Somewhere between owning EDR and being actually defended sits an unglamorous requirement: qualified humans watching the alerts, all 168 hours a week — because the decisive moments are scheduled for your empty ones. No small business can staff that (three shifts of analysts is an enterprise payroll), so the market built the shared version: managed detection and response — a security operations center (SOC) watching many clients at once, sold as a service. It’s become the insurer-expected baseline and, frankly, the most consequential security purchase most SMBs make. It’s also a label worn by wildly different offerings. Here’s what the real thing includes, and how to buy it.

What the service actually does, hour by hour

A working MDR delivers four verbs. Triage: your EDR (and often identity and email signals) streams alerts to the SOC, where analysts separate the noise — most alerts — from the leads; this filtering alone is worth the fee, because alert fatigue is what kills self-watched consoles. Investigation: the leads get worked — telemetry pulled, the behavioral chain read, the “real or false?” call made by someone who reads these chains hundreds of times a month. That reps-per-month number is the actual product: pattern recognition your environment alone could never train. Containment: confirmed threats get acted on immediately per an agreed playbook — machines isolated, sessions killed, accounts disabled — with the authority boundaries decided in advance (what the SOC does autonomously versus what wakes your people). Escalation and reporting: you get a human notification with the story attached, feeding your incident process, plus the monthly reporting that turns invisible prevention into visible numbers.

What MDR is not: a full outsourced security department. Patching, backup, training, policy — the rest of the program still needs owners (this is what a managed IT relationship wraps around it; MDR is the watching layer inside a larger practice, which is exactly how we deliver it — built into every plan, not sold as courage à la carte).

The questions that expose pretenders

The label ranges from staffed SOCs to rebranded alert-forwarding, and five questions sort them fast:

  1. “Who is watching at 3 a.m. Sunday — people or software?” The only acceptable answer names humans on shift. “Automated monitoring with on-call escalation” means alerts wait for someone to wake up — which is the exact gap you’re paying to close.
  2. “What actions will you take without calling us first?” Real MDR contains autonomously within agreed boundaries; “we notify you promptly” is a smoke detector with better marketing. Get the playbook boundaries in writing.
  3. “What’s the alert-to-containment time, in writing?” Minutes matter here more than anywhere in IT; the SLA logic applies, with sharper stakes.
  4. “What signals do you watch beyond endpoints?” Identity (sign-ins, forwarding rules) and email telemetry catch what endpoint-only misses — the stolen-password attack that never runs malware at all.
  5. “Walk me through a real incident from last quarter.” Anonymized, obviously — but a real SOC has these stories at hand, with timelines. Vagueness here is the whole answer.

The pricing shape, and the honest math

MDR prices per endpoint or per user, monthly — typically a modest add on top of the EDR licensing itself, and often bundled (as it should be; detection without response was always half a product). The evaluation math is blunt: compare the annual fee against one incident’s downtime arithmetic — the service pays for itself the first time a 2:06 a.m. isolation replaces a Monday-morning discovery — and note that insurers’ pricing already reflects the same conclusion, so part of the fee comes back as premium.

The bottom line

MDR is how a 20-person company gets a Fortune-500 night shift: shared analysts, real containment authority, and pattern-recognition reps no single environment could ever train. Buy it with the five questions, wire its playbook into your incident plan, and read the monthly report — the best case being years of “nothing much happened,” which was, all along, exactly what you were buying.