proactive account health checks and those types of things that's involved with that. So we won't dive into this too much, but I wanted to take this a little bit further to give you an idea of what this looks like. So in this case, there was a credential theft attack that was coming through, Proofpoint email. And with our integration on that, that you can see we detected though that over a 118 of the employees received the phishing email. Two of them clicked on the link, and within Proofpoint, there were 234 alerts that were generated from this. One of the great things about having an MDR team is that you don't have to focus on those alerts anymore. You do not have to look at those 234 alerts. Our MDR team, investigated into it, found found what the phishing email was. We were able to, block the IP address and, and, sorry, we blocked the IP address, on the endpoints. They we were able to confirm that none of the employees' credentials were compromised. And then we worked with the team to, you know, talk about, hey. We need to increase user awareness for this. You guys really should have multifactor authentication in place, and a better privileged access management practice was put in place as well with that. As I said, we do have integrations with some of these products, so that makes our response even faster and and more complete. So this one ties in directly to those two business email compromise, examples that we talked about where they sent money off to the wrong place because somebody had hacked it and taken over their emails. So in this case, it you know, somebody fell for a phishing attack and the sessions were hijacked. As I said, we were able to disable the sign in and terminate the sessions. But over there on the side, these are the response within Microsoft's three sixty five. So this isn't our team telling you to go terminate the active sessions. This is our team doing this in real time to stop the threat. And I wanna call it, and so we can block and enable the user sign in, terminate the active sessions. But down there, the disable suspicious inbox rules. This is what I was talking about where the hackers will will put in these inbox rules to control the flow of all the emails going in and out. So sometimes what what it will just be is if you go look and you have a rule that just has, like, a comma as the description, there could already be a hacker in your system that's watching your email and just kinda biding their time to find the right information or to inject that email that they could leverage to maybe siphon some money out or something. So we we not only detect on those things, but we can also go through and remediate and clean those up for you on your behalf. And then ransomware. So just a couple of things. Like, in the case of what happened, we isolated the server, disabled the accounts. We added any artifacts. Artifacts would be like software or applications or, you know, malware or anything like that. We added those to being blocked so that they're in the future, they're automatically blocked. We terminated any of the active running processes, and then we did a full analysis, on the location for any other compromised accounts. We reviewed VPN logs to determine how they got in, did malware analysis, and and really went through that. And then for remediation, we suggested domain wide password resetting, made sure that Sophos was deployed to everything that was unprotected. We really need to watch out for that and then, implement MFA for the remote VPN. We that was, you know, some of the guidance. So now you're probably like, hey. This would be great to have that team helping me handle these types of things when they come. And so I'm just presenting you this. The Sophos is not a cyber insurance provider. We don't provide it. But it is it is important to know if you do have cyber insurance that if you have an MDR service, you can usually negotiate significant cost savings. Some in some cases that actually even cover the cost of MDR. So, specifically, in this, like so on the credit union, as you can see, their previous insurance premium was 38,000. We do have a partnership with a company called Sysurance. We do have partnerships with others. This is just an example. But when when the customer purchased Sophos MDR and they went to CDW and CDW and said your premium is going to be 6,500. And in some of these cases, they actually get a higher premium because I mean, they get a higher coverage rate as well. And then for Sophos, the the cost of of the Sophos MDR with pro services was 24,000. So there was a lot of savings involved, and the and the customer got better security overall, and they got and they got better coverage. So these are so these are just some of the examples. If you haven't looked at that that kind of a lever to, you know, maybe help adjust budget or find ways to to cover that. It really is advantageous, for cyber insurance because they know that their risk of any anything really happening that's going to be cost it's going to have a significant cost goes way down, the the risk of that. So and then another way is if if you are using a SIM with Sophos, with our, you know, our the way that our company is structured and with our integrations and everything now, we do have that SIM capability, and we are often significantly cheaper than a dedicated SIM. And so you can find the the budget for it within that with the cost savings. And the reason why our competitor why you'd wanna choose us over our competitors is not only will you get that SIM replacement with all the logging and everything that you need, and we do great we do ingest raw logs, is that from a security standpoint, you can get access to a security analyst in less than ninety seconds. We do have superior threat intelligence in that incident response. Everything that I just described to you that you're getting it from an action side of things of response, that is not what everybody else does in MDR. That's why we, you know, what kind of response are you getting? We we call it big r or little r. Are you getting little r response? Are you getting big r response? And then you'll have full visibility into all of your data as a SIM replacement. We do know that some of our competitors will ingest all of the data as, as a SIM replacement, but, some of that data is is you have to request it through, somebody at that company to to say, hey. Can I get my firewall logs from three weeks ago? Whereas, we just have that data present and available for you at any time. And then you don't finally, you don't have to take, my word for it. Sophos is the top rated MDR service on Gartner Peer Insights. That is not analysts. That is customers that have gone on there and rated us, as as a service that they really love. And that's it. Are there we really appreciate everybody jumping on today, and thank you for your time. Are there any questions? Jared, I haven't seen any come through the chat. So, if anybody has any questions, they can use the chat feature. Yep. But I I wanted to to circle back on something you had mentioned while we give everybody a a minute or two if they they had anything that came to mind. A lot of the conversations that I have with my customers, and and I cover nonprofit nationally, so I I've got a a good book of, customers that that I talk to on a on a regular basis that, movement from SIM, and we know, like, the big SIM players, it's a huge product to stand up and maintain and care for and feed. Customers are more and more moving to MDR solutions like Sophos as a replacement for a quote, unquote managed SIM or managed SOC simply because it's easier. It's more cost effective. And like you said, you get access to that, resource. You know, if you have an incident and you need to triage something, you can get access to, an expert within ninety seconds. That's just a benefit to have moving from that old school legacy SIM solution to an MDR solution. So it it's something to consider. And and as you mentioned, you can often move budget from, what you are paying for, Splunk or one of those guys, over to your MDR solution, and you're covering more of your stack and getting more insights, without having the overhead of having to have, like, a full time employee managing that. So just wanted to share that from my experience talking with customers on a on a daily basis that are looking at this type of solution. Yeah. Thank you. That's awesome. We haven't had any other questions come in. So once again, we'll thank you for your time today. There should be a follow-up email that goes out to all of you, and we we appreciate your time, and thanks for joining us. Thanks, everybody.