MSP 501 Vanguard Award: CyFlare and the Channel's Security Operations Center Gap

Remote work has exposed businesses cybersecurity weaknesses, according to security operations center-as-a-service (SOCaaS) provider CyFlare.

But CEO Joe Morin says those vulnerabilities existed well before 2020.

CyFlare’s Joe Morin

“There’s a lot of jargon and buzz going around about remote workforce,” Morin said. “That shines a light on protecting the endpoint and account credentials, but that was always the case.”

However, Morin said 2020 has prompted an “exodus to the cloud.” He predicted that many providers will offer new products and services that provide cloud visibility and agility, as businesses choose to retire on-premises infrastructure.

CyFlare recently earned the MSP 501 Vanguard Award, given to a company that demonstrates digital transformation thought leadership. Morin, a former employee of Barracuda Networks, Zscaler, Comodo and other security-minded vendors, said CyFlare offers the world’s first converged SOC offering.

Joe Morin and Douglas Mannella co-founded the MSSP in 2017. However, they initially intended to be a managed web application firewall provider. After struggling, they pivoted the company to more MSSP services. The company in 2018 launched its SOC in-a-box offering and recently unveiled its “One” converged security platform, which uses a single hardware appliance to enable a variety of security applications. Morin likened the platform to an “iPhone for security.”

“Basically anything that can be containerized or virtualized — we can deploy into that appliance and then manage it from the SOC. And more importantly, take telemetry and security events into the SOC,” he said.

From the SOC, Cyflare generates playbooks. Many large MSSPs provide playbooks, but Morin said CyFlare differs by extending them to the customer. Thus, the customers can customize how they want to respond to security events.

“It creates a more cohesive experience and a more predictable result when there’s a security event,” he said.

CyFlare also provides full-scale automation, in which its security operations center provides recommended actions for the customer’s incumbent security tools. The platform features more than 1,500 API actions for more than 250 products.

“It’s not just seeing stuff and telling the client what to do,” Morin said. “We can actually fix it for them programmatically. And there’s no charge for it.”

Business Model

The company prides itself on selling exclusively through the indirect channel.

“That’s what every security vendor says,” Morin said. “Most of them are not accurate.”

CyFlare, on the other hand, employs only two sales-focused people. They function as channel account managers, working to recruit and enable partners.

Morin said businesses are demanding low-cost outsourced cybersecurity providers. But channel partners are struggling to fill the gap.

“What I saw is that the value-added resellers in particular – including the MSPs – are all being tasked with furnishing security offerings. They just didn’t have the skill set,” he said.

CyFlare teams with these partners but also allies with security-focused firms. Indeed, Morin said the most common partners function as virtual chief information security officers (vCISO) to their clients. However, they do need an SOC, which CyFlare provides.

CyFlare also works with white-label partners. For example, Morin said two of the top 20 global MSSPs white-label CyFlare’s SOC. Also, a $3 billion recently began rebranding the appliance.

Morin urged partners to avoid fragmentation in their cybersecurity stacks. He said a mature posture covers more than technical controls and services, but many providers only handle one or two of those.

“Pick a partner that can take you further and do most of the things in the cybersecurity stack,” Morin said. “I think that’s key for a partner to be successful. They can’t be out there learning 18 different tools and working with 18 different vendors.”

We recently caught up with 2019 MSP 501 Vanguard winner Platte River Networks.