Managed Detection and Response (MDR)
MDR vs EDR, Managed EDR and XDR, and What MDR Costs
IBM's 2026 study puts the average breach at 247 days to identify and contain. MDR puts analysts on your endpoints around the clock to close that gap. Get MDR through us: the providers that fit price it at once, and we negotiate the contract.
Price My MDRMost companies shopping for MDR already own security tools. What they lack is someone watching them at 3 a.m. on a Sunday, with the authority to act before Monday. MDR is one part of managed security services; this page compares it with EDR, XDR, SOC as a service and an MSSP, then covers price and terms. We source MDR for you from the providers that fit and negotiate the contract.
Sources: IBM Cost of a Data Breach Report 2026, via the Baker Donelson summary ($1.33 million gap is an MCA calculation; 241 days from the IBM 2025 report, PDF); 2026 Data Breach Investigations Report (DBIR); staffing is an MCA calculation from BLS figures, shown in the MDR vs SOC section.
Sources: IBM Cost of a Data Breach Report 2026, conducted by Ponemon Institute, lifecycle figures via the Baker Donelson summary; who found the breach from the IBM 2025 report, full report (PDF), figures 13 to 15, where days are time to identify plus time to contain. Figures as of October 2026. Free to cite with a link to this page.
Each provider quotes the same endpoints, servers, cloud accounts and identities, with the same response authority, so the per-endpoint prices actually compare.
One requirement goes to the MDR providers that fit, on the same day. Once you ask one for pricing directly, it usually will not register an advisor on the deal, and you negotiate alone.
What the provider may do without calling you, how fast, what counts as an incident, and how many incident response hours are included, in writing before you sign.
The provider you choose pays us, so it costs you nothing. You'll hear back within 24 hours. If running detection with your own team is right for you, we will say so.
What Does an MDR Service Do?
An MDR service does five things around the clock: it monitors, hunts, investigates, responds and reports. The first three are detection. The fourth is what separates MDR from a monitoring service that sends you an email and waits.
| What it does | What the provider does | What to pin down |
|---|---|---|
| 24/7 monitoringNights, weekends, holidays | Analysts watch alerts from your EDR and any other sources in scope, around the clock | Whether a person, not only automation, reviews high-severity alerts at night, and how fast |
| Threat huntingLooking for what did not alert | Analysts search your telemetry for quiet signs of an attacker, such as a valid account signing in from somewhere new | How often hunts run, and whether you see what was searched for and what was found |
| InvestigationTriage and scoping | Each real alert is worked out: what happened, which machines and accounts are involved, how the attacker got in | Whether investigating a confirmed incident is included, or billed as incident response |
| Response actionsContainment | Isolate a host from the network, kill a process, disable an account, block a file or address, remove what the attacker left behind | Which actions the provider may take without asking you, and which need your approval first |
| ReportingFor you, auditors and insurers | Incident write-ups, monthly summaries, and the evidence auditors and cyber insurers ask for | Report format, review meetings, and whether reports map to the frameworks you answer to |
| Onboarding and tuningThe first weeks | Agents deployed, normal activity baselined, false positives cut down | Who deploys the agents, how long onboarding takes, and when the time commitments start to apply |
MDR vs EDR: What Is the Difference?
EDR (endpoint detection and response) is software; MDR is a service, usually built on EDR. EDR records what happens on each laptop and server, flags behavior that looks like an attack, and gives someone the controls to stop it. MDR adds the someone: trained analysts who watch those alerts 24 hours a day and use the controls. A company with EDR and no one watching it has a smoke detector in an empty building.
| Question | EDR | MDR |
|---|---|---|
| What is it? | Software installed on endpoints and servers | A service: people, process and technology, usually including an EDR tool |
| Who watches the alerts? | Your own team, during the hours it works | The provider's analysts, 24 hours a day, every day |
| Who hunts for what did not alert? | Your team, if it has the time and skills | The provider, on a schedule you can see |
| Who stops an attack in progress? | Your team, using the tool's controls | The provider, within the authority you grant, then hands over |
| What does it cover? | Endpoints and servers with the agent installed | Endpoints, and often cloud, identity, email and network sources |
| What do you need in-house? | Analysts to triage and respond, around the clock if you want 24/7 coverage | A named contact who can make decisions, and an escalation list |
| How is it priced? | A license per endpoint, per year or per month | Per endpoint or per user per month, with the license often included |
EDR vs Antivirus: What Is the Difference?
Antivirus stops known bad files at the door. EDR records what happens after something gets in. That matters because many attacks never drop a file antivirus would recognize: an attacker who signs in with a stolen password and uses the system's own administrative tools looks like an employee to antivirus, and like an anomaly to a well-tuned EDR. EDR solutions keep a timeline of processes, connections and changes on each device, which is what an analyst needs to answer "what did it touch?"
Traditional antivirus
Matches files against signatures of known malware and blocks or quarantines them. Cheap and still useful, but blind to attacks that use legitimate tools or new code.
Next-generation antivirus
Adds behavior and machine-learning models to catch malware no one has seen before. Still prevention: it decides block or allow, and keeps little history for an investigation.
EDR
Records activity on every device, flags suspicious behavior, and lets a responder isolate the machine, kill a process or roll back changes. Most EDR products include next-generation antivirus. It needs someone watching it.
Some MDR providers work with the endpoint tools you already have; others bring their own agent. Send us what you run and how many endpoints, and we price both routes side by side. You'll hear back within 24 hours.
MDR vs SOC: What Is the Difference?
A security operations center (SOC) is the team, processes and tools that monitor and defend an organization; MDR is a service that delivers the detection and response part of that job. The real choice is usually build a SOC in-house or buy one. Buying one is SOC as a service, which centers on a SIEM collecting logs from firewalls, servers, cloud and applications. MDR centers on endpoint telemetry and on acting against an attack. SOC as a service gives the broader view and the log retention many compliance frameworks expect; MDR gives faster hands-on response. Many mid-market companies buy MDR alone; larger or more regulated ones often buy both, sometimes under one contract.
MCA calculation. A seat staffed around the clock is 8,736 hours a year (52 weeks × 168 hours). One analyst works about 1,776 hours after vacation, sick leave, holidays and training (2,080 hours less 38 days: 23 days of vacation and sick leave from the BLS National Compensation Survey, plus 10 holidays and 5 training days, our assumption). 8,736 ÷ 1,776 = 4.9 analysts per seat. At the BLS median pay of $129,180 (May 2025), that is about $635,000 a year in salary, or about $928,000 with benefits at the BLS ratio of total compensation to wages of 1.46 (Employer Costs for Employee Compensation, June 2026). Excludes tools, a SIEM, management and turnover. Free to cite with a link to this page.
Hiring is the other half of the problem. The BLS counts 192,900 information security analyst jobs in 2025 and projects 21 percent growth from 2025 to 2035, much faster than the average for all occupations, so the people a 24/7 rotation needs are in demand everywhere. A seat staffed around the clock is also a single point of failure: one analyst, alone at night, deciding whether to take a production server offline. An MDR provider spreads that across a team that sees attacks at many customers. If you already run a staffed security team, MDR can cover nights and weekends or act as a second line.
MDR vs MSSP: What Is the Difference?
The practical test: when the service sees something at 2 a.m., does it open a ticket and alert you, or does it contain the machine and then call? A monitoring-only service does the first; MDR does the second. If you are buying firewall management, SASE and MDR in the same year, putting them in front of providers together can produce better terms than three separate searches; the managed security services guide covers the full set.
Managed EDR and Managed XDR
Managed EDR is the narrowest form of the service: a provider's analysts watch and act on one EDR tool across your endpoints and servers. Managed XDR applies the same service to an XDR platform, which adds network, cloud, identity and email data. MDR sits between them in practice, and many providers use the three terms loosely, so read the coverage list, not the name.
What Is XDR?
XDR (extended detection and response) is a platform that correlates detections from endpoints, network, cloud, identity and email into one set of incidents, so an analyst sees one attack instead of five unrelated alerts. XDR is a product category, sold by security vendors, and you can run it with your own team. Managed XDR is that platform with a provider's analysts running it 24/7.
Managed EDR
Covers: endpoints and servers. Fits: smaller environments, mostly on premises or in private cloud, where the endpoint is where attacks land.
MDR
Covers: endpoints plus the sources you add, often identity and cloud. Fits: most mid-market companies without a 24/7 security team.
Managed XDR
Covers: endpoints, network, cloud, identity and email in one platform. Fits: hybrid environments spread across offices, colocation and public cloud.
Antivirus vs EDR vs MDR vs XDR vs SOC as a Service vs MSSP
The six terms overlap, and providers mix them. This is how they line up on the questions that matter to a buyer.
| Option | What it is | Who is watching | What it acts on | Usually priced |
|---|---|---|---|---|
| Antivirus | Software that blocks known malicious files | No one; alerts go to you | Quarantines files automatically | Per device, or bundled |
| EDR | Software that records endpoint activity and flags attacks | Your team | Your team isolates hosts and kills processes | Per endpoint license |
| Managed EDR | EDR plus a provider's analysts on that tool | Provider, usually 24/7 | Endpoints and servers, within agreed authority | Per endpoint per month |
| MDR | 24/7 monitoring, hunting, investigation and response | Provider, 24/7 | Endpoints, and often accounts, cloud and email | Per endpoint or user per month |
| XDR / managed XDR | A platform correlating many sources; managed adds analysts | Your team, or the provider if managed | Hosts, accounts, email and network controls | Per endpoint, user or data source |
| SOC as a service | An outsourced SOC watching logs from everything, usually in a SIEM | Provider, 24/7 | Detects and escalates; response depends on the contract | By log volume, devices or users |
| MSSP | A provider of managed security services of many kinds | Provider, for the services bought | Whatever the contract covers | Per service, device or site |
Metro Colo Advisory summary of how the categories are commonly sold; individual providers vary, which is why we compare coverage lists rather than labels.
Coverage has to follow the workloads. Servers in a colocation cage, a private cloud and a public cloud account each need an agent or a log feed; a service scoped to office laptops misses what an attacker wants most. If workloads are moving, through cloud migration services, cloud repatriation or a hybrid cloud colocation design, scope MDR for where they will run, not where they ran.
Send us your endpoint count, the tools you run and who answers alerts at night. We tell you which service fits before any provider quotes it. If your current setup is enough, we will say so.
MDR Pricing: How Much Does Managed Detection and Response Cost?
MDR pricing is most often per endpoint per month, with servers frequently priced above workstations; some providers price per user or per employee instead. We do not publish a dollar range: the published ranges come from companies that sell MDR, and a per-endpoint number means little until the scope behind it is fixed. Two quotes can be far apart and both be fair, because one includes identity coverage, response authority and incident response hours and the other does not. Managed detection and response cost is set by these drivers.
| Cost driver | Why it moves the price | What to have ready |
|---|---|---|
| Endpoint count | Most quotes are per endpoint, and volume tiers lower the unit price as counts rise | Counts of laptops and desktops, servers and virtual machines |
| Servers vs workstations | Servers carry more risk and more telemetry, and are often priced at a higher rate | Server count by operating system and where each group runs |
| Cloud coverage | Cloud accounts, containers and SaaS add data sources beyond the endpoint agent | The cloud accounts and SaaS applications that must be watched |
| Identity coverage | Attackers often sign in rather than break in, so watching sign-ins and directory changes is common added scope | Your identity platform and user count |
| Your EDR or theirs | Some providers run on the EDR you own; others include their own agent and license in the price | The EDR you run now, if any, and its renewal date |
| Response authority | Hands-on containment at any hour costs more than notify and advise | The actions you will authorize without a phone call |
| Incident response retainer | Pre-paid hours for a full investigation and recovery, beyond what MDR includes | How many hours you want, and what your cyber insurer requires |
| Data retention | Keeping telemetry longer costs storage, and some frameworks set minimums | The retention your auditors, insurers or regulators require |
| Term | Multi-year terms usually buy a lower rate and fix renewal terms | Your budget cycle and how long you want to commit |
Send endpoint and server counts, cloud and identity sources, and the response authority you want. The providers that fit price the same scope, and we negotiate the rate and terms. Once a provider has priced you directly, it usually will not register an advisor, and you negotiate alone. If you have already spoken to one provider, tell us which; we can still run the rest of the market.
Ransomware and MDR: What the Breach Data Shows
Ransomware is the attack most MDR buyers worry about, and the numbers support the worry. In the 2026 Data Breach Investigations Report (DBIR), ransomware was present in 48 percent of breaches, up from 44 percent, and the 2025 edition found it in 88 percent of breaches at small and midsize businesses.
Sources: 2026 DBIR executive summary (all breaches, 2026); 2025 DBIR executive summary (all breaches 2025, and the split by company size, which the 2026 summary does not repeat). Figures as of October 2026. Free to cite with a link to this page.
The 2026 report also found that 69 percent of ransomware victims did not pay. Exploited vulnerabilities were the way in for 31 percent of breaches, now ahead of credential abuse at 13 percent, and only 26 percent of the flaws in CISA's Known Exploited Vulnerabilities catalog were fully fixed, at a median of 43 days. In the 2025 DBIR, edge devices and VPNs made up 22 percent of exploitation, up from 3 percent, which is why managed firewall services and SASE and SD-WAN belong in the same conversation as MDR. Third parties were involved in 48 percent of breaches in 2026, and the human element in 62 percent.
What MDR does against ransomware is catch the steps before encryption: the stolen sign-in, the new administrator account, the tools staged on a server, the backups being deleted. Those steps can run for days, and that is the window MDR works in. What MDR does not do is restore your data. If encryption happens, recovery depends on copies the attacker could not reach: immutable backup as a service, DRaaS for systems that must be back in hours, and disaster recovery colocation for the few that cannot be down at all. Buy detection and recovery as a pair.
What to Put in an MDR Contract
Which actions the provider may take without asking (isolate a host, disable an account, block a file), which need approval, and who it calls, in what order, when no one answers.
Time to triage, time to notify you and time to contain once authorized, in minutes, by severity, measured from the alert, with service credits when they are missed.
The definition, the severity levels, and where MDR work ends and billable incident response begins. This line decides the size of your bill in a bad month.
Hours included, the rate after them, how fast responders engage, and whether unused hours can go to tabletop exercises or assessments instead of expiring.
Every endpoint group, server group, cloud account and identity source by name, and how new devices are added and billed during the term.
How long telemetry is kept and where, who owns it, how you get it back at the end, how agents come off, and what renewal increases are capped at.
Questions to Ask MDR Services Providers
| Ask | Why it matters | A complete answer includes |
|---|---|---|
| Walk us through a real 3 a.m. alert | Shows who looks, how fast, and what they are allowed to do | Named roles, timings by severity, and the exact point at which you are called |
| What do you see? | Coverage gaps are where attackers live | A list of data sources in scope, and which of your systems would be outside it |
| Can you run on our EDR? | Replacing a tool you just bought adds cost and a migration | Supported tools, and the price with and without their own agent |
| How do you hunt? | Hunting finds what alerts miss | Frequency, method, and an example of a hunt report |
| What evidence do we get for auditors and insurers? | Monitoring is often a control you must prove | Sample reports, the provider's own attestations such as SOC 2 Type II, and a HIPAA business associate agreement where needed |
Want these answered before you sign? We ask every provider we bring you to answer them in writing with its quote, so you compare response terms as well as price. Send the requirement and you'll hear back within 24 hours.
MDR for Regulated Industries
Healthcare, financial services and defense contractors buy MDR partly because their frameworks expect continuous monitoring and a tested incident response capability. MDR helps meet those expectations but does not make you compliant on its own: logging, access control and documentation still sit with you. Healthcare buyers need a provider that signs a business associate agreement; see HIPAA compliant hosting. Trading firms and funds should read colocation for financial services, and defense contractors handling controlled unclassified information should start with the GCC High and CMMC enclave guide, because the monitoring has to fit the enclave. The physical side of compliance is covered in compliance colocation.
How We Place MDR
You send the requirement
Endpoint and server counts, operating systems, cloud accounts, identity platform, the EDR you run now if any, compliance frameworks, and the response authority you want. Rough numbers are fine.
We run the providers that fit, at once
The same scope goes to the MDR providers that fit, on the same day, so the quotes compare line by line.
We compare scope and terms, not labels
Coverage, response authority, time commitments, incident response hours, retention and exit, side by side.
We negotiate, and you sign
Rate, term and the contract terms above, while they are still negotiable. The provider you choose pays us, so it costs you nothing.
Larger questions are paid engagements, and if the work is a paid engagement, we tell you the fee before it starts: where your workloads should run is IT infrastructure consulting, and the security and resilience of a facility you are building or buying is data center consulting and data center due diligence.
Managed Detection and Response: Frequently Asked Questions
What is managed detection and response (MDR)?
MDR is a service in which a provider's analysts monitor your endpoints, and often your cloud, identity and email activity, 24 hours a day, investigate alerts, hunt for threats the tools missed, and take response actions such as isolating an infected device. It is usually built on EDR software and priced per endpoint per month. Its purpose is to find and contain attacks in hours rather than the 247 days the average breach took to identify and contain in IBM's 2026 report.
What is the difference between MDR and EDR?
EDR is software that records activity on endpoints and servers, flags attacks and gives a responder controls to stop them. MDR is a service in which a provider's analysts watch that software 24/7, investigate, and take response actions for you. Most MDR services include or run on an EDR tool.
What is the difference between EDR and antivirus?
Antivirus blocks known malicious files, while EDR records what happens on each device and detects suspicious behavior, including attacks that use stolen passwords and legitimate tools that antivirus would not flag. EDR also keeps the history an investigation needs and lets a responder isolate a machine. Most EDR products include next-generation antivirus.
What is the difference between MDR and a SOC?
A SOC is the team, processes and tools that monitor and defend an organization, while MDR is a service that delivers the detection and response part of that work. SOC as a service usually centers on a SIEM collecting logs from every system, which suits broad visibility and compliance log retention. MDR centers on endpoint telemetry and hands-on response, and many companies use one or both.
What is the difference between MDR and an MSSP?
An MSSP is a type of provider that runs security services such as firewalls, VPNs, log monitoring and scanning, while MDR is a specific service focused on detecting and stopping active attacks. Many MSSPs sell MDR. The test is whether the contract includes hands-on response or only alerting.
What is managed EDR?
Managed EDR is an EDR tool on your endpoints and servers watched and operated by a provider's analysts, usually 24/7. It is the narrowest form of MDR, covering the endpoint only. It fits smaller environments where most systems run on premises or in a private cloud.
What is XDR, and what is managed XDR?
XDR, extended detection and response, is a platform that correlates detections from endpoints, network, cloud, identity and email into single incidents. Managed XDR is that platform run 24/7 by a provider's analysts. It suits hybrid environments where attacks cross several systems.
How much does MDR cost?
MDR is most often priced per endpoint per month, with servers usually priced above workstations, and some providers price per user instead. The total depends on endpoint count, cloud and identity coverage, how much the provider may do without asking, incident response retainer hours, data retention and term. For comparison, staffing one 24/7 seat in-house takes about 4.9 analysts, about $928,000 a year with benefits by our calculation from BLS figures.
Can MDR stop ransomware?
MDR can catch the steps that come before encryption, such as stolen sign-ins, new administrator accounts and deleted backups, and contain them. It does not restore encrypted data, so it should be paired with immutable backups and disaster recovery. Ransomware was present in 48 percent of breaches in the 2026 Data Breach Investigations Report.
Do we still need an incident response retainer with MDR?
Usually yes. MDR contains attacks, but a full investigation, forensic work and recovery after a serious incident are often billed separately as incident response. A retainer fixes the hours, rate and response time in advance, and many cyber insurers ask about it.
Who needs MDR?
Companies that need 24/7 detection and response but cannot staff a round-the-clock security team, which takes about 4.9 analysts for one seat. That includes most mid-market organizations and regulated firms in healthcare, financial services and the defense supply chain. Companies with a staffed security team often use MDR for nights, weekends or as a second line.
How do you help us buy MDR?
We put one requirement in front of the MDR providers that fit, at the same time, compare their scope and terms side by side, and negotiate before you sign. The provider you choose pays us, so it costs you nothing. Send your endpoint counts and environment, and you'll hear back within 24 hours.
Price Your MDR
Send what needs watching: endpoint and server counts, cloud accounts, identity platform, and how much the provider may do without calling you. Rough numbers are fine. You'll hear back within 24 hours from the person who will run your search. If running detection with your own team is right for you, we will say so. Everything runs by email, so there is no sales call to book.
That is what keeps the providers that fit competing for your business. The provider you choose pays us, so it costs you nothing.
Managed security: managed security services, SOC as a service, managed firewall services, SASE and SD-WAN and the GCC High and CMMC enclave.
Recovery: backup as a service, DRaaS and disaster recovery colocation.
Compliance: compliance colocation, HIPAA compliant hosting and financial services colocation.
The infrastructure being protected: cloud migration services, managed private cloud, the colocation pricing guide, wholesale colocation, the data center lease guide, AI and GPU colocation and data center cost.
