What Is Managed Detection and Response?

Managed detection and response is monitoring, triage and response delivered as a service. A provider supplies the analysts and the round-the-clock rotation, and usually the detection platform, while the customer retains ownership of the environment and of most remediation.

The category exists because detection tooling is available to anyone and analyst capacity is not. Twenty-four hour coverage needs enough people to sustain a rotation, which is more headcount than most mid-sized organisations can justify for the purpose.

What separates it from older managed security

Traditional managed security monitoring largely forwarded alerts. The customer received a notification and did the investigation, which moved the work rather than reducing it.

This category is distinguished by the provider investigating before escalating and by having some authority to act — isolating an endpoint, disabling an account, blocking a destination. Whether that authority genuinely exists is the question that most differentiates providers, and it lives in the contract rather than the brochure.

What to establish before signing

Response authority. Which actions may the provider take without waiting for approval, and at what time of night. A provider that can only recommend is an alerting service.

Coverage scope. Which systems and which telemetry. Endpoint only, or identity and cloud as well — and if the latter, whose licences.

Escalation timing. How quickly a confirmed serious detection reaches a human on your side, contractually rather than aspirationally.

Data ownership. Whether logs and detections remain accessible to you, and what you keep if the relationship ends.

Where these arrangements disappoint

The recurring complaint is escalations without context: an alert arrives, the customer investigates, it is nothing. That is the old model with new branding, and it is detectable during evaluation by asking to see real examples of escalations they have sent other clients.

The second is the assumption that a provider removes the need for internal capability. Somebody internal still has to own remediation, maintain the asset context the provider lacks, and make business decisions during an incident.

Cost, and how it compares honestly

Pricing is typically per endpoint or per user, monthly. The comparison that matters is not tooling against tooling but the service against the fully loaded cost of the analyst rotation it replaces — which for genuine round-the-clock coverage is several full-time staff, not one.

The onboarding period is where the outcome is decided

The first sixty to ninety days involve deploying agents, connecting telemetry and tuning detections against your environment. During that period alert quality is poor, because the provider does not yet know what is normal for you.

Organisations that judge the service on the first month usually judge it badly, and organisations that do not participate in tuning get a service permanently calibrated for a generic estate. The asset context, ownership information and business criticality that make triage accurate can only come from your side, and supplying it is the highest-leverage thing a customer does in the relationship.

Where to start

Decide what response authority you are prepared to delegate. That single decision shapes the whole evaluation, because a provider who cannot act is being bought for alerts.

See what MDR is, MDR versus MSSP, how to choose a provider and what it costs. GuardsArm delivers managed detection and response.