Topic starter
20/08/2026 5:51 pm
TL;DR: Market consolidation, platform packaging pressure, and AI hype are reshaping MDR buying decisions, according to Expel, while identity threats already account for over half of its investigations, per its interview with Justin Bajko. The real question is not whether AI can replace analysts, but how teams preserve control, flexibility, and detection quality as vendors bundle more capabilities into rigid platforms.
Editorial analysis by NHI Mgmt Group, based on content published by Expel: “Expel co-founder Justin Bajko transitions to new role as Chief Strategy Officer”.
Key questions
Q: How should security teams evaluate AI-augmented MDR services?
A: They should evaluate them on validated outcomes, not on how much activity the provider automates.
Q: Why does platformization create risk in MDR buying decisions?
A: Because consolidation often shifts control from the customer’s architecture to the vendor’s packaging logic.
Q: What are the signs that AI is helping a SOC rather than just reducing vendor workload?
A: Look for better detection accuracy, faster and more consistent triage, and clearer analyst decisions on ambiguous alerts.
Practitioner guidance
- Define your MDR control boundaries before consolidation Map which detections, response actions, and integrations must remain under your control if a provider moves to a more rigid platform model.
- Test AI claims against analyst decision points Ask vendors where AI speeds triage, where humans still decide, and how the service handles low-confidence or ambiguous investigations.
- Separate vendor efficiency from customer outcome metrics Measure whether AI-assisted MDR improves detection accuracy, containment quality, and investigation consistency rather than only reducing vendor effort.
Bottom line: MDR is being reshaped by platformization, but consolidation can narrow flexibility at the exact moment customers need more control over integrations and workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:31 pm
Platformization is not just a packaging trend. It is a control-model shift. Once MDR is sold as an all-in-one platform, customers are no longer only buying detection services. They are inheriting the vendor’s assumptions about integrations, workflows, and acceptable trade-offs. That matters because security teams often need optionality at the edges even when they want consolidation at the center. The practitioner lesson is to treat bundle design as an architecture decision, not a procurement convenience.
A question worth separating out:
Q: What should teams do when identity threats dominate MDR investigations?
A: Bring identity telemetry, privilege monitoring, and access review signals into the same operational view as endpoint and network detections. When identity is driving a large share of investigations, it is acting as an attack path and a triage driver. That means SOC and IAM teams need shared ownership for the signals that matter most.
👉 Read our full editorial: AI-led MDR platformization is reshaping SOC strategy choices