What is MDR, and do we need it?

MDRMDR: managed detection and response. A service in which an outside team watches your alerts and responds for you. (managed detection and response) is a service in which an outside team watches your security alerts around the clock and responds for you; you need it if nobody in your company can react to an alert at night or at weekends. It is a service, not a tool: the provider still relies on sensors such as EDREDR: endpoint detection and response. Security software installed on each computer that watches what happens on that machine. (endpoint detection and response) on your computers, and sometimes on network data. Before signing, check what the provider actually does at 03:00. Do they isolate a machine, or only send you an e-mail? Which sensors are included, and who owns the data if you leave? How fast do they respond, in writing? Many small companies combine automated detection with an on-call arrangement with their IT provider instead. NetSenX is software, not an MDR: it detects and explains alerts at any hour, and the alerts go to your team or your IT provider, who decide what to do.

← All 40 questions on NDR, EDR, SIEM, XDR, MDRAll topics