What is managed detection and response? Managed detection and response, or MDR, is a security service in which an outside team watches your environment around the clock, investigates suspicious activity and takes action to contain real threats. You are buying people and process on top of security technology, not just another tool that produces alerts.
The "managed" part is the point. Most organizations can buy detection tools. Far fewer can staff a team that reads the alerts at 3 a.m., decides which ones are real and acts. MDR fills that gap.
This guide explains what MDR includes, how it works, how it differs from EDR, XDR, a security operations center and a full managed security service, what to ask before you buy, and what MDR does not do.
What does an MDR service include?
Services vary by provider, but a typical MDR offer includes:
- 24/7 monitoring. Telemetry from endpoints, and often networks, identities and cloud services, is watched continuously.
- Threat detection. Analytics and rules flag behavior that looks hostile.
- Investigation. Analysts look at each alert, add context and decide whether it is a real incident.
- Response. The provider takes or guides action: isolating a device, disabling an account, blocking a process.
- Threat hunting. Analysts search for signs of attackers that automated rules missed.
- Reporting and advice. Regular summaries of incidents, trends and recommendations.
How does MDR work?
- Connect. The provider deploys agents or connects to your existing security tools to receive data.
- Baseline. It learns what normal looks like in your environment.
- Detect. Software surfaces suspicious events.
- Triage. Analysts sort real threats from noise, so you do not receive every raw alert.
- Respond. Containment steps are carried out within agreed limits.
- Report and improve. Findings feed back into tuning, advice and your own security plan.
The agreed limits in step five are important. Some providers act on their own within pre-approved boundaries. Others recommend and wait for you to approve. You should know which before an incident, not during one.
How is MDR different from EDR, XDR, SIEM and a SOC?
| Term | What it is | Who operates it |
|---|---|---|
| EDR | Endpoint detection and response: software on laptops and servers that records activity and can contain threats | You, or a provider |
| XDR | Extended detection and response: detection across endpoints, email, identity, network and cloud in one platform | You, or a provider |
| SIEM | Security information and event management: a system that collects and correlates logs | You, or a provider |
| SOC | Security operations center: the team and process that watch and respond | In-house, or outsourced as a managed SOC |
| MDR | A managed service that combines technology with a team that detects and responds | An outside provider |
In short, EDR, XDR and SIEM are technology. A SOC is a team. MDR is a service that delivers both. If you want to compare providers of the team side, see our page on managed SOC providers.
How is MDR different from an MSSP?
A managed security service provider, or MSSP, delivers a wider range of security services, which can include firewall management, vulnerability scanning, compliance reporting and log management. MDR is more focused on detecting and stopping active threats. Many MSSPs now include MDR as one of their offers, and some MDR specialists do not do the wider work.
If you are unsure which you need, our guide to MSP vs MSSP sets out the difference between general IT and security providers, and our managed security service provider list shows who offers what.
Who needs MDR?
MDR tends to suit organizations that:
- Have valuable data or face regulatory pressure.
- Cannot staff a security team that works every hour of every day.
- Already run endpoint protection and want someone to act on what it finds.
- Rely on an MSP for IT and need a specialist for security.
- Have been told by an insurer or customer to show active monitoring.
Very small businesses with little data and simple systems may be better served by solid basic protection, backups and training first.
What should you ask an MDR provider?
- What can you do without asking me? Find out which response actions are automatic.
- Which tools do you use? Do they bring their own, or work with what you already own?
- When are analysts on duty? "24/7" should mean people, not only software.
- How fast do you respond? Ask for written targets for detection, investigation and containment.
- How is onboarding handled? Ask how long it takes and what you must do.
- What do reports look like? Ask for a sample.
- Who owns the data? Make sure you can take your logs and history with you.
- What happens when we leave? Read the exit terms.
What does MDR not do?
- It does not replace basics. Patching, backups, access control and training still matter.
- It does not see what is not connected. Coverage depends on which systems send data.
- It does not guarantee no incidents. It reduces the time attackers stay in place.
- It does not own your decisions. You still decide risk appetite and who approves action.
How do MSPs and MSSPs offer MDR?
Many MSPs do not build their own security operations center. They partner with an MDR vendor and resell the service under their own brand, adding their local knowledge and first-line support. This is one reason MDR vendors invest in partner programs, and why a verified list of providers is useful for them. Our database covers about 50,000 MSSPs alongside roughly 100,000 MSPs.
Related reading
- what is a managed security service provider: the wider security service MDR often sits inside.
- compliance, governance and risk management explained: the compliance side of security.
- what is a managed service provider: the IT provider model that MDR is often added to.
Where to go next
MDR gives you a team that watches, investigates and responds, so detection tools turn into action. If you are choosing a provider, start with our guide to shortlisting an MSSP. If you sell security services or tools to providers, request a free 100-record sample of verified MSSP contacts.
ChatGPT
Claude
Google AI Mode