Mandiant cozying as much as each Microsoft and SentinelOne, apparently

It was an attention-grabbing juxtaposition of reports objects at present for incident response powerhouse Mandiant.

On the one hand, Bloomberg reported that Mandiant is in discussions with Microsoft, doubtlessly resulting in a tie-up of the 2 corporations. Microsoft buying Mandiant would plug a serious hole within the tech big’s portfolio of safety choices with the addition of incident response (IR) companies. Whereas Microsoft is a critical participant in most main safety segments at this level, the corporate is notably absent, as an example, from Gartner’s latest Market Information for Digital Forensics and Incident Response Companies. So the reported Microsoft-Mandiant talks, coming only a few months after Mandiant re-gained its independence from FireEye, make a lot of sense.

Then there’s the second information merchandise from at present about Mandiant—this one primarily based on an announcement by the corporate. Mandiant disclosed a brand new partnership with cyber agency SentinelOne, a key a part of which includes Mandiant utilizing SentinelOne’s Singularity XDR platform as a part of its IR work.

SentinelOne is, amongst different issues, a fast-growing challenger to Microsoft and its safety enterprise aspirations. Whereas not as vocal as fellow Microsoft rival CrowdStrike, SentinelOne has nonetheless made efforts to tout benefits for its know-how in comparison with Microsoft.

“Whereas Microsoft Defender for Endpoint might present ‘Superior Menace Safety’ for Home windows 10+ endpoints, they lag severely behind in options and protection for macOS, Linux, and earlier Home windows variations,” SentinelOne says on its web site, on a web page devoted to evaluating Microsoft vs SentinelOne. “SentinelOne is healthier geared up for the distinctive wants of each group with assist for contemporary and legacy working methods and have parity throughout Home windows, macOS, and Linux.”

And whereas SentinelOne remains to be establishing itself and simply went public final yr, it has loads of momentum: As of its most not too long ago reported quarter, annual recurring income had surged 131%, yr over yr, to $237 million.

Thus, the juxtaposition: Mandiant is reportedly in talks with Microsoft about an acquisition, and Mandiant is concurrently launching a relationship with a rising Microsoft competitor.

Mandiant increasing its horizons

CRN provides some insights into what Mandiant is as much as on the SentinelOne aspect of issues. Plain and easy, Mandiant must assist extra endpoint detection and response (EDR) platforms than simply Trellix (previously FireEye) and Microsoft, Mandiant chief know-how officer Marshall Heilman informed the location.

And SentinelOne is a pure selection for Mandiant to go along with, for a variety of causes. SentinelOne not solely provides superior analytics for IR—derived partly from the corporate’s acquisition of Scalyr final yr—however SentinelOne additionally doesn’t itself compete with IR companies suppliers, stated Nicholas Warner, chief working officer on the firm, in a latest interview with me.

“We made a strategic determination a number of years in the past to completely concentrate on being an answer and know-how supplier, not a companies agency,” Warner informed me.

So each of those developments—Mandiant partnering with SentinelOne, and Mandiant doubtlessly an acquisition by Microsoft—make all kinds of sense, individually.

However do they make sense when put collectively? Does Mandiant leveraging SentinelOne’s know-how for its IR work make the corporate much more interesting to Microsoft—since now Mandiant is extra diversified and has entry to a few of the most cutting-edge analytics on the market for IR?

Or, does Mandiant working with a Microsoft rival like SentinelOne truly counsel that perhaps getting on Microsoft’s good aspect isn’t the highest precedence proper now?

I don’t know. However these are attention-grabbing questions.

Microsoft’s technique

Now, I’m additionally nicely conscious that tech corporations are liable to companion with one another on one aspect, and compete on one other aspect.

So it’s completely attainable that Mandiant would cozy as much as SentinelOne and discover a tie-up with Microsoft on the identical time. The end result right here may all rely, I suppose, on what kind of IR companies enterprise Microsoft would like to personal—one which retains the concentrate on the Microsoft safety ecosystem, or one that’s keen to go broader.

To know the reply to that, you’d need to know what Microsoft’s technique is right here. And provided that Microsoft isn’t saying something proper now about what it’s reportedly as much as with Mandiant, we’ll have to attend and see on that.

However, for Microsoft’s functions, at the least Mandiant to date isn’t utilizing CrowdStrike.