Cynet 360 Vs Cylance
The Cynet 360 Difference
Attack Prevention and Detection
Malicious activity manifests itself in one of three ways: file/process execution, network traffic and user behavior. Cylance is oriented on file/process-based threats and typically gain good results on that field. Cylance relies solely on AI-based static analysis capabilities to detect and prevent attacks. While this approach is efficient against malicious files, it offers little protection against fileless, Macros and LOLbin threats. Moreover, researchers have demonstrated that AI-based analysis approaches can be bypassed by identifying the biases inherent in the detection algorithms toward certain benign files to trick the product into accepting malicious files (see here).
Users of AI-based static analysis report that it is prone to false positives and often blocks legitimate software as malicious. To overcome the false positives, IT and security teams must invest heavily in whitelisting and exclusion of organizational software and other legitimate apps.
Cylance also lacks the ability to identify and block attacks that manifest only in anomalous network traffic (lateral movement, data exfiltration and network-based credential theft) or user behavior (anomalous login of compromised user account).
Cynet 360 uses Cynet Sensor Fusion™ technology to continuously collect and analyze endpoint, user and network activities within the protected environment, powering the ability to identify and block both file/process-based attacks, as well network and user based ones, rendering complete coverage beyond the capabilities of Cylance. Cynet also provides deception technologies to help expose threats across your environment.
Moreover, by fusing together all the environment activity signals, Cynet 360 is able to uncover the true context of each process execution, network traffic and user behavior to unveil and block threats that are undetectable by monitoring just file/processes as Cylance does. Cynet successfully blocks the execution of processes that Cylance allows to run.
RESPONSE: Managed Detection Services (MDR)
Cynet’s CyOps team operates a 24/7 SOC, providing customers with full MDR services with no additional payment over Cynet 360 core offering. CyOps continuously monitors, trains and optimizes Cynet 360 detection algorithms based on over 30 threat intelligence feeds and detected attacks.
CyOps provides Cynet customers with the additional services:
- Alert monitoring
- Attack investigation
- Remediation guidance
- Exclusions, whitelisting and system fine tuning
Advanced cyberattacks leave their mark across all parts of the targeted environment: endpoints, files, process, user accounts and network traffic.
Cylance has a limited number of endpoint/file remediations (isolate, kill process and delete/quarantine file), limited host remediations and no network or user remediation capabilities. Cynet provides a complete set of remediation tools for infected endpoints, malicious files/ processes, compromised user accounts and attacker-controlled traffic.
Moreover, Cynet 360 can act as a response orchestration interface that communicates with core components such as Firewalls and Active Directory to expand the response process across the entire environment.
Cynet 360 supports the use of preset and user-created created remediation playbooks that automate response for detected threats by chaining together several discreet remediation actions (for example, isolate the endpoint + disable user account in Active Directory as an automated response user account compromise detection).
These playbooks both scale the security team alert-handling capacity by automating repetitive tasks and radically increase the share of attacks that are autonomously addressed and resolved by Cynet 360 without need of human intervention.
Monitoring and Control
Continuous monitoring of all entities and activities in the environment is enables users to discover exposed attack surfaces and address them (vulnerable systems and apps, unchanged user passwords, etc.), and by that eliminate the risk of up to 60% of common attack vectors.
Cynet 360 uses Cynet Sensor Fusion™ technology to automate the collection and correlation of executed file/processes, user account activities, file access and network traffic, introducing unmatched speed and ease to all monitoring and control workflows.
Cynet includes 24x7 Managed Detection and Response (MDR) services to all clients that continuously monitor clients’ environments, providing best-of-breed detection and response services. Cylance offers MDR services, CylanceGUARD, but as an optional, fee-based service.
CYNET 360 VS Cybereason COMPARISONS
PREVENTION & DETECTION
Multilayered Malware Protection
|ML Based Static Analysis|
|Dynamic Analysis (Sandbox)|
Compromised User Account Detection
|Anomalous User Logins|
|Preset User Activity Rules|
|Credential Theft (LLNMR\NBT-NS Attacks)|
|Lateral Movement (Pass The Hash Etc.)|
|Reconnaissance (Scanning Attacks)|
|Tunneling Based Data Exfiltration|
|Decoys ( Data Files, Credentials,Network Shares, URL, RDP)|
|Host remediation:||Isolate,Restart,Change IP,Delete\Disable Service, Delete\Disable Scheduled Task,Run Command, RunScript||Isolate in a single use case of auto propagating malware|
|User remediation:||Disable\Enable, Reset Password|
|Network remediation:||Block Traffic, Clear DNS Cache|
|Expand Remediation Across the Environment Infrastructure: Firewall, Proxy, AD, etc.|
|Chain Various Remediation Actions to a Single Flow That Runs Automatically When a Predefined Alert Is Triggered|
MANAGED DETECTION & RESPONSE SERVICES
|Managed Detection & Response Services|
|File integrity monitoring|
Detect and Respond to cyber threats faster with our Autonomous End-point Breach Protection.
Let our team monitor and detect cybersecurity threats against your network, users, files and hosts 24/7 via our ThreatFortress Cynet360 XDR and Response Automation platform.
Real-time Detection and Response to Cyber Threats
Protecting companies from 5 devices to 10,000 around the world.
AUTONOMOUS BREACH PROTECTION
ThreatFortress Cynet XDR prevents and detects threats on endpoints, networks, and users and triggers for each identified threat an automated investigation flow that reveals the attack’s scope and root cause and applies automated remediation. The 24×7 MDR team continuously monitor and optimize this process to maintain top quality and precisionLearn more
Deception Technology Included
Lure Attackers to Reveal Their Presence with Advanced Deception Technology. That's right part of the ThreatFortress system sets traps for cybercriminals to further protect your system against attack.Learn More
ThreatFortress Cynet360 Platform Demo
XDR Prevention and Detection
Helping to protect your business with real-time threat prevention and detection services for your Users, Hosts, Networks and Files. XDR Prevention and detection of a myriad of attack vectors, utilizing the capabilities of the following security technologies:
Complete coverage of all attack vectors that involve endpoint, user and network.
Cynet Prevention & Detection leverages Cynet Sensor Fusion to provide the integrated capabilities of Next-Generation Antivirus, Endpoint Detection and Response, Network Analytics, Deception and User Behavioral Analytics. Cynet also moves beyond the incremental value of these capabilities, by unveiling advanced threats that can be detected only by concurrent analysis of endpoint, user and network activities.
Next Generation Anti-Virus
Block execution of malware, exploits, fileless, Macros and ransomware.
Endpoint Detection and Response
Detect advanced attacks by continuous monitoring of endpoint file and process activities.
Monitor network traffic to unveil reconnaissance, credential theft, lateral movement and data exfiltration attempts.
User Behavior Analysis
Profile the behavior of all user accounts to pinpoint anomalies that indicate an attempted compromise. Learn More
Plant various types of decoy files across your environment to lure attackers into revealing their presence. Learn More
Providing fully automated or manual response actions to threats. Manual and automated remediations of infected hosts, malicious files, compromised user accounts and attacker-controlled traffic.
Full automation of response workflows across the entire environment.
Cynet Response Orchestration includes a full set of remediation actions to address infected hosts, malicious files, attacker-controlled network traffic and compromised user accounts. Remediation can be performed either directly on the endpoint or by involving infrastructure components such as firewall, AD, etc. Cynet supports response automation by gathering several remediation actions into playbooks that are activated upon occurrence of respective alerts.
Remove malicious presence and activity with pre-built actions for hosts, files, users and network.
Build your own response workflows by chaining various remediations together and adding scripts to communicate with core components such as firewalls and AD.
Automate incident response workflows by using Cynet’s playbooks to resolve security events without the need for human intervention.
24/7 MDR SOC Services
Providing you with 24/7 monitoring of all of your endpoints by real humans and SOC Anlysts. CyOps is Cynet’s 24/7 SOC team of threat researchers and security analysts that complement Cynet 360 technology with unmatched security expertise, available to Cynet’s customers at no additional charge. CyOps assist Cynet customers with in-depth investigation, proactive threat hunting, malware analysis and attack reports, ensuring that every security event is handled and resolved.
Proactive Threat Hunting
Continuous search through our customers’ environment to detect and address live attacks.
Engage CyOps upon any suspicious activity you see in your environment, to detect, respond and remediate.
Attack Investigation and Reporting
Get reports on attacks that CyOps detects across our customers’ install-base, including IOC and mitigation practices.
Submit any suspicious file to an expert analysis for information regarding its nature and potential risks.