Managed Detection and Response (MDR)

What managed detection and response does

Managed detection and response puts trained analysts behind your endpoint security software, so a real person investigates suspicious activity and stops it, at any hour. Without MDR, the same software raises alerts that someone on your side has to notice, understand and act on.

A typical MDR service works like this:

• Agent on every device. Endpoint detection and response (EDR) software runs on laptops, desktops and servers and records process, file and network activity.
• Detection. The EDR platform and the provider's own rules flag behavior that looks like an attack: credential theft tools, unusual remote logins, files being encrypted in bulk.
• Investigation. An analyst reviews the alert, decides whether it is real and works out which machines and accounts are involved.
• Response. The analyst contains the threat and tells you what happened and what to fix.

Many MDR services now also watch Microsoft 365 or Google Workspace sign-ins, because so many attacks start with a stolen login. Sophos found that 79% of ransomware attacks in its 2026 study began with compromised identities ³. Ask whether identity monitoring is included or sold separately; Huntress, for example, lists Managed ITDR (identity threat detection and response) as a separate $4.80 per identity per month line ⁶.

MDR is one part of a full program. Our managed security services guide shows where it fits alongside email security, training and vCISO work.

MDR vs EDR vs XDR

EDR is software, MDR is a service, and XDR is software that covers more than endpoints. The confusion comes from vendors selling all three under similar names.

CrowdStrike's self-managed tiers show the EDR price spread: $59.99, $99.99 and $184.99 per device per year, or $7.99 to $19.99 per device on monthly billing ⁷. Microsoft lists Defender for Business, its EDR for companies up to 300 users, at $3.00 per user per month ⁴; it is already included in Microsoft 365 Business Premium.

Buy EDR alone only if someone on your team, or your MSP, will respond to alerts at night and on weekends. Buy MDR if nobody will. Many MDR providers can work on top of EDR you already own, such as Defender, which avoids paying for a second agent. XDR makes sense when you have a team able to use the wider data; small firms usually get the same benefit from an MDR provider that pulls in identity and email signals.

If you also need logs from firewalls, servers and cloud apps watched in one place, that is a SOC with a SIEM, covered on our SOC as a service page.

What MDR costs per endpoint

Mainstream MDR runs $8 to $25 per endpoint per month, and a 50-endpoint office should budget roughly $400 to $1,250 a month (our calculation from that range) ¹. Prices that look like outliers usually have a reason:

• Below $8. Often alert forwarding rather than response: BD Emerson puts entry-level alert forwarding at $3 to $9 per endpoint per month ¹. Read what the analyst is allowed to do.
• Low to middle of the range. Where SMB-focused services tend to list. Huntress, for example, lists Managed EDR at $8.99 per endpoint per month MSRP, with a 50-seat minimum for direct purchase and a 12-month term ⁶.
• Above $25. Usually includes more: identity, cloud or SIEM coverage, longer log retention, or incident response hours. An October 2026 index of vendor pricing puts MDR at $9 to $75 per endpoint or user per month across the market ².
• Bundles. MSSPs that wrap MDR with email security, training and vulnerability scanning averaged $45 (basic) to $73 (premium) per endpoint per month in a 2024 benchmark ⁵.

Ask what counts as an endpoint (servers and virtual machines are sometimes priced higher), whether there is a minimum seat count, and what incident response work costs once an attack is confirmed. Our managed IT pricing guide shows how MDR is often folded into a per-user IT price.

What 24/7 means in an MDR contract

In a good MDR contract, 24/7 means a staffed analyst team investigates and contains threats at any hour, without waiting for you to wake up. In a weak one, it means software collects alerts all night and a person looks at them in the morning.

Read the contract for these points:

• Staffed or on call. Are analysts on shift overnight and on holidays, or paged from home?
• Pre-approved actions. Which steps can they take without calling you: isolating a laptop, disabling a user, killing a process, blocking a file? The more that is pre-approved, the faster the response.
• Escalation list. Who gets called, in what order, and what happens if nobody answers.
• Measured times. Ask for their actual median time to detect and time to contain from the last quarter, not a marketing number.
• Where response ends. Most MDR stops at containment. Rebuilding servers, restoring data and forensic investigation usually belong to an incident response team and your backup and disaster recovery plan.

Speed matters because breaches are slow to find. IBM's 2026 report put the average time to identify and contain a breach at 247 days ⁸, and organizations using security AI and automation extensively cut average breach costs by $1.93 million ⁹.

Ransomware protection: what MDR can and cannot do

MDR is the strongest single defense against ransomware for most small and midsize businesses, because it can catch the attacker during the hours or days before files are encrypted. It is not a complete defense on its own.

Verizon's 2026 DBIR found ransomware in 48% of all breaches ¹⁰. Sophos's 2026 study of organizations with 100 to 5,000 employees put the average recovery cost at $1.7 million and the median ransom payment at $769,000 ³¹¹. Coveware reported a median ransom payment of $150,000 in Q2 2026 ¹².

MDR does not cover the other common entry points:

• Unpatched internet-facing systems. Exploited vulnerabilities were the top initial access route in the 2026 DBIR, at 31% of breaches ¹⁰. That is a firewall and patching problem.
• Phishing. Malicious email (26%) and phishing (24%) were the top root causes in Sophos's 2026 data ³. You need email filtering and training too.
• Backups. If everything else fails, restorable offline or immutable backups decide whether you pay. In Sophos's US data, 60% of organizations used backups to recover encrypted data ¹³.

Cyber insurers expect EDR as a baseline control ¹⁴. Our cyber insurance requirements page lists the others, and cybersecurity for small business covers the full starter set.

If ransomware is running now: call your cyber insurer's breach hotline if you have a policy, report to the FBI at ic3.gov ¹⁵, and do not wipe or rebuild machines until evidence is preserved.

Questions to ask an MDR provider

The best way to compare MDR providers is to ask each one the same questions and compare written answers. Use this list:

1. Which EDR platform do you use, and can you work with the Microsoft Defender licenses we already pay for?
2. Do you monitor Microsoft 365 or Google sign-ins and mailbox rules, and is that extra?
3. Which containment actions are pre-approved, and who do you call first?
4. What were your median detection and containment times last quarter?
5. Is incident response included after containment? If not, what is the hourly rate, and do you work with our insurer's approved firms?
6. What counts as an endpoint, is there a minimum seat count, and what is the contract term?
7. What do monthly reports show, and will they satisfy our insurer's application questions?
8. If we leave, do we keep our logs and configurations, and how long are logs retained?

If you have no IT provider yet, our guide to choosing an MSP explains how to buy MDR through one. If you already have IT staff, see co-managed IT.