WatchGuard Strengthens MDR Services With ActZero Acquisition

WatchGuard purchased a managed detection and response startup led by the former CEO of StackRox to increase operational maturity and embrace an open platform strategy.

See Also: AI Surge Drives a 40-1 Ratio of Machine-to-Human Identities

The Seattle-based platform security vendor said acquiring San Francisco-based ActZero will differentiate WatchGuard’s MDR offering through machine learning and artificial intelligence while supporting the company’s open philosophy for integrating third-party security products. Building a more scalable and efficient MDR offering will help WatchGuard meet the needs of MSPs, said Chief Product Officer Andrew Young.

“It accelerates us at least five years in maturing that MDR service,” Young told Information Security Media Group. “ActZero has things like mature customer and partner onboarding processes and mature SOC processes and playbooks. They have technical account managers that help their customers. And they have customer success capabilities that help stay in touch with the customer.”

ActZero, founded in 2019, employs 40 people and emerged from stealth in March 2021 with a $40 million seed round led by Point72 Hyperscale. The company has been led since inception by Sameer Bhalotra, who previously led container security firm StackRox, was COO of account protection startup Impermium, and was senior director of cybersecurity to The White House’s National Security Council (see: WatchGuard CEO Prakash Panjwani on Making XDR Easy for MSPs).

How WatchGuard, ActZero Will Come Together

ActZero’s existing infrastructure is designed to manage both WatchGuard and third-party tools, which Young said allows the firm to provide broader managed offerings across both proprietary and external tools. The deal will enable better support for third-party tools Microsoft Defender and help WatchGuard scale beyond endpoint protection to manage firewalls, identity, and network detection and response.

“We think about the importance of offering a broad set of managed services across the WatchGuard portfolio,” Young said. “We’re also excited about how this expands beyond the WatchGuard portfolio. One of the first things that we’ll be releasing is the ability to manage not only WatchGuard’s EDR but expanding that to Microsoft Defender and doing managed services around third-party products as well.”

WatchGuard plans to integrate ActZero’s platform and machine learning models with the company’s current products while expanding its managed service capabilities to third-party tools, according to Young. Training ActZero’s machine learning models on WatchGuard’s telemetry data, specifically in endpoint protection, is one of the immediate priorities, which he said will enhance detection efficacy.

“One of the first milestones for us is training their machine learning on WatchGuard EDR, and then offering managed Microsoft Defender in the community,” Young said. “Those are some of the early milestones for us that we expect to occur before the end of Q1.”

Young said MDR provides the security expertise and continuous monitoring that many small to mid-sized businesses can’t afford in-house while allowing MSPs struggling with retaining talent and keeping costs down to focus on core services and outsource SOC functions to WatchGuard. The convergence of endpoint detection and response with MDR reflects the need for more integrated security solutions.

“When we’re catering to the needs of the MSP, that idea of open is really important as well because some of them standardized on a stack,” Young said. “Others are looking for ways to get efficiency within their customer base, and see this as an opportunity to do that.”

Why Outsourced MDR Is a Wise Investment for CISOs

ActZero’s AI models are designed to boost SOC efficiency by automating threat detection and improving response times, which he said will reduce false positives and enable proactive threat hunting. ActZero has spent the past few years transitioning to a 100% channel-focused approach, mirroring WatchGuard’s model, while ActZero’s expertise in managing third-party solutions aligns with WatchGuard’s approach (see: WatchGuard Buys CyGlass to Bring NDR to Midmarket Customers).

“They already have trained a number of models in areas both in and outside of endpoint, and have a process down to add additional capabilities,” Young said. “They have a platform that brings in that telemetry ability to train those models and then expand. We’re really excited about the ability to leverage what they’ve already done, but also the process of expanding beyond that.”

Young said MDR services present a compelling return on investment for CISOs by addressing the need for comprehensive threat detection and response without the overhead of maintaining a SOC. MDR services eliminate the need for expensive SOC setups, ensuring CISOs can meet their security objectives while optimizing costs, while machine learning and automation drive efficiency in MDR services, he said.

“MDR is one of those areas where there’s just a very clear return for a CISO in making that build-versus-buy decision,” Young said. “Then it’s about finding that trusted partner, and then the security platform that’s powering that partner for them, and driving a decision based off of that.”

To ensure the acquisition achieves its goals, he said the company will track the integration of ActZero’s offerings into WatchGuard’s MSP ecosystem, the onboarding of clients to the enhanced MDR service, and the number of users per customer to measure service penetration. Security relevance, simplicity in operations, and alignment with channel partners remain the core pillars for future acquisitions, he said.

“We have metrics around partner onboarding, customer onboarding, and then average users per customer, and we very diligently track penetration across each of those three metrics,” Young said.