Managed detection and response (MDR)
Also known as: MDR, managed detection, SOC as a service, managed security
Managed detection and response (MDR) combines security tools like EDR with a team of human analysts who monitor your environment around the clock, investigate alerts, and take action to contain threats.
It gives a small business enterprise-grade security operations without building an in-house security team.
Managed detection and response (MDR), explained at three levels
At home
A home alarm that only beeps is useful only if someone is home to hear it. A monitored alarm calls a centre staffed all night, and a person decides whether to send help. MDR is the monitored version for business computers. Security software raises alerts, and a team of analysts watches them around the clock, investigates the real ones, and steps in to stop an attack.
At work
Managed detection and response (MDR) is a subscription service that combines security tools, usually EDR, with a team of analysts who monitor alerts 24/7, investigate them, and take containment actions on your behalf. For a small business, it delivers a security operations centre without hiring one. That matters because many attacks launch at night or on weekends, when nobody in-house is watching.
At home
MDR has three layers. Sensors, usually EDR agents plus feeds from email, cloud accounts, and firewalls, collect signals. A platform correlates those signals and filters out noise. Then analysts in a security operations centre triage what remains, decide what is real, and act, for example by isolating a laptop or disabling a compromised account. You typically get an alert and a written summary of what they found and did.
At work
In a small business, MDR usually sits alongside the MSP rather than replacing it. The MSP manages devices, patches, and users, while the MDR provider, such as Huntress, Arctic Wolf, or Sophos MDR, watches for attacks. Contracts define response authority: some providers fully contain threats, others only notify. Good services include identity monitoring for Microsoft 365, since many intrusions now start with a stolen login rather than malware.
At home
What separates MDR from an alerting tool is human judgment. Analysts tune detections to your environment, hunt for attackers who evade automated rules, and spot patterns a machine misses, like a legitimate admin tool used at 3 a.m. from a new country. While MDR costs more than software alone, in my view an alert that no one reads at night is worth very little.
At work
When evaluating MDR, look at coverage (endpoint only, or also identity, email, cloud, and network), response authority, and measured times to detect and respond. Ask how detections map to MITRE ATT&CK, how often analysts hunt, and who handles full incident response beyond containment. Check that reports satisfy insurer and audit requirements. A common failure mode is an MDR service that only watches endpoints while attackers operate through stolen cloud logins.
Real-world examples
At home
Aisha's shop couldn't afford a security analyst, so her MSP added MDR. When an attacker tried to exploit a server late one night, the MDR team detected it, isolated the server, and had a summary waiting for Aisha in the morning, a threat handled while she slept.
At work
Jerome's clinic subscribed to MDR to meet both patient-privacy obligations and their cyber insurer's requirements. Over a year, the team caught two credential-based intrusions early, contained them within minutes, and provided the documented response the insurer required.
Common confusions
- EDR and MDR are the same thing — EDR is the tool; MDR is the tool plus a team that monitors and responds 24/7. EDR without someone watching it leaves alerts unaddressed.
- MDR replaces our MSP — MDR focuses on security monitoring and response; your MSP handles broader IT operations. They're complementary, and often delivered together.
- We're too small to need a security operations team — Automated attacks target businesses of every size. MDR makes round-the-clock response affordable precisely for organizations that can't hire their own analysts.
For analysts
When evaluating MDR, the key question is 'do they respond or just alert?' Look for a provider with the authority to contain threats (isolate devices, disable accounts), a defined response-time commitment, and clear reporting you can hand to insurers.
History & origin
Detection tools like EDR generate alerts, but someone must watch and act on them 24/7, a challenge for organizations without a security operations centre. MDR emerged in the late 2010s to fill this gap, packaging tools plus expert monitoring and response as a subscription. It became especially valuable for small and mid-sized businesses that face the same threats as large enterprises but can't staff a round-the-clock security team.