What happens in the first hour after a real intrusion at a company with no security staff on shift? For many small and mid-sized organizations, the honest answer is: nothing, until someone notices something odd days later. That gap is exactly what managed detection and response (MDR) exists to close. But signing a contract is the easy part. Getting MDR right takes planning, honest scoping, and a clear idea of what the provider actually does versus what stays on your plate.
This guide walks through the practical steps: assessing readiness, choosing a provider, surviving onboarding, and measuring whether the service earns its keep.
What MDR Actually Covers (and What It Does Not)
MDR is a service in which an outside team monitors your endpoints, networks, cloud accounts, or identity systems, investigates alerts, and helps you respond to threats. It typically bundles three things: technology (endpoint or network sensors), human analysts (24/7 triage), and response actions (containment, isolation, guided remediation).
It is not the same as antivirus, and it is not a full replacement for an internal security team. Most providers handle detection and first response, then hand off deeper remediation to you or your IT partner. Understanding that boundary before you sign prevents months of mismatched expectations.
The work itself maps to established frameworks. The NIST Cybersecurity Framework describes the identify-protect-detect-respond-recover lifecycle, and MDR mainly strengthens the detect and respond phases. The MITRE ATT&CK framework catalogs real adversary techniques, which is useful when you ask a provider which behaviors they actually detect. (Cybersecurity Best Practices)
Step 1: Assess Your Environment Before You Shop
Buying MDR blind is the most common mistake. Providers price and scope based on what you have, so know your numbers first.
- Asset count: endpoints, servers, cloud workloads, and identities.
- Coverage gaps: which devices have no endpoint agent, which systems log nothing.
- Existing tools: EDR, SIEM, firewalls, identity providers, and whether they forward logs.
- Compliance obligations: sector rules, contractual requirements, insurance conditions.
- Internal capacity: who triages alerts today, and at what hours.
Write this down as a one-page inventory. Providers will ask for it, and you will use it to compare quotes fairly. If your logging is thin, expect onboarding to include log pipeline work. That is normal, but it takes time and should be priced in.
A quick word on adjacent risks: MDR detects threats, but it does not stop every credential-stealing tool. Knowing what a keylogger is and how to detect one helps you ask better questions about endpoint telemetry during vendor calls.
Step 2: Define Outcomes Before Features
Feature checklists are seductive. Instead, define the outcomes you need in plain language, then map features to them.
| Outcome you need | Question to ask providers | Red flag if they answer |
|---|---|---|
| Fast alert triage | What is your median time to triage, and how is it measured? | Vague “real-time” claims with no metric |
| Clear escalation | Who calls whom, at what hour, and how fast? | “We send an email ticket” |
| Containment ability | Can you isolate a host without our approval? | Only “advisory” response |
| Coverage hours | Is triage truly 24/7 by humans? | “Automated after hours” |
| Transparency | Do we get raw telemetry access? | Locked portal with summaries only |
The last row matters more than buyers expect. If you ever change providers, raw data access determines whether you start over or migrate smoothly.
Step 3: Choose the Right Provider Model
MDR comes in several shapes, and the right one depends on your team size and budget.
Pure-play MDR vendors focus only on detection and response. They tend to be sharp on threat hunting but may not manage your broader IT stack.
MSSPs with MDR offerings combine monitoring with general managed IT services. Good fit if you want one throat to choke; watch for analysts spread thin across many tools.
Platform-native MDR comes bundled with an EDR or SIEM product you already run. Integration is smooth, but you are tied to that vendor’s ecosystem.
Co-managed or hybrid models let your internal team handle business hours while the provider covers nights and weekends. This is often the best value for organizations with one or two security staff.
There is no universally best model. A 40-person firm with no IT security hire usually wants a fully managed service. A 400-person company with a security analyst likely wants co-managed coverage and keeps tuning in-house.
Step 4: Run a Structured Evaluation
Shortlist three providers and evaluate them the same way. A simple scorecard keeps the process honest.
- Discovery call: confirm scope, pricing model, and onboarding timeline.
- Technical deep dive: ask for a live portal walkthrough, not slides.
- Reference calls: speak to two customers of similar size and sector.
- Trial or proof of value: request a 30-day pilot on a subset of endpoints.
- Contract review: check SLAs, data ownership, exit terms, and liability caps.
During the deep dive, ask how they detect specific behaviors rather than products. For example: “Show me how you would catch credential dumping on a Windows server.” Strong providers answer with detection logic and response playbooks. Weak ones recite marketing.
Also ask about false positive handling. Every environment generates noise. You want to know how tuning requests are submitted, how fast they are actioned, and whether tuning is included or billed hourly.
Step 5: Prepare Your Side of Onboarding
Onboarding is where most MDR relationships succeed or stall. Providers cannot detect what they cannot see, and sensor deployment depends on your cooperation.
Practical tips that actually work:
- Assign one internal owner. A named person who answers provider questions within a day keeps onboarding on schedule. Diffuse ownership is the number one cause of delays.
- Deploy agents in waves. Start with servers and finance or admin endpoints, then expand. A big-bang rollout buries everyone in alerts.
- Document your crown jewels. Tell the provider which systems matter most. Detection priority should follow business risk, not asset count.
- Set up an escalation channel that people actually watch. A dedicated chat channel or phone tree beats a shared inbox nobody monitors at 2 a.m.
- Agree on a baseline period. Expect two to four weeks of tuning before alert quality stabilizes. Judge the service after that, not during week one.
Common mistakes to avoid: buying MDR but leaving endpoint agents uninstalled on a third of laptops; forgetting cloud and identity logs; and never testing the escalation path. Run a tabletop exercise in month one. Send a fake alert through the process and see how long it takes to reach a human who can act.
If your team also runs automation tooling, keep the security stack documented. Articles like this guide to starting an AI automation agency are a reminder that fast-moving tech environments accumulate shadow systems, and shadow systems are blind spots for any monitoring service.
Step 6: Know What Response You Have Authorized
Detection without response is a notification service. Decide in advance which actions the provider may take autonomously.
Typical tiers look like this:
- Notify only: provider alerts you; you act.
- Assisted response: provider recommends and you approve, usually within minutes.
- Autonomous containment: provider isolates hosts or disables accounts under pre-agreed rules.
Most organizations land on assisted response for endpoints and autonomous containment only for the most severe cases, such as confirmed ransomware behavior. Put these rules in the contract; the onboarding call alone is not enough. During a real incident, nobody wants to debate permissions.
Step 7: Measure the Service After 90 Days
MDR is a subscription, so treat it like one you review. Ask for a quarterly report covering:
- Alert volume and how many were true positives
- Median time to detect and time to respond
- Incidents contained and how
- Tuning changes made
- Coverage gaps still open
Benchmark the numbers against your own expectations, not vendor marketing. If detection times drift upward or tuning requests stall, raise it early. Good providers welcome the conversation; poor ones get defensive.
Where MDR Fits Alongside Your Other Defenses
MDR strengthens monitoring, but it does not replace hygiene. Patching, multi-factor authentication, backups, and phishing awareness still carry most of the defensive weight. Think of MDR as the smoke alarm and fire brigade, not the fireproof walls.
It also pairs well with detection literacy across the organization. Teams that understand how synthetic media and fake content spread make better decisions under pressure. Guidance on how to detect AI-generated images is a useful companion piece for anyone building broader awareness training.
For organizations running open-source security stacks, MDR can complement rather than replace them. A practical walkthrough such as this one on using Wazuh SIEM to detect PHP2Shell in 13 steps shows how much detection value a tuned open-source tool delivers, and MDR providers can often ingest those alerts rather than duplicate them.
Budget Expectations and Contract Traps
Pricing varies widely by model and scope, so treat any single figure with suspicion. What you can control is the contract structure.
Watch for these traps:
- Per-alert billing that punishes noisy environments
- Tuning fees hidden outside the base subscription
- Data lock-in where you cannot export raw logs on exit
- Vague SLAs without defined measurement methods
- Auto-renewal clauses with long notice periods
Negotiate a pilot clause and a clear exit path. A provider confident in its service will accept both.
A Realistic 90-Day Plan
Here is a timeline that works for most mid-sized organizations:
- Weeks 1–2: Complete the environment inventory and define outcomes.
- Weeks 3–5: Shortlist providers, run deep dives, and check references.
- Weeks 6–7: Select a provider and negotiate the contract with response tiers.
- Weeks 8–10: Deploy sensors in waves and connect log sources.
- Weeks 11–12: Tune alerts, run a tabletop exercise, and confirm escalation paths.
- Week 13: First review meeting using the metrics above.
That pace is achievable without heroics. Compressing it into two weeks usually means skipped log sources and a noisy first month.
Conclusion
Getting started with managed detection and response is less about picking a logo and more about preparation. Know your environment, define outcomes in measurable terms, choose a delivery model that matches your team, and treat onboarding as a joint project with a named owner on your side. Decide your response permissions before an incident forces the question, then review the service with real metrics every quarter. Done this way, MDR becomes what it promises: a reliable set of eyes and hands that shortens the distance between a suspicious signal and a contained threat.
Frequently Asked Questions
How long does MDR onboarding usually take?
Most mid-sized organizations need four to eight weeks from contract signature to steady-state monitoring. The variance comes from sensor deployment speed, log source availability, and how quickly your team answers provider questions. Plan for a tuning period of two to four weeks after that before judging alert quality.
Do we still need an internal security person with MDR?
Not necessarily a dedicated hire, but you need a named internal owner. Someone must approve response actions, handle tuning requests, and attend review meetings. Without that owner, escalations stall and the service degrades into an expensive alert feed nobody acts on.
Is MDR worth it for a small business?
It often is, provided the business has basic hygiene in place first. Patching, MFA, and backups matter more than monitoring, but a small firm with no night-shift coverage gains real value from 24/7 triage. Co-managed or shared models usually fit small budgets better than fully bespoke contracts.
What is the difference between MDR and a SIEM?
A SIEM collects and correlates logs; it is a tool. MDR is a service that uses tools, including SIEM technology, plus human analysts and response procedures. You can run a SIEM without any monitoring service, and you can buy MDR that includes SIEM capability as part of the package.
Can an MDR provider stop a ransomware attack on its own?
Sometimes, if you have authorized autonomous containment and the detection fires early enough. Most providers isolate affected hosts and disable compromised accounts under pre-agreed rules, then guide remediation. Full recovery still depends on your backups and incident response plan.
What should we measure to know MDR is working?
Track median time to detect, median time to respond, true-positive ratio, incidents contained, and the number of open coverage gaps. Review these quarterly against your own targets. Rising detection times or stalled tuning requests are early warning signs worth raising immediately.
