The managed detection and response the enterprise has been quietly buying has finally become the service the small security team can actually use, the service the alert fatigue has been quietly demanding, the service the postmortem will name as the difference. The honest framing matters here, because the MDR the enterprise has been paying the subscription for sits as the MDR the enterprise has been quietly expecting the SOC the enterprise could not afford to staff.
What follows runs as the working version of the field guide. The shorter version is what the security team and the procurement team actually have time to read.
What MDR actually does
Three things, in roughly that order of how much each one matters. The first runs as the 24/7 monitoring, where the monitoring the provider has been delivering, the monitoring that runs around the clock, the monitoring the small team cannot staff, the monitoring the provider has been quietly running for the enterprise the enterprise has been paying for. The second runs as the triage, where the triage the provider has been performing, the triage the analyst the enterprise could not hire has been doing, the triage that filters the noise the SIEM has been producing, the triage that hands the enterprise only the alert the enterprise needs to act on. The third runs as the response guidance, where the guidance the provider has been giving, the guidance the analyst the enterprise cannot staff has been writing, the guidance the enterprise gets on the phone when the alert the enterprise cannot ignore lands, the guidance the enterprise has been quietly treating as the analyst the enterprise wishes the enterprise had.
What MDR does not
Three things, in roughly that order of how much each one matters. The first runs as the custom rule, where the rule the enterprise has been asking for, the rule the provider has been treating as the out of scope, the rule the enterprise needs to write the enterprise cannot afford the analyst to write, the rule the enterprise should be writing the enterprise has been treating as the provider problem. The second runs as the insider access, where the access the provider does not have, the access the provider has been requesting, the privileged access the enterprise has been treating as the security risk the provider has been quietly trying to talk the enterprise out of, the access the enterprise has been quietly refusing to grant. The third runs as the full coverage, where the coverage the provider does not have, the coverage the enterprise has been expecting, the coverage of every endpoint, every cloud, every SaaS the enterprise has been using, the coverage the provider has been quietly scoping to the endpoint and the cloud the provider has been asking the enterprise to grant the access to.
How to pick the right provider
Three moves if you are the security or procurement team that wants the MDR the enterprise has been paying for to actually catch the breach the MDR has been promising. Ask the onboarding question, where the question the procurement team should be asking, the question that asks how the onboarding works, the question that asks how long the onboarding takes, the question that asks what the enterprise needs to provide, the question the procurement team should be asking before the procurement team signs the contract. Ask the custom rule question, where the question the procurement team should be asking, the question that asks how the custom rule works, the question that asks who writes the custom rule, the question that asks how long the custom rule takes, the question the procurement team should be asking to know the answer the provider will not put on the slide. Ask the exit question, where the question the procurement team should be asking, the question that asks what happens when the enterprise cancels, the question that asks who owns the data, the question that asks how the enterprise takes the rule the provider wrote, the question the procurement team should be asking because the answer the procurement team gets the day the enterprise wants to leave matters more than the answer the procurement team gets the day the enterprise signs. The team that asks the three questions serves as the team that has actually picked the right provider.
The bottom line
MDR in 2026 sits as the service the small team can actually use. The 24/7 monitoring, the triage, the response guidance, those three are what it does. The custom rule, the insider access, the full coverage, those three are what it does not. The onboarding, the custom rule, the exit, those three are the questions. The team that asks the three picks the right provider. The team that does not serve as the team that will be writing the renewal the enterprise should have asked the questions about.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
