Home / Knowledge hub / MDR
Knowledge hub
MDR
An outside service that monitors your systems and responds to threats for you.
What it means
MDR stands for managed detection and response. It is a service where an outside team monitors your systems, usually through endpoint and cloud tools, investigates alerts, and takes or guides action when it finds a real threat. You buy the outcome rather than the software alone.
It sits between buying a tool and building your own security operations centre. The provider supplies the analysts, the round-the-clock cover and the playbooks. You supply access, context about your business, and a decision on what they may do without asking.
Why it matters
For a company too small to staff night shifts, MDR is often the realistic way to get someone watching at 3 a.m. It also tends to cost less than hiring a team, and it gives you a named party to point to when a customer or insurer asks who is monitoring.
The value depends on what the contract promises. Some services only alert. Others isolate a laptop or disable an account straight away. Response time, the actions they may take, and what they report back are the terms to read closely.
How it shows up
Typically you install agents on endpoints and connect cloud and identity logs. The provider's analysts review alerts, contact you on real ones, and may contain the threat. Ask what data sources they cover, whether they can act without calling you, how fast they commit to respond, and how you get the records after an incident.
Be clear on the limits. MDR watches for attacker activity in the systems it can see. It does not review your code, and it will not notice a broken access check in your application that returns another customer's data to a normal-looking request. That is found by testing. See also MSSP and EDR.
Questions people ask
MDR, answered
What is the difference between MDR and an MSSP?
An MSSP is the broader category of outsourced security services, often including device management and compliance. MDR focuses on detection and active response.
The line between them is blurry, so read the actual service description.
Is MDR the same as EDR?
No. EDR is the software on endpoints. MDR is a service, often built on EDR, with people who watch it and respond to what it finds.
You can buy EDR without MDR, but then you need your own analysts.
Does MDR replace penetration testing?
No. MDR looks for attackers acting now. A penetration test looks for weaknesses before anyone exploits them, and finds flaws that monitoring cannot see.
They answer different questions, and most companies need both.
What should we ask an MDR provider?
What they monitor, what actions they can take without approval, their response times in writing, how they report, and how you can leave with your data.
Ask to see a sample incident report.
Will MDR catch application-level attacks?
Only where the application's logs or the endpoint reveal them. Many logic flaws look like normal use, so no alert fires.
Ask what application signals the service can ingest and review.
Related
Terms that sit next to this one
Security operations centre
A team and room that watch for and respond to threats around the clock.
MSSP
A provider that runs security services, such as monitoring or testing, for other businesses.
EDR
Software on laptops and servers that records activity and spots attacks.
SIEM
A system that gathers logs from everywhere and raises alerts on suspicious patterns.
Incident response
The agreed plan for the hours after something has gone wrong.
What does monitoring not see?
Monitoring watches for attackers. Testing finds the flaws they would use. We find vulnerabilities in your web apps and APIs and prove each with the request and the response. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.