What is MDR?

An MDR engagement starts with the provider deploying its own telemetry sources into the customer environment: EDR/XDR agents on endpoints, network sensors for east-west visibility, and log forwarders that pull cloud and on-prem logs into the provider's own SIEM. From that point, the provider's SOC analysts, not the customer's, triage every alert generated. The service typically covers three response tiers: notify-only (the provider tells the customer what happened and recommends action), notify-and-approve (the provider proposes a containment action, like isolating a host, and the customer approves before it executes), and autonomous response (the provider acts immediately under a pre-agreed playbook, most commonly for high-confidence ransomware precursors where minutes matter). What separates MDR from an old-style MSSP is that an MSSP's contract is usually built around log collection and compliance reporting, largely passive, while MDR is built around active detection engineering, threat hunting, and measurable response, with contractual SLAs for mean-time-to-detect and mean-time-to-respond. A mid-market retailer without the headcount to staff a 24/7 SOC (that typically takes ten or more experienced analysts across shifts, plus tooling costs) is the textbook MDR customer: they get enterprise-grade detection coverage without building the team themselves. The tradeoff is that the provider's analysts don't have the customer's institutional context by default, so onboarding includes documenting the customer's normal (which admin accounts are expected to touch production, which vendors have VPN access) so the provider's team doesn't drown in environment-specific false positives during the first weeks. Threat hunting is usually bundled into the service too: rather than waiting for an alert to fire, MDR analysts proactively search across the aggregated telemetry from every customer they cover for TTPs seen in one client's environment, then check whether the same pattern exists elsewhere in the provider's book of business, a cross-customer visibility advantage a single in-house SOC simply doesn't have.