What happens at 3 a.m. when an alert fires and nobody on your team is awake to read it? That single question explains why so many organizations now shop for managed detection and response (MDR) services. The pitch sounds great: 24/7 monitoring, expert analysts, faster containment. But the market is crowded, vendor claims are loud, and contracts are long. A structured checklist is the difference between buying real protection and buying a dashboard with a friendly logo.
This guide walks through what a solid MDR evaluation actually looks like, section by section, with the questions that separate serious providers from marketing departments.
What MDR Actually Covers
Managed detection and response pairs security technology, typically endpoint detection and response (EDR), extended detection and response (XDR), SIEM, and network telemetry, with a human analyst team that monitors, investigates, hunts, and responds on the customer’s behalf. The human layer is the point. Tools generate alerts; MDR teams decide which alerts matter and act on them.
Gartner has tracked MDR as a distinct service category for years, and the market has matured from “outsourced alert triage” into full detection-and-response engagements that include threat hunting and containment. That evolution matters for buyers, because two providers using the same label may deliver very different scopes.
One trap to avoid early: confusing MDR with a managed security service provider (MSSP) that mainly watches firewalls and forwards alerts. Traditional MSSPs often stop at notification. MDR is expected to investigate and respond. Ask any shortlisted provider to describe, in plain words, what their analysts actually do when something suspicious appears. If the answer is “we send you a ticket,” that is monitoring, not response.
Scope and Coverage: The First Checklist Block
Before comparing prices, map what the provider can see. Coverage gaps are where incidents hide.
Which telemetry sources are included?
A practical checklist item is a written inventory of data sources: endpoints, servers, identity providers (Entra ID, Okta), cloud workloads (AWS, Azure, GCP), email, network, and SaaS logs. Ask which sources are included in the base fee and which cost extra. Many quotes look cheap until cloud logs and identity telemetry are added.
How is identity covered?
Most modern intrusions involve stolen credentials. The CISA guidance on identity and access management repeatedly stresses that compromised credentials remain a top initial access vector. If an MDR provider cannot monitor authentication logs and flag impossible travel, brute force, or token theft, the coverage story has a hole.
What about remote and mobile endpoints?
Remote workers expand the attack surface. If unmanaged personal devices are in scope, ask how (or whether) they are covered. For a practical sense of the risks on mobile, this guide on how to check whether an APK file is safe shows how easily sideloaded apps become an entry point, a risk MDR coverage should account for.
Detection Content and Threat Hunting
Detection is not a switch; it is a maintained library. The evaluation question is who maintains it and how often it changes.
Is detection mapped to MITRE ATT&CK?
The MITRE ATT&CK framework catalogs real adversary techniques, and mature providers map their detections to it. Ask for coverage statistics by tactic. A provider that can show detection coverage across credential access, lateral movement, and exfiltration is telling you something concrete. One that answers with adjectives is not.
Is threat hunting proactive or on request?
Threat hunting means analysts actively search for undetected intrusions rather than waiting for alerts. Ask how many hunting hours per month are included and whether hunts are hypothesis-driven. “We hunt continuously” is a claim; a sample hunt report is evidence.
How is detection quality measured?
Watch for false-positive rates and tuning processes. High noise burns out internal teams and hides real incidents. Ask how detections are tuned to your environment after onboarding and whether tuning is included or billed hourly.
Response: What Happens After the Alert
This is where MDR contracts differ most, and where buyers should slow down.
What response actions are authorized?
Checklist items include: isolating an endpoint, killing a process, disabling a user account, blocking a hash or domain, and quarantining email. Ask which actions the provider can take autonomously, which require your approval, and how approval works at 3 a.m. A provider that needs a phone call to your CTO before isolating ransomware is a provider with a built-in delay.
What are the SLA commitments?
Look for mean time to acknowledge (MTTA) and mean time to respond (MTTR) written into the contract, with remedies if they are missed. Vague “rapid response” language is not an SLA. Ask for the previous quarter’s actual performance against those numbers.
How does incident response handoff work?
When an incident escalates beyond containment, who leads? MDR providers typically hand off to a retainer-based IR firm or your insurer’s panel. Ask about the handoff process, whether the MDR contract includes IR hours, and how evidence is preserved. Chain-of-custody mistakes during handoff can complicate both recovery and any legal or regulatory follow-up.
Is automation used, and where?
Security orchestration and automation (SOAR) can speed up repetitive containment. Ask what is automated and what is human-reviewed. Fully automated containment without review can disrupt business systems; zero automation can slow response. The right answer depends on your risk tolerance, but the provider should be able to explain its choices.
Integration, Onboarding, and Reporting
Will it work with your existing stack?
If you already run a SIEM or EDR platform, ask whether the MDR service ingests your telemetry directly or requires rip-and-replace. Integration friction is a common source of failed deployments. For teams running open-source tooling, a walkthrough like this Wazuh SIEM guide to detecting PHP2Shell in 13 steps illustrates the kind of detection engineering MDR providers should be doing on your behalf, and gives you a benchmark for judging their rule quality.
How long does onboarding take?
Realistic timelines vary with environment size, but weeks, not months, is the norm for mid-sized estates. Ask what is required from your team during onboarding: agent deployment, log forwarding, access provisioning. Underestimate this and go-live slips.
What does reporting look like?
Ask for sample monthly reports and a sample incident report. Good reports state what was detected, what was done, what was learned, and what changed. Bad reports are alert counts in a PDF. Also ask how the provider supports compliance evidence needs, such as mapping coverage to NIST Cybersecurity Framework 2.0 functions like Detect, Respond, and Recover. That mapping is increasingly useful for regulated buyers, particularly in the EU where NIS2 obligations push organizations toward documented detection and response capability. (Cybersecurity Best Practices)
Pricing, Contracts, and the Human Factor
How is pricing structured?
Common models include per-endpoint, per-user, per-GB of log ingestion, and platform-plus-service bundles. Compare total cost at your real data volumes, not the headline per-endpoint rate. Ask about overage charges and what happens when you add 200 laptops mid-term.
Who are the analysts?
Ask where analysts sit, what tier structure exists, and how escalation works. A provider whose “24/7” team is a single rotating shift across three time zones may still be fine, but you should know. Also ask about staff turnover in the SOC. High churn erodes institutional knowledge about your environment.
What are the exit terms?
Checklist items people forget: data ownership, log retention after termination, transition assistance, and notice periods. Your telemetry should remain yours.
Common Mistakes Buyers Make
A few patterns show up again and again in failed MDR engagements.
- Buying on price alone. The cheapest per-endpoint quote often excludes identity, cloud, and hunting.
- Skipping the proof-of-value. Ask for a trial or a scoped pilot with success criteria. Vendors who refuse are telling you something.
- Ignoring internal readiness. MDR amplifies a capable internal team and exposes a disorganized one. Someone internally must own the relationship.
- Not testing the escalation path. Run a tabletop exercise with the provider in the first month. You will learn more from one simulated incident than from any sales deck.
- Forgetting the human targets. Attackers phish people, and they phish machines too. Understanding what a keylogger looks like on an endpoint helps your team sanity-check whether the provider’s detections would actually catch credential theft in progress.
Practical experience from the field suggests one more: write down your success criteria before demos begin. Teams that define “we want ransomware contained within 30 minutes, with endpoint isolation authorized autonomously” get sharper answers than teams that ask vendors to “show us your platform.”
A Compact Checklist You Can Reuse
| Area | Key question | Red flag |
|---|---|---|
| Scope | Which telemetry is included at base price? | Cloud and identity cost extra |
| Detection | Is coverage mapped to MITRE ATT&CK? | No coverage data shared |
| Hunting | How many proactive hunt hours monthly? | Hunting only “on request” |
| Response | Which actions are autonomous? | Everything needs approval |
| SLAs | Are MTTA and MTTR contractual? | “Rapid” with no numbers |
| Onboarding | What is required from our team? | Months-long deployment |
| Reporting | Can we see sample incident reports? | Alert counts only |
| Exit | Who owns the data after termination? | Unclear retention terms |
Conclusion
An MDR checklist is really a set of questions about evidence: show me the coverage map, show me last quarter’s MTTR, show me a hunt report, show me what happens at 3 a.m. Vendors that answer with documents and numbers deserve a pilot. Vendors that answer with adjectives deserve a polite goodbye. Take the twelve questions above into every evaluation, insist on a proof-of-value with written success criteria, and test the escalation path early. Done that way, MDR becomes what it promises: a genuine extension of your security team, not another subscription to forget about.
Frequently Asked Questions
What is managed detection and response in simple terms?
MDR is an outsourced security service where a provider’s analysts monitor your systems around the clock, investigate suspicious activity, and respond to threats, often containing them before your own team logs in. You get technology plus human expertise as a subscription.
How is MDR different from antivirus or EDR software?
Antivirus and EDR are tools that run in your environment. MDR is the team that operates detection and response on your behalf, using those tools plus others. Software alerts; MDR investigates and acts.
What should an MDR checklist include first?
Start with scope: which data sources are covered at the base price, especially identity and cloud logs. Then move to detection mapping, hunting cadence, authorized response actions, and contractual SLAs. Coverage and response authority matter more than dashboard features.
What SLAs should I expect from an MDR provider?
Look for written mean time to acknowledge and mean time to respond commitments, with actual performance data from recent quarters. The specific numbers vary by provider and tier, so treat any figure as a claim to verify rather than a benchmark to assume.
Can a small company justify MDR?
Often, yes. Small teams rarely have the budget for 24/7 in-house coverage, and attackers do not schedule incidents for business hours. The economics usually work best when the alternative is hiring multiple analysts or accepting overnight blind spots.
How long does MDR onboarding usually take?
It depends on environment size and how much telemetry you forward, but mid-sized organizations typically go live in weeks. The biggest delay is usually internal: deploying agents and granting access. Ask providers what they need from you and plan for it.
