McAfee kicked off its annual Mpower Cybersecurity Summit today with a new analytics tool and approach called “unified cloud edge” that aim to bridge the vendor’s legacy endpoint security business with its newer cloud portfolio.

Mvision Insights is significant because “it takes all the threat telemetry we’ve been collecting across our consumer devices, our enterprise threat detection devices, our web gateways, and our CASB [cloud access security broker] product” and turns this data into information that organizations can use to improve their security posture, said Ash Kulkarni, McAfee’s chief product officer for enterprise.

McAfee’s global network allows it to collect data on threats from more than 1 billion sensors. The vendor launched its Mvision cloud portfolio at the end of last year, and it’s its new security analytics product announced today makes use of all this data.

But it’s also significant because McAfee, along with competitor Symantec, has had a tough time making the transition from a consumer endpoint business to an enterprise security powerhouse. This new product seems to provide the technology — and a story — to connect the two.

Symantec wasn’t able to make that transition. In August, Broadcom paid $10.7 billion and acquired Symantec’s enterprise security business and its name.

IDC analyst Frank Dickson, program vice president for cybersecurity products research, said he believes the McAfee security story will have a different ending. “I don’t think the story has been written yet, but I do think they are in the fight,” he said, adding that traditional endpoint vendors, network security companies like Cisco, Palo Alto Networks, and Fortinet, and even the cloud giants are moving toward a more integrated approach to security. “So we’re no longer talking about security as silos, we’re talking about security holistically. I’m not sure who is going to win yet because there are some really powerful enemies they’ve got in the fight.”

McAfee’s new Mvision Insights product is essentially a next-gen endpoint detection and response (EDR) tool, Dickson said. “Fundamentally, it’s a security analytics tool, and that’s where everyone is going. Endpoint protection has gotten really good, and what that functionality now needs to do is defend against the things that are really, really hard to find, be able to pull that information together, and not only find it, but find it quickly. The metric of the day is time.”

The security sector is notoriously short staffed, which makes security professionals expensive and in high demand. Mvision Insights aims to shorten the time it takes to identify, prioritize, and respond to targeted attacks, Kulkarni said.

It tracks attacks globally, across endpoint, network, and cloud. It automatically correlates local and global threat intelligence by geography and industry to find attacks that are most likely to target a particular organization, according to the company.

Insights also prioritizes risk by rating both the actual and potential impact of the threat by assessing a company’s existing protection capabilities. And it can proactively defend against attacks by enabling actions such as isolating systems and remediating with new policy configurations. It also sends insights directly to Mvision EDR, the company’s endpoint detection and response product.

“Pulling all this together is really valuable to customers and gives them that view into what they need to do next,” Kulkarni said.

In the future, McAfee plans to add a capability to Insights to allow it to pull in data from third-party vendors and other threat information sources. “We strongly believe that security is not a one-person sport,” Kulkarni said. "We have to enlist the help of our customers, our partners, and even our competitors to provide the right kind of defenses against our adversaries.”

Also today at Mvision, McAfee announced new capabilities across its Mvision cloud-based product line.

This includes new features to its Mvision Cloud platform, which provides data protection and threat prevention across software-as-a-service, infrastructure-as-a-service, and platform-as-a-service environments.

It added a new gateway anti-malware engine that detects zero-day attacks in milliseconds instead of minutes or hours. It also has a feature that provides a peer-compared assessment of the maturity of an organization’s cloud security posture and makes recommendations about how to improve it and reduce risk. And a new end-user remediation capability allows organizations to involve end users in the incident remediation process by providing business justification or marking false-positives. Incidents can be auto-resolved based on end-user input, which reduces the workload for security analysts.

The vendor also added native encryption management to its Mvision ePolicy Orchestrator and expanded this cloud service to data centers in Sydney, Singapore and Frankfurt.

Additionally, McAfee noted that its endpoint products received the FedRAMP In Process designation under the Federal Risk and Authorization Management Program (FedRAMP) for a cloud-based technology platform. This moves these products one step closer to securing FedRAMP authorization at the moderate level.

And finally, McAfee said it’s converging its CASB, cloud security, web gateway, and data loss prevention products and making them all available through the Mvision ePolicy Orchestrator (ePO) platform. “We’re calling this approach unified cloud edge,” Kulkarni said. It aims to reduce complexity and make it easier for companies to move to the cloud by unifying policies, incident management, investigations, workflows, and reporting for cloud, network, and endpoint data protection.

This unified cloud edge approach also reflects the company’s moves to a more holistic approach to security.

Dickson said McAfee’s “strategic consistency” in this regard will pay off. “They consistently deliver on that message of a world without a firewall. They are looking to protect endpoints and data wherever it exists in a unified fashion, and making it easy for people,” he said. “That’s what the McAfee manifest destiny is. It’s how do I protect data, applications, and endpoints in a world without a firewall.”