Managed detection and response (MDR)

What an MDR service actually does

Endpoint detection and response (EDR) and extended detection and response (XDR) tools are very good at spotting suspicious behaviour, but they still need someone to look at what they find. Most small and mid-sized organisations do not have a security team watching a console overnight, at weekends or over the holidays, and that is exactly when attackers prefer to work. MDR closes that gap by adding people and process to the technology.

A typical MDR service includes:

• 24/7 monitoring of alerts and telemetry from endpoints and, depending on the service, identities, Microsoft 365, cloud platforms, firewalls and email
• Triage and investigation: analysts separate genuine threats from noise and piece together what happened, from first access to the current state
• Response actions: isolating a device, killing a process, quarantining a file, disabling an account or revoking sessions, within limits you agree in advance
• Threat hunting: proactive searches for attacker activity that has not triggered an alert
• Reporting and guidance: clear incident write-ups, remediation advice and regular service reviews

The value of MDR is that someone acts, rather than forwarding alerts for you to deal with. MSSP vs MDR explains how MDR fits inside a wider managed security service, and MDR vs SOC vs SIEM separates the service from the team and the tools behind it. If you are still deciding which underlying tools you need, our endpoint security site compares EDR vs XDR vs MDR (opens in a new tab).

Response authority: the question that matters most

Before you compare features, decide what you want the MDR team to be allowed to do. Services range from "notify only" to full remediation, and most let you choose a level per type of action.

Write the rules of engagement down during onboarding: who the MDR team contacts, in what order, and which actions they can take without waiting for an answer. Identity actions deserve particular care. Disabling a director's account at 2am may be exactly right during a business email compromise, but everyone should know in advance that it can happen. We agree this with you and the vendor at setup, and it is confirmed at quote.

How to choose an MDR service

MDR services differ more than their marketing suggests. These are the questions we work through with you:

1. Coverage beyond the endpoint. Many attacks now start with a stolen Microsoft 365 session or a compromised identity rather than malware on a laptop. Check whether the service watches identities, email, SaaS, cloud and firewall logs, or only endpoints. Managed ITDR explains why the identity side matters.
2. Bring your own tools or theirs. Some services run only on the vendor's own agent; others can work with Microsoft Defender, CrowdStrike or another EDR you already own. Replacing a working agent just to buy a service is rarely the cheapest route.
3. Microsoft integration. If you already license Microsoft Defender, ask whether the service can respond in Microsoft 365 and Microsoft Entra ID, not just read alerts. MDR for Microsoft Defender covers the services built for that.
4. Communication and reporting. Ask how you will be contacted, how incidents are written up and whether reports are in plain English your board can read.
5. Data location and UK GDPR. Ask where telemetry is stored and processed and for how long, and check the data processing terms. Under UK GDPR Article 33 (opens in a new tab), a reportable personal data breach goes to the regulator (the Information Commission, still widely known as the ICO) without undue delay and, where feasible, within 72 hours of becoming aware of it, so ask how quickly the service will give you the facts you need.
6. Incident response. Find out whether full incident response for a serious breach is included, capped, or a separate engagement; our page on incident response retainers explains the difference.
7. Onboarding and tuning. A good service spends the first weeks learning what normal looks like for you, so that it raises fewer false alarms later.

Pricing is usually per endpoint or per user, sometimes with separate charges for servers, log sources or retention; MSSP pricing explains the units, and how to choose an MSSP lists the wider questions. Ask us for a quote and we will compare like for like.

The vendor MDR services we set up and manage

Every service we supply is run by the vendor's own security operations team. Because we supply several, we can suggest the one that fits the tools you already own rather than the other way round. In broad terms:

• On the vendor's own platform: Sophos MDR (Sophos's own SOC, on Sophos or supported third-party tools), CrowdStrike Falcon Complete MDR (CrowdStrike analysts deliver full-cycle remediation), ThreatDown MDR (24/7 analysts on Windows, macOS and Linux endpoints) and Todyl MXDR
• Keeping the EDR you already own: WatchGuard Open MDR works with WatchGuard Endpoint, CrowdStrike or Microsoft Defender, and WatchGuard Core MDR for Microsoft is built around Microsoft Defender; our endpoint security site sets out the WatchGuard MDR tiers (opens in a new tab)
• Platforms built for IT providers and smaller organisations: Blackpoint Cyber's CompassOne, with a 24/7 human-led SOC, MDR and ITDR for Microsoft 365 and Cisco Duo (opens in a new tab) accounts; and Guardz, whose 24/7 MDR pairs AI-driven investigation with Guardz security experts across identity, email, browser, endpoint and cloud
• Cisco estates: Cisco XDR Premier, Cisco XDR offered as a managed service by Cisco security experts; see managed XDR

For the side-by-side detail, including tiers, coverage and licensing units, see SOC as a service vendors, our comparison of the MDR services we manage. Each vendor's service description sets out exactly what it monitors and commits to, and we go through it with you before you sign.

MDR for Microsoft 365 and Defender estates

Many UK organisations already own capable Microsoft security tools through Microsoft 365 Business Premium or E5, but nobody watches them. In that case an MDR service that works on Microsoft Defender is often better value than buying a new agent. Options include WatchGuard Core MDR for Microsoft, WatchGuard Open MDR and Sophos MDR, while Blackpoint MDR's agent works alongside Defender and its SOC watches Defender alerts too; MDR for Microsoft Defender compares how each uses your Microsoft licences.

Whichever you choose, the service should cover the identity side as well as devices: risky sign-ins, mailbox rule changes, OAuth consent grants and session theft. These are the signals behind most business email compromise cases, and managed ITDR goes further into them.

MDR, managed EDR and managed XDR

The labels overlap, so it helps to know which page answers which question:

• Managed EDR: endpoint detection and response run for you, usually without the full 24/7 response of MDR
• Managed XDR: MDR whose view reaches beyond the endpoint to email, identity, network and cloud
• Managed SOC: the wider security operations service, of which MDR is the most common form
• Cyber security monitoring: what gets watched, who watches it and how alerts reach you

How Forever Systems helps

We start with what you already own, then add the service that fits. A typical engagement:

1. Review your current endpoint, identity and Microsoft 365 security, and your out-of-hours cover.
2. Shortlist two or three MDR services that fit your tools, size and response needs.
3. Agree rules of engagement, escalation contacts and response authority with you and the vendor.
4. Onboard the service and tune it, then act as your escalation point when the vendor's SOC raises an incident and review the service with you.

Good backup is the other half of incident recovery; Forever Group's cloud backup (opens in a new tab) can help. Staff awareness cuts the incidents that start with a click: see security awareness training (opens in a new tab). Scope and responsibilities are confirmed at quote.

Contact us to compare MDR services for your organisation.