What is a threat research team?
A threat research team is a group of cybersecurity experts dedicated to proactively seeking out potential risks and delivering related insights to their broader security team to take action on.
This team has the dual role of threat hunting and threat intelligence, to make their proactive cybersecurity approach more effective. They not only keep specific threats and trends on their organization’s radar, but also provide forward-thinking approaches and research to help fortify the team’s defense.
Threat research teams vary in size and scope depending on the type of organization they serve. Some teams work in-house, while others act as an outsourced team of experts, and a third-type provide research and intelligence to multiple organizations, like an information sharing and analysis community (ISAC) or organization (ISAO).
How threat research teams help managed service providers (MSPs)
Since MSPs offer organizations a way to outsource their IT and cybersecurity needs, providing the expertise of a threat research team through the MSP can be a great value-add for clients.
Too often in recent years, MSPs have taken a trial-and-error approach to cybersecurity. To bring the most value to their customers, MSPs must take a proactive and holistic view of their security offerings. Creating, or working with, a threat research team can allow the MSP to stay ahead of upcoming cybersecurity challenges while also providing cutting-edge counsel to their customers.
The threat research team keeps the MSP, and the customers they are serving, ahead of the curve on ransomware and other common cybersecurity threats, like vulnerabilities. Beyond serving customers, these proactive approaches also serve to protect the MSP’s own cybersecurity posture.
The 2021 Perch MSP Threat Report found that MSPs are vulnerable targets for cyberthreats. The aid of a threat research team helps the MSP focus on everyday security needs while also taking a forward-thinking posture.
The Connectwise Cyber Research Unit (CRU) aids threat hunting and threat intelligence
ConnectWise introduced the CRU to offer a threat-protection focused platform to MSPs and technology service providers (TSPs.) Like a threat research team, the CRU specializes in threat hunting and threat intelligence. This team is composed of security operations and threat research experts, brought together to offer MSPs and TSPs the research and proactive approaches they need to mature their cybersecurity offerings.
The CRU produces threat reports, a daily-updated threat feed and more to spread the knowledge they gain through their research into automated and manual malware analysis, the monitoring of ransom leak sites and malicious botnets. As a result of this threat hunting, the CRU can provide threat research teams with new indicators of compromise (IOCs) that were previously inaccessible.