Cloud-based security tailored to fit MSSPs
Cisco Endpoint Security for MSSPs

Customers Need Help with Endpoint Security
Organizations lack the resources necessary to respond to advanced threats on the endpoint
Lack of
Available Budget
Over half of the security
professionals named cost
efficiency and unbiased
insight as the top reasons to
outsource security
Diverse Endpoint
Ecosystems
Mobile and flexible workforces
have introduced a diverse set of
endpoint types and increased
complexity of environment
Evasion Techniques
Advancing
Today’s threats employ advanced
evasion techniques designed
specifically to get around
preventative security tools
Lack of Available
Security Talent
(ISC)2 estimates that the number
of unfilled cybersecurity jobs will
rise to 1.8 million by 2022

Cloud-Based Endpoint Portfolio
Visibility
Gain visibility into file and Internet
activity across devices
Control
Manage and control all endpoint
devices and security policies.
Security
Prevent breaches, block malware,
and uncover stealthy attacks.

© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Increasing Demand
for Managed
Security Services
Outsourcing security enables organizations to concentrate on
what matters most
0.0%
10.0%
20.0%
30.0%
40.0%
50.0%
60.0%
70.0%
80.0%
Yes - In the last
12 months
Plan to in the
next 12 months
Have not/No
Plans
US
WE
AP
Mexico
Q: Have you engaged with a security services
provider for Cloud Managed SaaS-security?

MSSP Market Transitioning to cloud
Cloud-based security service revenue totaled $9.1B in CY16
13%Up from $8.1B in CY15
43%The market will grow
over the next 5 years to
$13.1B in CY21
7.5%CY16 to CY21 CAGR

1995 2007 2009 2013 2014 2015 2016 2017
Cisco is Investing in Security Growth

Unrivaled Global Threat Research and Intelligence
Identify advanced threats Get specific intelligence Catch stealthy threats Stay protected with updates
Endpoints
Devices
Networks
NGIPS
WWW Web
250+
Researchers
24 x 7 x 365
Operations
Security Coverage Research ResponseThreat Intelligence
1.5M
daily malware
samples
600B
daily email
messages
16B
daily web
requests
120TB
data received
daily

Portfolio Benefits/Features
Multitenancy
Add, move, and change
customers while keeping client
environments separate
Centralized Reporting
Keep customers informed
through automated,
customizable reports
API integrations
Easily integrate Cisco
solutions with your portfolio
and management systems
Easy service creation
Deploy advanced cloud-based
security solutions quickly

The Portfolio
Umbrella
Provide protection against threats on the
Internet across all devices, even when users are
off the corporate network
AMP for Endpoints
Prevent, detect, and respond to advanced
threats while continuously monitoring file
behavior to uncover stealthy attacks

AMP for Endpoints

What is Cisco AMP for Endpoints?
Prevent
Prevent attacks and block malware
in real time
Detect
Continuously monitor to
reduce time to detection
Respond
Accelerate investigations and
remediate faster and more
effectively

What is Cisco AMP for Endpoints?
Next-generation endpoint security
Cloud managed across multitenant platform
Lightweight connector
Available for Windows, Mac, Linux, iOS, and Android

MSSP AMP for Endpoints Benefits
No hardware, all cloud managed (private cloud option available)
Reuse and redeploy licenses among your customers as
business requires.
Simply deploy software solutions when and where you need them
Post-paid OPEX utility based pricing with no up-front licensing costs

Managed AMP Endpoint Customer Deployments
Customer AMP
Endpoint
ThreatGrid File Analysis
Submission and Reports
AMP Endpoint
Management Services
Provisioning Users
Connector Deployment
Management & Monitoring
Response
Ongoing Support
MSSP AMP Solutions AMP MSSP Portal
AMP Public Cloud
Customer 1 Customer 2 Customer 3
AMP MSSP
(customer)
REST API
MSSP SOC
Customer 1
Endpoints
Customer 2
Endpoint
Customer 3
Endpoints
MSSP Provides A4E Connector download link
and/or installation package to individual customers

AMP for Endpoints MSSP Console

- Rick Chapman, CTO, InterVision Systems LLC
“AMP’s multitenant, cloud-based
delivery model has made it easier than
ever to introduce enhanced security
services to our customers with no
upfront costs.”

Umbrella

Cisco Umbrella
Built into the foundation of the internet
Intelligence to see attacks before launched
Visibility and protection everywhere
Enterprise-wide deployment in minutes
Integrations to amplify existing investments
208.67.222.222
Malware
C2 Callbacks
Phishing
Cloud Security platform

Centralized settings | MSSP admins | Centralized reports
MSSP Organization
Subscription Admin &
Settings
Reports
Customer 1 Customer 20K
Subscription Admin &
Settings
Reports

Centralized settings | MSSP admins | Centralized reports | Centralized S3 Log Management
Cisco Umbrella MSSP Offer
Umbrella Intelligence
Intelligence to stop threats earlier
Your Current
Security Stack
Integrations to amplify
existing security
MSSP Threat Analysis
and Intelligence
Maintain your intellectual
property secret
IOCs

MSSP threat analysis
and intelligence
Umbrella enforcement
and visibility
Domains
Automatically push newly discovered
malicious domains via API
Logs or blocks all internet activity
destined to these domains
Isolated only used for your customers
— no inspection or leakage
Intel uncovered by your teams remains your
secret sauce
Leverage our APIs to enforce your intelligence
Protect your customers while keeping your intellectual property secret

Available Packages Professional Insights Platform
Coverage: on-network
Any network device (by external IP)
Cisco ISR4K and WLAN (by VLAN/SSID)
Umbrella Virtual Appliance (by internal IP)
Coverage: anywhere
AnyConnect roaming module (for Win/Mac)
Umbrella roaming client (for Win/Mac)
Cisco Security Connector (for iOS)
Identity
External IP, VLAN/SSID*, host name/serial*
Internal IP*
Active Directory integration*
Enforcement
DNS-layer enforcement
IP-layer enforcement*
Enforcement: intelligence proxy
Malicious URL blocking
Custom URL blocking
File inspection (AV)
File inspection (Cisco AMP)
Enforcement: integrations
Partner integrations (pre-built)
Custom integrations (enforcement API)
Visibility: inside Umbrella
Basic logging and reports
Destination and identity reports
Cloud services reports
Visibility: outside Umbrella
Reporting API MSSP-only* MSSP-only* MSSP-only*
Log management (Amazon S3)
Centralized log management (Amazon S3) MSSP-only MSSP-only MSSP-only
Threat intelligence
Investigate console Sold separately Sold separately
Investigate API Sold separately Sold separately
Management Management API In production, not yet available
Support Basic support
*Available to *MSSPs but not end customer | In the future, will be available to end customers as well
MSSP

Umbrella for MSSPs Console

What sets Umbrella apart from Competitors
Fastest
And most reliable cloud infrastructure
Most Open
Platform for integration
Most Predictive
Intelligence to stop
threats earlier
Easiest
Connect-to-cloud
deployment
Broadest
Coverage of malicious
destinations and files