Managed detection and response, or MDR, is a service where an outside team monitors your security data, investigates alerts and helps respond to incidents. There is no single standard definition, so the contract matters more than the label. Agree what is watched, what the provider may do without asking and what you must still do yourself.
What does an MDR service usually include?
Offerings differ, but most combine four pieces: a feed of telemetry from your endpoints, identity systems, cloud accounts or network; analysts who triage alerts around the clock; investigation of confirmed threats; and some form of response, from advice to isolating a machine.
The reason companies buy it is staffing. Round the clock monitoring needs several trained people, and small security teams cannot cover nights and weekends.
No standards body defines MDR the way NIST defines, say, a firewall, so terms such as "response" are stretched. One provider's response is a ticket with recommendations. Another's is a remote action that contains a laptop within minutes. Compare those carefully.
How does it relate to incident response?
NIST SP 800-61 Revision 3, released in April 2025, helps organizations build incident response recommendations into their cybersecurity risk management. It is written as a profile of the NIST Cybersecurity Framework 2.0. Its framing is useful to buyers: incident response is not one team's job during an emergency, it is a capability that includes preparing, detecting, responding and recovering. An MDR provider can perform part of that capability. It cannot own all of it, because only you know your business priorities, your legal duties and which systems are critical.
What should you decide before signing?
Scope of visibility. Which data sources does the provider ingest? A service that sees endpoints but not your cloud accounts or identity provider will miss attacks that use stolen logins.
Response authority. Can the provider disable an account or isolate a device without a phone call? Faster is safer in an attack, but a wrong action can stop a business process. Write down which actions are pre approved, for which assets and at what hours.
Time commitments. Ask for numbers on how quickly alerts are triaged and escalated, and how you are notified.
Reporting. Ask what you receive: investigation notes, evidence, monthly summaries, and how you can query raw data yourself.
Data handling. Where does your telemetry go, who can access it and how long is it kept? Check this against your own legal and contractual duties.
Exit. If you leave, do you keep your data and detections?
Constructed example: the Saturday night login
A mid sized firm has an MDR service watching endpoints and its identity provider. At 02:00 on Saturday, an admin account signs in from a new country and creates a mailbox forwarding rule. The provider's analyst confirms it is suspicious within minutes. The contract says the provider may disable accounts flagged as high confidence, so it does, then calls the on call contact. The same event in a service with advice only response would have waited for a human on the firm's side to wake up and act. The scenario is invented, but it shows why response authority is a contract term, not a detail.
What does MDR not replace?
It does not patch your systems, fix weak passwords or remove excess permissions. It is detection and response, so prevention remains yours. For software teams, the preventive side includes catching vulnerable or malicious dependencies before release, which is the work of tools such as Safeguard's dependency scanning, not of a monitoring service.
How to check or apply this
- List what you need monitored: endpoints, identity, cloud, email, network.
- Ask each provider which of those it ingests today, and from which products.
- Write a response matrix: which actions the provider may take alone, which need approval, and who approves.
- Request time commitments for triage and escalation in the contract.
- Run a tabletop exercise with the provider before you rely on it.
- Review the reports monthly and ask what the provider found that your own tools missed.
- Confirm data ownership and exit terms.
Quick check
Does MDR mean I no longer need a security team?
No. Someone inside must set priorities, approve actions, fix the root causes and own prevention. MDR covers monitoring and part of response.
What is the single most important contract term?
Response authority. It sets what the provider may do on its own at 2 a.m., and that decides how quickly a threat is contained.
Sources
Last reviewed: 18 October 2026.
