In short
Managed XDR (MXDR) is managed detection and response delivered across several data sources at once: endpoints, email, identities, network and cloud. A vendor's 24/7 security operations centre investigates correlated alerts and contains confirmed threats. Forever Systems supplies MXDR services from Todyl, Check Point, Cisco, WatchGuard and Sophos, then sets them up, manages them and handles escalation.
Get a quote for managed XDR
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What MXDR means
MXDR stands for managed extended detection and response. It joins two ideas:
- XDR (extended detection and response) is technology. It collects telemetry from several security tools, such as endpoint agents, email security, identity providers, firewalls and cloud services, correlates it and groups related alerts into one incident.
- Managed means a team of analysts works that platform for you, around the clock: triaging incidents, investigating what happened and taking response actions within limits you agree.
In other words, MXDR is managed detection and response whose view reaches beyond the endpoint. A suspicious Microsoft 365 sign-in, a new inbox forwarding rule, a laptop running an unusual PowerShell command and a burst of traffic through the firewall can be seen as one attack rather than four unrelated alerts in four consoles.
If the acronyms are new, our sister site explains EDR vs XDR vs MDR, and MDR vs SOC vs SIEM sets out how a managed service differs from the tools and the team behind it.
MXDR vs MDR
The two terms overlap and vendors use them loosely, so it helps to look at what is actually monitored rather than the label.
| Endpoint-focused MDR | Managed XDR (MXDR) | |
|---|---|---|
| Main data source | Endpoint agents (EDR) on laptops, desktops and servers | Endpoints plus email, identity, network, firewall and cloud services |
| What analysts can see | Processes, files and connections on each device | The whole attack path: phishing email, account sign-in, device activity, network movement |
| Typical response actions | Isolate a device, stop processes, remove malware | Device actions plus disabling accounts, revoking sessions, blocking addresses at the firewall, removing emails |
| Best fit | Organisations whose main risk is on devices | Organisations running Microsoft 365, cloud services and remote users, where identity and email attacks matter as much as malware |
In practice many MDR services now take identity and Microsoft 365 data too, so the line keeps moving. The useful question when comparing services is: which of my tools will the analysts actually see, and what are they allowed to do about it? We answer that for each option before you choose.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
MXDR services we supply
Forever Systems does not run its own security operations centre. The 24/7 analysts in each service below work for the vendor; we choose the right one with you, deploy it, connect your data sources and act as your escalation point.
| Vendor service | What it covers | Read more |
|---|---|---|
| Todyl MXDR | Todyl's analysts monitor Todyl SIEM, endpoint and SASE data, including identity threats such as account takeover in Microsoft 365; licensed per device | Todyl MXDR licensing |
| Check Point MDR, MDR 360 and MXDR 360 | Check Point analysts cover endpoint, email, network, cloud and identity with incident response included; MXDR 360 adds a fully managed SIEM and security data lake within a co-managed SOC framework | Check Point MDR |
| Cisco XDR Premier | Cisco XDR Advantage delivered as a Cisco-managed service, with Talos Incident Response and a technical security assessment | Cisco XDR |
| WatchGuard Total MDR | WatchGuard's SOC watches WatchGuard endpoints plus Fireboxes, NDR, AuthPoint, FireCloud, Microsoft 365 and cloud services | WatchGuard MDR licensing |
| Sophos MDR with integrations | Sophos analysts work across Sophos products and supported third-party firewalls, identity, email and cloud tools, with ITDR and NDR as add-ons | Sophos MDR |
Each vendor publishes its own service description, and those documents, not our summary, set out exactly what is monitored and what the analysts may do. We go through the relevant description with you before you sign.
Cisco managed XDR
Cisco offers Cisco XDR in three editions. Essentials brings together telemetry from the Cisco security portfolio; Advantage adds curated third-party integrations, such as Microsoft Defender and CrowdStrike; and Premier delivers Advantage as a Cisco-managed service, with Talos Incident Response and a technical security assessment included. Cisco also packages its managed XDR service, Talos Incident Response and a technical security assessment in the Breach Protection Suite Premier tier.
That makes Cisco XDR Premier a natural fit if you already run Cisco firewalls, Secure Endpoint, Secure Email or Duo, because the managed service can draw on the network and identity data you own. We can bring the XDR service together with the Cisco security and networking you already run. Our Cisco XDR page on ciscosecure.co.uk covers the platform in depth.
Is managed XDR the right fit for you?
We will check it against your systems and requirements and recommend the right option.
What Forever Systems does
A managed XDR service is only as good as the data it receives. The common reasons a service underperforms are practical: integrations left switched off, agents missing from some devices, firewall logs not forwarded, or escalation contacts who have moved on. That is the work we take on.
- Scope: we list your tools (endpoint, Microsoft 365, email security, identity, firewalls, cloud) and check which ones each candidate service can take data from.
- Recommend: we shortlist services that fit what you own, rather than asking you to replace working tools.
- Deploy and connect: we install agents, connect integrations and confirm data is flowing before go-live.
- Agree response authority: with you and the vendor, we set what analysts may do without asking, such as isolating a laptop or disabling an account, and what needs your approval.
- Escalate and review: we act as your escalation point when the vendor's SOC raises an incident, help with remediation, and review the service with you at agreed intervals.
The responsibilities split is written down and confirmed at quote. Where you want your own IT team to stay closely involved, see co-managed SOC.
Choosing an MXDR service
There is no single best MXDR service; the right one depends largely on what you already own.
- Mostly Cisco network and security: Cisco XDR Premier can use the telemetry you already have.
- Check Point email, endpoint or firewalls, or a mixed estate: Check Point MDR and its 360 packages integrate with third-party tools as well as Check Point's own.
- WatchGuard Fireboxes and endpoint: WatchGuard Total MDR watches the wider WatchGuard stack.
- Smaller organisations wanting one agent for network, endpoint and SIEM: Todyl's platform with MXDR.
- Sophos endpoint or firewall already in place: Sophos MDR with the integrations and add-ons you need.
Data residency, log retention, the response modes on offer and whether incident response is included all vary. Our guide on how to choose an MSSP lists the questions to ask, and MSSP pricing explains what drives the cost. If you are weighing a fuller managed SOC, see managed SOC services. For pricing, ask us for a quote and contact us.
How Forever Systems helps with managed security
We do not run our own security operations centre. The round-the-clock monitoring, investigation and response come from managed detection and response services that established security vendors already run at scale. Our part is choosing the right one for you, setting it up properly and staying involved.
- Independent recommendation: we supply several vendor MDR, XDR and SIEM services, including Sophos MDR, Check Point MDR and Cisco XDR, so we can suggest the one that fits the tools you already own
- Setup and onboarding: we can deploy agents, connect integrations such as Microsoft 365 and work with the vendor through tuning
- Clear responsibilities: escalation contacts, response permissions and who does what are agreed with you in writing and confirmed at quote
- Ongoing management: we help with policy changes, exclusions, renewals and regular service reviews
- Wider security too: security awareness training, Cyber Essentials and cloud security advice
We work with businesses, schools, charities and public sector organisations across the UK.
Frequently asked questions
What is managed XDR?
Managed XDR (MXDR) is a service in which a security operations team monitors and responds to threats using an extended detection and response platform. It covers several data sources, typically endpoints, email, identities, network and cloud, rather than endpoints alone.
What does MXDR mean?
MXDR stands for managed extended detection and response. XDR is the technology that correlates alerts from several security tools; the managed part is the team of analysts who investigate and respond to what it finds, usually 24/7.
What is the difference between MXDR and MDR?
MDR traditionally focuses on endpoints. MXDR extends the same managed service to email, identity, network and cloud data so analysts can follow an attack across systems. Many MDR services now take some of these sources, so check exactly what each one monitors.
Does Cisco offer managed XDR?
Yes. Cisco XDR Premier is Cisco XDR Advantage delivered as a Cisco-managed service, with Talos Incident Response and a technical security assessment. The Breach Protection Suite Premier tier also includes Cisco's managed XDR service.
Do I have to replace my security tools to get MXDR?
Not necessarily. Several services integrate with third-party tools, for example Check Point MDR, Sophos MDR and WatchGuard Open MDR. We check which of your existing tools each service supports before recommending one.
Still have a question about managed XDR?
Ask us and a member of our team will reply by email.