# MDR: Managed Detection and Response
Managed Detection and Response (MDR) is a managed security service that delivers 24/7 threat monitoring, alert triage, threat hunting, and active containment actions on the customer's behalf. MDR providers combine their own security technology with human analyst teams to detect threats that automated tools miss, investigate incidents to determine scope and severity, and take direct response actions such as isolating endpoints, blocking domains, killing malicious processes, and revoking compromised credentials.
The defining characteristic of MDR is the word "response." Analysts do not just generate alerts and hand them to the customer. They investigate the alert, determine whether it represents a real threat, and act to contain it. This makes MDR fundamentally different from the previous generation of managed security services and positions it as the closest thing most organizations will get to a fully staffed internal Security Operations Center (SOC) without building one from scratch.
MDR emerged as a direct response to the detection gap created by the proliferation of next-generation endpoint and network tools in the 2015-2020 period. Organizations bought powerful detection technology and then discovered they did not have the analyst capacity to act on the signals it produced. MDR providers filled that gap by wrapping human expertise around the technology.
MDR service delivery operates across several integrated functions:
Technology Integration: The MDR provider deploys endpoint detection and response (EDR) sensors, network detection agents, log collectors, and cloud connectors across the customer environment. Some providers mandate their own technology stack. Others support a bring-your-own-tools model where customers retain existing investments.
24/7 Monitoring and Triage: Provider SOC analysts monitor alerts generated by detection tools across all telemetry sources around the clock. The analyst's job at this stage is to separate genuine threats from false positives. Most MDR providers claim triage SLAs measured in minutes for high-priority alerts.
Threat Investigation: When an alert passes initial triage, analysts conduct full investigation: timeline reconstruction, process tree analysis, lateral movement assessment, data exfiltration indicators, and persistence mechanism identification. This produces the context required to understand what happened, how far the threat spread, and what actions to take.
Active Response: Confirmed threats trigger containment actions. MDR providers execute these directly without waiting for customer approval (within pre-agreed playbooks) or with a notification-then-action workflow depending on the service agreement. Response actions include: network isolation of compromised endpoints, blocking of malicious IP addresses and domains, termination of malicious processes, quarantine of suspicious files, and revocation of compromised identity credentials.
Threat Hunting: Proactive threat hunting searches the environment for signs of threats that have not yet triggered automated alerts. Hunters use attacker TTPs (Tactics, Techniques, and Procedures) from MITRE ATT&CK, threat intelligence, and pattern analysis to find dwell-time threats, fileless malware, and living-off-the-land techniques before they escalate.
Reporting and Communication: MDR engagements produce regular reporting covering threat activity, response actions taken, and security posture trends. Quality reporting distinguishes strong providers from those that generate noise.
MxDR (Managed Extended Detection and Response): The evolution of MDR extends coverage across endpoint, network, cloud, email, and identity telemetry simultaneously. Instead of detecting threats in one domain, MxDR correlates signals across all five to identify attack chains that span multiple surfaces. An attacker who compromises a cloud credential, uses it to pivot to an internal system, and then exfiltrates data via an allowed cloud service generates signals in identity, cloud, and network telemetry. Only an MxDR service correlating all three catches the full chain.
Co-Managed SOC: Some organizations need a hybrid model. The co-managed SOC arrangement has the MDR provider supply the technology platform and tier-one analysis while the customer contributes their own analysts for tier-two investigation and specialized knowledge of the environment. This suits organizations with security teams that have deep institutional knowledge but lack the tooling or 24/7 coverage to operate a full SOC.
The arithmetic of operating a 24/7 SOC independently is brutal for most organizations. A true around-the-clock capability requires a minimum of five to seven analysts to cover three shifts, seven days a week, with coverage for vacations and turnover. At fully loaded costs of $120,000 to $180,000 per analyst, the staffing cost alone runs $600,000 to $1,260,000 annually before accounting for technology, infrastructure, and management overhead. Total internal SOC costs routinely exceed $2 million per year for even a basic capability.
MDR services typically cost $50,000 to $500,000 per year depending on scope and environment size, delivering SOC-equivalent capability at a fraction of the internal cost. For small and mid-sized organizations, MDR is not a tradeoff; it is the only realistic path to 24/7 detection and response capability.
The threat landscape justifies the investment. Ransomware operators achieve dwell times under 24 hours in many modern campaigns. Business email compromise attacks target finance teams with wire transfer fraud that completes before end of day. Nation-state actors move laterally through networks within hours of initial access. An organization that detects a breach through end-of-quarter log review has already lost. MDR's value proposition is detection and containment measured in minutes and hours, not days and weeks.
The skills gap amplifies the case for MDR. There are approximately 3.5 million unfilled cybersecurity positions globally (Cybersecurity Ventures, 2023). Experienced SOC analysts, threat hunters, and incident responders are among the scarcest skills. MDR providers hire and retain these specialists at scale, distributing the cost across hundreds of customers. Individual organizations competing for the same talent pool cannot match that concentration of expertise.
SMB and Mid-Market: A 200-person manufacturing company with no dedicated security staff uses Huntress MDR to get 24/7 endpoint monitoring and response across their Windows environment. The service detects a credential-stuffing attack against their VPN within 14 minutes of the first successful authentication attempt and blocks the attacker's lateral movement before any production systems are reached. The company could not have staffed or sustained that capability internally.
Healthcare: A regional hospital network with 1,800 endpoints contracts with Arctic Wolf for MxDR coverage across endpoint, cloud (Azure), and identity (Active Directory). The service correlates a phishing-delivered credential theft with anomalous Azure login activity from an unrecognized geography, identifies that a compromised physician account is accessing patient records at unusual hours, and initiates account suspension before data exfiltration completes. HIPAA breach notification is avoided.
Technology Company with Internal Security Team: A 600-person SaaS company has two security engineers but no 24/7 coverage. They deploy Expel in a co-managed model: Expel monitors their AWS environment and Okta identity platform overnight and on weekends. Their internal team handles daytime investigation and response. The result is 24/7 coverage without the cost of a third shift, and the Expel team brings cloud attack pattern expertise the internal team does not have.
Post-Breach Recovery: A professional services firm experiencing their second ransomware incident in three years deploys Red Canary MDR as part of the post-incident recovery. The MDR engagement begins with a threat hunt to identify whether the attacker persisted after the initial incident response. The hunt finds a web shell on a public-facing server that survived the remediation. Red Canary removes it and implements monitoring rules that would detect similar persistence mechanisms in the future. The firm avoids a third incident.
Enterprise Supplement: A 5,000-person enterprise with a mature internal SOC adds Secureworks Taegis ManagedXDR for threat intelligence enrichment and extended detection across their OT/ICS environment, where their internal team lacks the specialized expertise. The enterprise model is not "MDR instead of SOC" but "MDR plus internal SOC," with each handling the domains where they have comparative advantage.
MDR addresses the detection and response function within CDA's Threat Intelligence & Defense (TID) domain, operating under the Predictive Defense Intelligence (PDI) methodology: "See the threat before it sees you."
CDA's TID domain missions include:
The critical distinction between CDA's approach and a standalone MDR purchase is the scope of the program. MDR gives you a SOC for the TID domain. It is a powerful capability, and organizations that lack detection and response coverage absolutely need it. But MDR solves a TID problem inside a six-domain security program that also includes DPS, VSD, SPH, IAT, and RGA. An organization that invests heavily in MDR while ignoring the other five domains is now better at detecting the attacks that their unpatched vulnerabilities, misconfigured cloud permissions, weak identity controls, missing data classifications, and absent governance framework continue to enable.
The failure mode is common. A company buys a premium MDR service and feels protected. Their MDR provider detects a ransomware deployment, isolates the infected endpoints quickly, and prevents full encryption. The incident report shows MDR performed as designed. The post-incident analysis reveals the attacker entered through an unpatched VPN appliance (VSD), moved laterally using a service account with excessive privileges (IAT), and achieved the level of access needed for ransomware deployment because no network segmentation existed (SPH). MDR detected and responded. The other five domains failed.
CDA does not sell MDR as a standalone product. When detection and response capability is identified as a gap during the Foundation Risk Model (FRM) assessment, CDA evaluates whether an MDR partnership, an internal SIEM/EDR buildout, or a hybrid co-managed model fits the client's size, budget, and risk profile. That recommendation sits inside a six-domain engagement where TID capability improvement is sequenced alongside VSD hardening, IAT strengthening, and the other domain missions that reduce the attack surface MDR has to monitor.
This is the difference between buying a capability and building a program. MDR providers sell capability. CDA builds programs that make the capability effective.
Evaluating MDR vendors: When MDR is the right answer, the evaluation criteria that matter most are:
The major MDR providers as of 2026 include CrowdStrike Falcon Complete, SentinelOne Vigilance, Arctic Wolf, Huntress (SMB-focused), Expel, Red Canary, Secureworks Taegis ManagedXDR, and Deepwatch. Each has distinct strengths in technology stack, market segment, and service model.