MDR, short for managed detection and response, is an outsourced cybersecurity service in which an external provider monitors an organization’s environment around the clock, investigates alerts and takes response actions against confirmed threats. In infrastructure defense it supplies the people, processes and tooling of a security operations center to organizations that cannot staff one themselves.
An MDR provider typically deploys or connects to EDR agents, log sources and cloud telemetry, applies its own detection content and threat intelligence, and assigns analysts who triage, hunt and respond. The defining element is the response: unlike a service that only forwards alerts, MDR is expected to contain threats, for example by isolating a host or disabling an account, within agreed limits.
How an MDR service operates
An MDR engagement runs a continuous cycle of collection, detection, investigation, response and reporting. The provider’s platform ingests telemetry from the customer, correlates it with detection rules and threat intelligence, and routes suspicious activity to analysts who decide whether it is malicious.
| Function | What the provider does | Typical output |
|---|---|---|
| Telemetry collection | Gathers endpoint, identity, cloud and network data | Normalized event stream |
| Detection | Applies rules, behavioral analytics and intelligence | Prioritized alerts |
| Triage and investigation | Analysts confirm or dismiss alerts with context | Incident with timeline and scope |
| Threat hunting | Proactively searches for undetected activity | Findings and new detections |
| Response | Contains threats within agreed authority | Isolated hosts, disabled accounts |
| Reporting and advice | Explains incidents and recommends fixes | Incident reports, monthly reviews |
The rules of engagement agreed at onboarding define what the provider may do without asking. Many customers authorize automatic host isolation for high-confidence ransomware activity but require approval before accounts are disabled or production servers are taken offline.
Service models and key parameters
MDR offerings differ widely in scope, technology and depth of response. Comparing them requires looking beyond marketing labels at a few measurable service parameters.
| Parameter | Typical range | Why it matters |
|---|---|---|
| Coverage | Endpoints only to endpoints, identity, cloud and network | Gaps leave attack paths unmonitored |
| Technology model | Provider’s own stack or customer’s existing tools | Affects cost, lock-in and visibility |
| Time to respond | Minutes to about an hour for critical alerts | Ransomware can spread within hours |
| Response authority | Notify only, guided response, full containment | Determines who acts at night |
| Hunting frequency | Continuous to periodic campaigns | Finds threats that rules miss |
| Data retention | About 30 days to a year or more | Limits how far back investigations reach |
Service level figures should be read carefully. Time to acknowledge an alert is not the same as time to contain a threat, and some contracts measure only the former.
Pricing is usually per endpoint or per user per month, sometimes with surcharges for cloud workloads, additional log volume or incident response hours. When comparing quotes, buyers should check whether the price includes the EDR licenses, how many data sources are covered and whether remediation support after containment is part of the service or billed separately.
MDR compared with EDR, XDR, SIEM and MSSP
Neighboring Terms in infrastructure defense are often confused with MDR because they share data sources. The essential distinction is that EDR, XDR and SIEM are technologies, while MDR is a service delivered by people who use such technologies.
| Offering | What it is | Who does the analysis |
|---|---|---|
| EDR | Endpoint detection and response software | The customer’s own team |
| XDR | Detection platform spanning several data sources | The customer’s own team |
| SIEM | Central log collection and correlation | The customer’s own team |
| MSSP | Managed security services such as device and log management | Provider, often alert forwarding |
| MDR | Managed monitoring, investigation and response | Provider analysts, with active response |
Traditional MSSP contracts often focus on managing firewalls and forwarding alerts, leaving investigation to the customer. MDR shifts that work to the provider. Many providers now combine both models, so the contract terms matter more than the label.
Choosing and onboarding an MDR provider
Selecting MDR is primarily a decision about operating model and trust. The provider will have privileged access to telemetry and response tools, so its own security, staffing and transparency deserve the same scrutiny as its detection quality.
| Situation | Recommended approach | Reason |
|---|---|---|
| No security team, limited budget | Full MDR with provider-supplied EDR | Fastest route to 24/7 coverage |
| Small team, existing EDR or XDR | MDR on the existing stack | Preserves investment and visibility |
| Mature in-house SOC | Co-managed MDR for nights and overflow | Extends coverage without duplicating effort |
| Strict data residency rules | Provider with in-region analysts and storage | Meets regulatory obligations |
Onboarding typically takes several weeks: deploying agents, connecting identity and cloud logs, tuning detections to the environment, agreeing escalation contacts and testing the response playbooks. A tabletop exercise before go-live confirms that both sides know who calls whom when an incident occurs at night.
Limitations and common pitfalls
- Shared responsibility gaps: the provider can isolate a host, but patching, rebuilding and business decisions remain with the customer.
- Incomplete coverage: unmanaged devices, legacy servers and SaaS applications without log integration are invisible to the provider.
- Unreachable contacts: escalations fail when the customer’s on-call list is outdated.
- Limited environment knowledge: without asset and business context, analysts may misjudge what is normal.
- Assuming MDR equals incident response: full forensic investigation and recovery are often separate retainer services.
MDR reduces the time attackers remain undetected, but it does not replace basic security hygiene. Strong identity controls, timely patching and tested backups still determine how much damage a contained incident causes.
The idea in brief
Most businesses cannot afford a team of security experts watching their computers day and night. MDR is like hiring a professional security company for the digital premises: their staff watch the cameras, check every alarm and step in when something is really wrong.
If a burglar shows up at three in the morning, they do not just send an email; they lock the door and call you. The business still decides on repairs and improvements, but it no longer faces an attack alone.
A practical scenario
A law firm with 250 employees and a two-person IT team signs an MDR contract covering its laptops, servers, cloud email and identity provider. The provider deploys EDR agents and connects sign-in logs, and the firm authorizes automatic isolation of any device showing ransomware behavior.
On a Saturday night, an analyst sees a sign-in from an unusual country followed by a mailbox forwarding rule and suspicious PowerShell activity on a partner’s laptop. Within about twenty minutes the provider isolates the laptop, revokes the account’s sessions and calls the IT manager. The investigation traces the intrusion to a phishing email, the firm resets credentials and enforces phishing-resistant MFA, and no client data leaves the network.