What it means
MDR is a service in which an external team performs defined detection, investigation, and response work for an organization. Tools are part of delivery, but the distinguishing element is the operational service and the people behind it. Contracts differ in coverage, staffing, response authority, supported sources, and what counts as an investigation. The customer still needs someone who understands the business and can make decisions outside delegated authority. Buying an MDR service does not transfer every security responsibility or ensure that every system is monitored.
The idea at a glance / Response
A recommendation is not an applied response.
Hold the provider’s work beside the customer authority and response that are still required.
Fictional NorthWatch’s written Chronos Hub service covers ordinary laptop EDR alerts from 22:00 to 06:00 UTC. Sloane Sterling reviews received AL124 for L124 at 23:00 and stores H124 recommending temporary isolation. The provider has read-only investigation access and no isolation authority. Vera Vance owns approval; Kael Cho operates the endpoint. This snapshot records no customer receipt or applied action.
READ THE PICTURE
Evidence and limits
Sloane has saved H124 with AL124’s evidence and an isolation recommendation. Vera’s receipt and approval, and Kael’s execution and verification, remain open.
Keep in mindWritten hours and a saved report do not prove continuous staffing, timely customer receipt or completed containment. The payroll server and other sources are outside this agreement. Provider authority and technical permissions vary by service. Customer approval, execution, verification and broader investigation remain open; no real provider or endpoint is involved.
Read the complete example
- Evidence and limits. Sloane has saved H124 with AL124’s evidence and an isolation recommendation. Vera’s receipt and approval, and Kael’s execution and verification, remain open. This entirely fictional snapshot uses a cross-midnight 22:00–06:00 UTC service window for ordinary laptop EDR signals. The payroll server S124 is excluded. Sloane Sterling has already received AL124 and reviewed its retained P124 endpoint evidence at 23:00. H124 records the source references, open questions and a recommendation to isolate L124. NorthWatch has read-only access: its written scope and technical role do not permit isolation. The saved case is addressed to customer Vera, but no acknowledgement is recorded. Vera must assess business effects and approve the selected action; Kael must execute it and verify the result. No CMD124 exists and L124 remains connected in this snapshot. Another MDR agreement may delegate scoped response actions, but delegation still does not prove application. Customer responsibilities, broader account/application activity, retention and tested out-of-hours reachability are not completed by the service label.
Written hours and a saved report do not prove continuous staffing, timely customer receipt or completed containment. The payroll server and other sources are outside this agreement. Provider authority and technical permissions vary by service. Customer approval, execution, verification and broader investigation remain open; no real provider or endpoint is involved.
Diagram references: Microsoft: managed response depends on granted authority
AN ILLUSTRATIVE SCENARIO
Provider review, customer action still pending
NorthWatch’s Nyx reviews received AL124 for an ordinary Meridian laptop during the written overnight window. H124 retains the evidence and recommends isolation. The provider has read-only access, so Sloane must approve and Vera must execute and verify any response. H124 has no customer acknowledgement and L124 stays connected. The excluded payroll server and broader application activity need separate work.
Put it to work
- Define the systems, data sources, coverage hours, and investigation deliverables in scope. Ask what the service will do with an ambiguous alert or an unavailable data source.
- Write a response-authority matrix naming actions the provider may take, actions requiring approval, and escalation contacts. Include backup contacts and a route for urgent operational concerns.
- Agree evidence access, retention, case handoffs, and offboarding. Review sample investigations and test the relationship before relying on it during a real incident.
How to check your work
Run a joint exercise outside normal office hours. Verify that the provider detects or receives the test case, explains its evidence, reaches a real decision-maker, and reports whether the authorized action actually took effect.
Connect the ideas
- SOC
The people and process that detect, investigate, and respond to security events. Distinct from System and Organization Controls reporting.
- EDR
Telemetry and response capability on laptops and servers for process, file, and similar host activity.
- Triage
A short, time-boxed judgment of severity, uncertainty, and next action when an alert arrives.
- Postcondition
The independently checked state of the world that should be true after a response action.