Managed detection and response (MDR) is an outsourced security service in which a provider’s analysts monitor a customer’s environment around the clock, hunt for threats and respond to attacks.
How MDR works
An MDR provider deploys or connects to detection technology at the customer – usually EDR agents on endpoints, often complemented by network, cloud and identity telemetry or a full XDR platform. The provider’s analysts then:
- triage alerts 24/7 and filter out false positives;
- investigate suspicious activity and perform proactive threat hunting;
- take response actions such as isolating a host, killing a process or disabling a compromised account;
- report findings and give remediation advice.
The key difference from a classic managed security service provider (MSSP) is the response part: an MSSP typically forwards alerts, while an MDR team actively investigates and contains threats.
Why MDR matters
Building an in-house security operations center requires round-the-clock staffing, experienced analysts and expensive tools – out of reach for many mid-sized organisations. Ransomware operators deliberately attack at night, at weekends and on holidays, when nobody watches the consoles; an intrusion that goes from initial access to encryption within hours leaves no time to wait until Monday. MDR gives such companies continuous monitoring and expert response at a predictable cost.
How to choose an MDR service
- Clarify which response actions the provider may take without asking.
- Check coverage: endpoints only, or also cloud, email and identity.
- Ask about response time commitments and how incidents are escalated.
- Make sure the service fits into your own incident response plan and that you keep access to the collected data.
