What it means
MDR is a service in which an external team performs defined detection, investigation, and response work for an organization. Tools are part of delivery, but the distinguishing element is the operational service and the people behind it. Contracts differ in coverage, staffing, response authority, supported sources, and what counts as an investigation. The customer still needs someone who understands the business and can make decisions outside delegated authority. Buying an MDR service does not transfer every security responsibility or ensure that every system is monitored.
AN ILLUSTRATIVE SCENARIO
A small charity needs overnight investigation
A charity’s technology manager cannot watch endpoint alerts around the clock. Its MDR provider investigates a suspicious laptop event overnight and calls the designated contact with evidence and a recommendation. The agreement allows temporary isolation of ordinary staff laptops, but not the donor-management server. The charity’s contact handles that decision. Both parties record the handoff and review whether account or application activity falls outside the service’s coverage.
Put it to work
- Define the systems, data sources, coverage hours, and investigation deliverables in scope. Ask what the service will do with an ambiguous alert or an unavailable data source.
- Write a response-authority matrix naming actions the provider may take, actions requiring approval, and escalation contacts. Include backup contacts and a route for urgent operational concerns.
- Agree evidence access, retention, case handoffs, and offboarding. Review sample investigations and test the relationship before relying on it during a real incident.
How to check your work
Run a joint exercise outside normal office hours. Verify that the provider detects or receives the test case, explains its evidence, reaches a real decision-maker, and reports whether the authorized action actually took effect.
Connect the ideas
- SOC
The people and process that detect, investigate, and respond to security events. Distinct from System and Organization Controls reporting.
- EDR
Telemetry and response capability on laptops and servers for process, file, and similar host activity.
- Triage
A short, time-boxed judgment of severity, uncertainty, and next action when an alert arrives.
- Postcondition
The independently checked state of the world that should be true after a response action.