Florida-based MSSP CyberPeak is the newest managed services partner for Respond, which initially targeted enterprises when they came to market last summer, but has since added a strong channel emphasis.

Respond Software, whose software is typically used to automate Level One analysts in SOCs, has announced a new MSSP partnership, with CyberPeak Solutions. The partnership is part of a concerted drive by Respond to add more MSSP partners, as the company builds out their channel to resell what they believe to be a novel offering in the marketplace.

Respond Software is a 2016 startup which just brought their offerings to market last summer. They are focused on robotic decision automation [RDA], a variant of the also newish, but better-known robotic process automation [RPA].

“RPA has been defined as process automation that customers can use to automate their business, using the bot technology to automate what they need to do,” said Matt Eberhart, VP of global sales at Respond Software. “It’s a box of Legos that you use to build your business. What we do with RDA is tailor this to the specific expertise of a security operator, and how they identify incidents and alerts.”

Eberhart, who spent 13 years at mega-MSSP SecureWorks, said that simplifying the procedure of identify and responding to alerts is extremely valuable in that kind of environment.

“Any time you see an alert, the question is what do you do with it,” he said. “MSSPs, SIEMs and SOCs see hundreds of thousands of these a day. Our software uses math modelling to evaluate these data points, and we can take these hundreds of thousands of alerts down to one or two a week.”

What Respond Software essentially does is augment the security analysts by automating the Level One techs whose job is to sort through the alerts and identify the critical ones for the more senior analysts to tackle.

“We augment the people,” Eberhart said. “We are a tech solution for people challenges. People aren’t good at sifting through lots of factors looking for a needle in a haystack, but when we do find an incident, we need to hand it off. One of our bigger customers is an MSSP, which wanted to use us to replace the Tier One analysts. It has created tremendous efficiencies for them.”

Eberhart said that Respond’s biggest competitive problem has been that RDA is counter-intuitive to the way that many IT folks think.

“It wasn’t an easy problem to solve, because many operators have wanted tools where they can turn knobs and switches,” he commented. “They like that. Some solutions, like SOARs, are like that. We believe that this is flawed because no one has time to do it. For a huge company like Uber, we are great because they are so big.

“There’s not another type of company that does decision analysis like we do it, and by focusing on automating incident reporting and replacing Tier One analysts,” he added. “We are also typically less than a three month ROI because we are software, with no engineering required. We can also drastically reduce spend on Splunk and data stores.”

Eberhart said that in today’s Work From Home environment, Respond’s capabilities are more important than ever.

“Today, many security people don’t even have access to the teams they need because they work from home,” he commented. “People aren’t keeping up with fundamental hygiene.”

The newly announced partnership with CyberPeak, an MSSP located in Hillsborough County FLA, is significant because it indicates Respond’s movement towards the MSSP market.

“Enterprises were our original customers, and they are still our customers, as well as the midmarket,” Eberhart said. “When we came to market last summer, we weren’t thinking about MSSPs at all.  We just launched our MSSP program in Q4 last year, and we brought on our first four MSSP partners in Q4. We are focusing on regional and boutique MSSPs.”

CyberPeak will also use Respond to extend their automation capabilities, by automating Tier One analyst capabilities.

“Most MSSPs spend most of their time on Tier One triage,” Eberhart said. “That’s not what creates value for customers. If we do that for them, they can do more valuable things upstream like threat hunting, and provide more value to their customers”

While most MSSP customers tend to be larger, Eberhart said that Respond creates value for MSSPs who work with smaller customers as well.

“One of our MSSP partners has small customers, some as small as 2-3 people,” he stated. “We want to get Respond out there protecting as many analysts as possible. We are a force multiplier for security programs, using the power of software to solve problems. Whether through MSPs, MSSP or VARs, any way we can get into more partners, we are open to it.”