A/NZ Webinar: Where EDR Stops – Blocking Attacks with Mail and DNS Security
EDR and SIEM do important work. Both are now standard in a well-built MSP security stack, and both deliver real value at the kill-chain stages they’re designed for. What gets less attention is where they aren’t designed to operate.
EDR works on endpoints, after a threat has executed. That leaves two earlier kill-chain stages outside its reach: Delivery, which happens over email before any device is involved, and command-and-control callback, which runs over DNS at the network layer. SIEM aggregates and correlates these events, but it isn’t a preventive control at either stage.
Mail Assure stops threats at Delivery. DNS Filter stops them at C2. Together they complete a defence-in-depth architecture, not just supplement one.
This session walks through the coverage map, maps an attack scenario across all four controls, and lays out the commercial case for closing the gap.
Speaker
Lewis Pope
Lewis started his career in the MSP channel, spending six years as a System Administrator, Manager of Service Delivery, and IR Lead with a break/fix operation that eventually matured to a full MSP. Lewis joined N‑able in 2018 as a Sales Engineer, and in 2021 became a member of the Head Nerds team.
As a Head Nerd at N‑able, Lewis is focused on cybersecurity, helping MSPs overcome security and operational challenges by providing education, training, and advocacy for implementation of practical security controls, proper risk management, and incident response. His primary goal is helping MSPs start the cybersecurity maturation process that is needed to contend with modern risks and the evolving threat landscape, as well as finding opportunities for growth.
In his downtime, you can find him hosting gameshows at sci-fi conventions, tinkering with microcontrollers that have way too many LEDs, or reading endless threat-intelligence feeds. He’s also very proud of his daughter, but if we got into all of the reasons for that we’d be here for quite a while.