# How do I choose an MDR provider for a small company?

Choose on what happens at 03:00, in writing, not on the brochure. Ask each provider five things. What exactly do you do when you see an attack: call us, isolate the machine, reset accounts, or only open a ticket? What is the response time you commit to in the contract, and how is it measured? Which sensors are included: endpoint only, or also network, e-mail, identity and cloud? Where are our data and your analysts located, and which sub-processors do you use? What do we keep if we leave? Ask for a sample incident report and a reference customer of your size. Check that the price model fits you: per endpoint, per user or per site. A network sensor can sit beside an MDR service: NetSenX alerts can go by e-mail on every plan, by Slack or webhook from the Pro plan and to a SIEM from the Business plan, so a provider can receive them.

FAQ: [NDR, EDR, SIEM, XDR, MDR](https://netsenx.com/en/faq/tools) · https://netsenx.com/en/faq/how-to-choose-an-mdr-provider-for-a-small-company

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/blog/2026-09-24_ndr-vs-edr-vs-siem

## Related questions

- [Should we outsource the SOC or build one?](https://netsenx.com/en/faq/should-we-outsource-the-soc-or-build-one)
- [Do we need a SOC if we have only one IT administrator?](https://netsenx.com/en/faq/do-we-need-a-soc-with-only-one-it-administrator)
- [Can a small IT team run network detection without a SOC?](https://netsenx.com/en/faq/can-a-small-it-team-run-network-detection-without-a-soc)
- [Why do companies use a SIEM?](https://netsenx.com/en/faq/why-do-companies-use-a-siem)
- [Does a small business need a SIEM at all?](https://netsenx.com/en/faq/does-a-small-business-need-a-siem)