MDR providers are hard to compare because one label covers a 24x7 endpoint alert desk, a managed extended detection platform and an outsourced SOC with authority to act on your identity provider and cloud. Quotes arrive priced per endpoint, per user or per gigabyte, service levels are measured from different starting points, and contracts rarely say what happens when you leave. This vendor-neutral buyer's guide is for security leaders, SOC managers and procurement teams running an MDR selection or renewal. It covers requirements, scoring, the questions that separate providers and a proof of value; the MDR Guide explains how the service works in operation, from response authority to onboarding and exit.
Key takeaways
- Buy coverage, not a sensor count. Decide whether you need endpoint-only, extended or full-scope monitoring, and make the provider name every in-scope source in a schedule.
- Compare service levels by definition. A "15 minute response" may mean an analyst opened the alert or that a host was contained. Contract time to notify and time to contain, with the start timestamp written down.
- Response authority is part of the price. A provider that can only advise costs less and protects you less at 3am. Agree pre-approved actions before comparing quotes.
- The provider becomes a privileged third party. Its analysts, API keys and agents hold standing access to your EDR, identity provider and cloud. Score how it limits and protects that access.
- Negotiate the exit at signature. Data return, deletion, ownership of detection content, agent removal and account revocation are cheapest to agree before go-live.
Define requirements
CISA's reminder that "Outsourcing IT services does not absolve executives of risk management responsibilities" (Risk Considerations for MSP Customers) sets the frame: the requirements document records what you still own. The joint SIEM and SOAR executive guidance adds that outsourcing "can produce visibility gaps, work duplication, and communication difficulties", which a precise scope prevents.
- Scope: counts of workstations and servers by operating system, cloud accounts, SaaS tenants, identity providers and users, plus exclusions such as OT or unmanaged devices.
- Response authority: the actions you will pre-approve, those needing approval, and those the provider must never take. See the MDR Guide for a worked authority matrix.
- Technology position: keep your own EDR and SIEM (bring your own) or adopt the provider's stack. Bring your own keeps telemetry and content in your hands at exit but needs a provider that supports your tools at depth; a provider stack onboards faster but leaving means replacing sensors and possibly losing history.
- Hunting: whether proactive hunting is required. Canada's Cyber Centre contract guidance (ITSM.00.500) asks buyers to check for "proactive threat hunting and reactive incident response capabilities".
- Data: residency, retention, sub-processors and your own copy of logs. CISA advises customers to "maintain their own offsite backups of essential records and network activity logs". Under UK GDPR the provider is usually a processor, so the Article 28 terms in the ICO's contract guidance apply, including audits and return or deletion of data.
- Incident response: where MDR containment ends and full investigation and recovery begin, and whether retainer hours are included. See the Incident Response Guide.
- People and reporting: 24x7 or out-of-hours cover, named contacts, staff location and vetting, and reporting cadence. ITSM.00.500 suggests "monthly performance reports detailing incident detection, response times, and resolution outcomes".
| Scope model | What the provider watches | Gaps to check | Usually fits |
|---|---|---|---|
| Endpoint-only MDR | EDR telemetry on managed workstations and servers | Identity provider, email, cloud control plane, SaaS, unmanaged devices | Small estates where endpoints carry most risk |
| Extended (XDR-based) MDR | Endpoint plus identity, email and cloud through one platform | Depth of support for other vendors' products | Estates standardised on that platform |
| Full-scope (SIEM-based) MDR | Any source the SIEM ingests, including network, SaaS and custom applications | Ingestion cost; who owns the SIEM and its content | Complex or regulated estates |
| Co-managed | Provider works your SIEM and EDR alongside your team | Split of duties; overlapping alerts | Teams with some in-house SOC capability |
| Pricing model | Unit | Watch for |
|---|---|---|
| Per endpoint | Devices with an agent | Server and cloud workload premiums; minimum commitments; containers |
| Per user or identity | Employees or accounts | Whether service accounts, contractors and workload identities count |
| Per data volume | Gigabytes per day ingested | Growth in log volume; who pays the SIEM licence |
| Tiered packages | Service level (alert only, managed response, full) | Hunting, identity, cloud coverage or response held back for the top tier |
| Add-ons | Incident response hours, onboarding, extra modules | Three-year total cost against your growth forecast |
NCSC's guidance on choosing a managed service provider notes that faster response times are likely to cost more; set targets per severity rather than buying the fastest tier for everything.
Evaluation criteria
An illustrative weighting is 25% coverage and response capability, 20% service levels and evidence of detection, 15% provider access security, 15% data handling and exit, and 25% the rest; adjust it to your requirements.
| Criterion | What good looks like | Weak signs |
|---|---|---|
| Coverage and telemetry | Named source schedule; coverage percentage reported monthly; detections for identity, cloud and SaaS as well as endpoints | "We monitor all your data" with no schedule |
| Response actions | Action catalogue across endpoint, identity (revoke sessions, disable accounts), email and cloud; approvals with timeouts; every action logged in your case record | Notify-only for everything; actions only in the provider's own EDR |
| Service levels | Time to acknowledge, notify and contain defined per severity from the detection timestamp; service credits tied to notify and contain | Acknowledgement-only SLAs; self-reported figures with no underlying data |
| Threat hunting | Scheduled and intelligence-led hunts in the base price; findings and new detections reported | "Hunting" means automated indicator sweeps |
| Evidence of detection | Emulation results on your estate; independent evaluations read carefully: MITRE's evaluation of security service providers assessed "their ability to analyze and describe adversary behavior" and states "We don't rank the vendors in our evaluations" (MITRE) | Rankings or "100% detection" claims attributed to evaluations |
| Analysts and escalation | Clear tiers, staff location and vetting, named service manager, escalation quality tracked | Unexplained handovers between regions |
| Transparency | Access to case notes, evidence and the detection logic behind your alerts | Monthly PDFs only |
| Onboarding | Milestone plan; each source validated before go-live; defined tuning period | Go-live declared before telemetry is checked |
| Data handling | Named regions and sub-processors; Article 28 terms; retention you set; no model training on your telemetry without consent | Vague answers on where data and analysts sit |
| Exit | Export formats and timeframes; deletion confirmation; transition support; detections built for you transfer | Data return fees; exit possible only at renewal |
Where identity fits
Two identity questions decide many MDR outcomes. First, can the provider see and act on identity? Intrusions that use stolen credentials, session tokens or service account keys may never touch a monitored endpoint, so an endpoint-only service misses them unless it ingests identity provider and cloud sign-in logs and can revoke sessions or disable accounts. See the ITDR Guide. Second, how does the provider secure its own access to you? ATT&CK T1199 Trusted Relationship notes that "Adversaries may breach or otherwise leverage organizations who have access to intended victims", with menuPass and APT29 among the groups that used managed service provider access. The joint advisory AA22-131A says "Contracts should also require MFA to be enforced on all MSP accounts used to access customer environments" and that "Customers should ensure MSP accounts are not assigned to internal administrator groups." Score providers on named analyst accounts, delegated and time-bound roles (Microsoft's GDAP, for example, gives partners "granular and time-bound access"), scoped and rotated API keys for log ingestion, and an access inventory you can audit. The BeyondTrust breach showed how one stolen API key for a remote support SaaS platform led to a major incident at the US Treasury. See the Third-Party Access Guide.
Questions to ask vendors
- Which of our sources will you analyse, which will you only store, and which will you not touch? Put it in a schedule.
- Which response actions can you take in our EDR, identity provider, email and cloud, and which need our approval? Show a redacted action log from a real case.
- How are time to notify and time to contain defined, from which timestamp, and can we see the data behind the monthly report?
- Is hunting in the base price? How often, driven by what, and what did hunts find for a comparable customer last quarter?
- If we keep our own EDR and SIEM, what do we lose compared with your stack?
- Where are our data and your analysts located, which sub-processors do you use, and does our telemetry train models or feed shared intelligence?
- Which accounts, roles, API keys and agents will you need, with what privileges, and how are they protected and logged? Do your own consoles support SSO and MFA at no additional cost, as CISA's Secure by Demand Guide asks?
- If you are breached, how and when will you tell us? AA22-131A says contracts "should detail how and when MSPs notify the customer of an incident affecting the customer's environment."
- What is included beyond containment, and what does incident response cost after that?
- At exit, what do we get back, in what format, how fast and at what cost, and who owns detections written for us?
Red flags
- Service levels measured from when an analyst picks up the alert, or covering acknowledgement only.
- No ability to act on identity or cloud, only endpoint isolation.
- Requests for Global Administrator or domain admin rights, shared provider accounts, or access without MFA.
- No access to your own data, case notes or detection logic.
- Rankings or detection percentages attributed to evaluations that do not rank.
- Contracts silent on data return, deletion, account removal or the agent uninstall process.
- Service accounts and workload identities counted as billable users without saying so, or hunting and response held back for premium tiers.
Proof of concept
- Set terms first: shortlist two or three providers, agree written success criteria and weights, a 30-day window, and data processing terms signed before any data flows.
- Provision least-privilege access: named accounts with MFA, time-bound delegated roles and read-only API keys with expiry dates, each recorded in your third-party access inventory.
- Connect a representative slice: a few hundred endpoints across operating systems, your identity provider, email, one cloud account and one SaaS application. Ask the provider to confirm which sources are parsed and analysed.
- Emulate attacks in a test segment: announced first, then unannounced. Include T1110.003 Password Spraying, misuse of a cloud account (T1078.004), disabling a cloud log (T1685.002) and suspicious endpoint behaviour. Record time to notify, time to contain and escalation quality.
- Test out of hours: trigger a high-severity scenario at night or at a weekend and check that the provider reaches the right named approver and follows the agreed authority.
- Inspect reporting: request case notes, raw evidence and the monthly metrics with their definitions.
- Exit and roll back: export trial data, revoke every account, role and key, uninstall agents, confirm the provider's access fails and obtain written confirmation of deletion.
Score the trial on measures you can keep in the contract: time to notify and time to contain by severity, percentage of emulated techniques escalated, percentage of escalations your team judged actionable, and percentage of in-scope sources reporting healthy data.
How NHI Mgmt Group can help
We provide independent requirements, RFP and evaluation support. Browse vendors in our products directory or contact us.
Related NHI Mgmt Group resources: MDR Guide · Third-Party Access Guide · Incident Response Guide · ITDR Guide · Log Management and Retention Guide