Managed detection and response (MDR) is a service in which an outside team monitors your security telemetry, investigates alerts and helps contain threats, often around the clock. There is no single standard scope. Before you buy, pin down what they watch, what they may do without asking, and how they hand back to you.
What problem does MDR solve?
Detection is a staffing problem as much as a tooling problem. Alerts arrive at night and on weekends. A small team cannot cover every shift or keep deep skills in every area. MDR rents that coverage.
NIST SP 800-61 Rev. 3 aligns incident response with the NIST Cybersecurity Framework 2.0 and its functions, including Detect, Respond and Recover. A useful way to read an MDR offer is to map it against those functions and see which parts the provider owns and which stay with you.
What varies between offers?
Telemetry. Some providers use only their own endpoint agent. Others ingest identity, cloud, email and network logs. Wider coverage finds more, and needs more integration.
Authority. Can the provider isolate a host, disable an account or block a domain on its own judgment, or does it only notify you? Both are legitimate. The mistake is not knowing which you bought.
Depth. Is the output a ticket that says "suspicious activity", or an investigation with scope, timeline and recommended steps?
Hours and response times. Look for how time is measured: to first alert, to analyst acknowledgement, to containment. These are very different numbers.
Handover. At the end of an incident, who does the recovery, the root cause work and the report?
A constructed example
A 150 person company buys MDR covering endpoints only. An attacker phishes an employee for a cloud console login and uses it to create access keys. Endpoints show nothing. The provider never sees the activity because cloud audit logs were not in scope. The service did what the contract said, and the gap sat in the scope, not the people.
What stays with you regardless?
- Asset inventory: they can only cover what they know about.
- Patching and configuration.
- Business decisions about taking a system offline.
- Legal, regulatory and customer notifications.
- Evidence of governance, since outsourcing monitoring does not outsource accountability.
How do you judge the service after it starts?
Look at what was found, not just what was promised. Ask for a monthly review that lists incidents, the time from detection to containment, alerts that turned out to be false and any gaps the provider noticed in your coverage. A provider that never reports a coverage gap is probably not looking.
Hold a joint exercise early. Simulate a plausible incident, see who is called and how quickly, and fix the handoff problems while the stakes are low.
How to check or apply this
- List your data sources and ask which the provider will ingest on day one.
- Write a short authority matrix: for each action, who may take it and who must be told.
- Ask for a sample investigation report and a sample escalation.
- Agree on response time definitions in the contract.
- Set contact paths for out of hours, and test them with a drill.
- Confirm how you get your data and detection content back if you leave.
- Run a purple team style exercise once a year to confirm they catch what you expect.
Quick check
Is MDR the same as a managed SOC?
The terms overlap. MDR usually stresses active response as well as monitoring. Compare actual scope in each contract, not labels.
Can MDR respond without my approval?
Only if you grant it. Many contracts split actions into pre approved ones, such as isolating one laptop, and ones needing your sign off.
Sources
- NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management
- NIST Cybersecurity Framework 2.0
Last reviewed: 18 October 2026.
