MDR and SOC

MDR is a managed service: a staffed security operations centre reviews alerts around the clock and responds to genuine threats, isolating a compromised machine or blocking malicious activity without waiting for your own team to notice. Some MDR providers supply their own endpoint telemetry agent, while others work on top of a third-party EDR you already run. Coverage often extends beyond endpoints to identity threat detection, network monitoring and Microsoft 365 monitoring, correlating signals across more than one source. What MDR does not replace is patching, backup or the RMM itself; it is a detection and response layer, not general endpoint management.

Pricing is per endpoint per month in most cases, with some providers pricing per user instead when identity and Microsoft 365 monitoring are a bigger part of the service than endpoint count. Minimum monthly commitments are common, since the service includes ongoing human monitoring rather than just software.

A human-staffed SOC covering all hours is the core promise of this category, so ask specifically how staffing works overnight and on weekends rather than assuming round-the-clock cover means the same thing at every vendor. Managed threat response and isolation, meaning the provider can act, not just alert you, is what separates MDR from a simple alerting tool. Identity threat detection and Microsoft 365 monitoring matter if a large share of the risk in your client base is account compromise rather than endpoint malware. Whether the provider works with third-party EDR or requires its own agent affects how it fits an existing stack, and monthly threat reporting matters for showing clients what they are paying for.

PSA integration for ticketing is the connection that determines whether an MDR incident becomes a tracked, billable ticket automatically or something a technician has to enter manually after the fact. A multi-tenant console matters for managing this across many clients from one place, and if the MDR provider works with third-party EDR, confirm it explicitly supports whichever EDR agent you already run.

Ask what round-the-clock staffing means in practice, including response time targets outside business hours. Ask about the contract term, any minimum endpoint or user commitment, and what a dedicated incident response engagement costs on top of the base monitoring service if a serious incident happens.

A small MSP without any internal security capability gets the most value from MDR, since it substitutes for a SOC the MSP could never staff itself. A larger MSP with its own overnight coverage or a mature internal security function may only need MDR for specific clients or as a backstop, and can negotiate a smaller footprint rather than covering every endpoint.