Executive Summary
Choose an MDR provider on two things: whose tools it watches, and what it may do to stop an attack before anyone on your team picks up the phone.
A managed detection and response (MDR) service is a security operations team you rent. The provider monitors your endpoints, identities, cloud accounts and other systems around the clock, investigates what looks suspicious, and contains confirmed threats. Choose a provider on two things: whose tools the service runs on, and which response actions it may take without waiting for your approval. Price comes third, because the unit each provider counts decides how the bill grows.
The providers differ most in what they connect to. Endpoint vendors run the service on their own agent. Other providers connect to the endpoint, identity, cloud and network tools you already own, or bring their own platform. A few sell MDR together with vulnerability management or with a network security platform. Each route changes what the provider can see and what it can act on.
MDR is priced on a count of what the provider protects, and the unit differs by provider: endpoints and servers, users, or packages built around them. Send every shortlisted provider the same inventory of devices, users, cloud accounts and log sources, and ask for a written quote that names what is included, what is capped and what is extra.
What an MDR Provider Does, and What Stays With You
An MDR provider takes over the round-the-clock work of watching alerts, deciding which are real and acting on the real ones. Zscaler states that MDR doesn’t replace your existing SOC, and that MDR complements and enhances your existing SOC. The provider runs detection and first response. Your team still owns the incident: who is told, what the business does while systems are down, and what is said to customers and regulators.
Incident response planning stays with you. NIST publishes SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile. NIST states that the publication seeks to assist organizations with incorporating cybersecurity incident response recommendations and considerations throughout their cybersecurity risk management activities as described by the NIST Cybersecurity Framework (CSF) 2.0. Write the provider into your plan: what it may do alone, whom it calls, and what evidence it hands over.
Detection coverage has a shared vocabulary. MITRE describes ATT&CK as a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. MITRE states that ATT&CK is open and available to any person or organization for use at no charge. Ask each provider to map its detections for your environment to ATT&CK techniques, then compare the gaps rather than the totals.
Response authority is the decision that matters most. Containment means isolating a host, disabling an account or blocking a domain. Each provider lists the actions it can take; your contract should list the actions it may take, for each class of asset, and the ones that need a call first. Keep domain controllers, production databases and executives’ laptops on the call-first list until the provider has shown how it works.
Several providers have changed owners. Zscaler announced that it has completed its acquisition of Red Canary. Sophos and Secureworks announced the completion of Sophos’ acquisition of Secureworks. Ask a provider that has changed owners which platform your contract runs on, and for how long that platform will be supported.
Warranties come with conditions. Arctic Wolf offers its Security Operations Warranty, financial assistance for cybersecurity incidents, when you purchase the Total Security Operations Bundle as well as Aurora Managed Endpoint Defense on a three-year term. Before a warranty counts in a comparison, read which bundle and term it requires and what voids it.
Build a SOC, Buy MDR, or Share the Work?
A security operations center that runs 24 hours a day needs enough analysts to cover every shift, holiday and sick day, plus people who write detections and people who lead incident response. If you cannot staff that, buy the service. If you can staff business hours but not nights and weekends, buy MDR for the hours you cannot cover and keep your team on escalations.
If one endpoint platform runs on nearly every device, that vendor’s own MDR uses the agent you already deployed. CrowdStrike states that Falcon Complete analysts deliver full-cycle remediation on your behalf, combining AI, automation, and human judgment to contain threats and restore your environment to a known-good state. The trade is dependence: the service and the tool become one decision at renewal.
If you run several vendors’ tools and intend to keep them, a provider that connects to them avoids replacing anything. eSentire states that you can Bring Your Own License (BYOL) or partner with eSentire for a fully managed MDR solution. Response then depends on what each tool lets the provider do, so test response actions tool by tool.
Co-managed MDR is the third path: your team works the day, the provider covers the rest, and both use the same console. Expel states that it can pull your data into Workbench or manage your SIEM entirely. Agree who owns detection rules and who approves tuning, or both sides will change them.
| Your situation | Start with | What to test |
|---|---|---|
| One endpoint platform deployed on nearly every device | That endpoint vendor’s own MDR service | Response outside the endpoint: identity, cloud and email |
| Several security vendors you intend to keep | A provider that connects to your existing tools | Which response actions each integration supports |
| Few security tools and a small IT team | A provider that supplies its own agent or platform | What you must deploy, and what happens to it if you leave |
| An in-house SOC that covers business hours | Co-managed MDR for nights, weekends and surges | The hand-off between shifts, and who owns detection rules |
| A zero trust or network security platform already in place | MDR from that platform’s vendor | Coverage of endpoints and cloud beyond the platform’s own data |
How do you evaluate Managed Detection and Response (MDR) Services?
Start with what the provider can see. Arctic Wolf states that its Aurora Superintelligence Platform features an open XDR architecture to plug into your current telemetry, with 200+ integrations across attack surfaces. Expel lists 160+ integrations, including AWS, CrowdStrike, Google, Microsoft, Okta, Palo Alto, SentinelOne, Splunk, Salesforce and Wiz. A count says little. Ask for the list of your own products, and which of them the provider can act through rather than only read from.
Response actions decide the outcome. eSentire lists 24/7 threat response and remediation including host isolation, hash blocking, account suspension, retroactive email purges and system reboots. Zscaler lists the ability to automatically block URLs and IoCs via ZIA, isolate endpoints via EDR, and suspend users via your IDP. Arctic Wolf states that it contains threats through Agentic SOC response with humans in the loop. Write the approved actions into the contract for each class of asset, and say which ones need a call first.
Ask where monitoring ends and incident response begins. Sophos lists critical incident response in which threats are fully removed, not just contained, with no hourly caps. Rapid7 states that its responders investigate, contain, and fully eradicate threats, with engagement without caps. eSentire includes unlimited threat hunting and unlimited incident handling in its foundational MDR solution. Then ask whether forensics, rebuilding systems, and support for legal and notification duties are included or sold separately.
You should be able to see what the analysts did. Expel surfaces outcome metrics in real time through Expel Workbench, including mean time to detect, mean time to respond, alert volume by source, true positive rate, and auto remediation actions executed. Ask every provider for the same measures, defined the same way: from alert to analyst, from analyst to containment, and from containment to your phone ringing.
Agree how much the provider’s AI may do on its own. Ask which alerts it may close without a person, which actions it may take without a person, and how an analyst reviews both. Ask for the share of your alerts closed automatically each month.
| Capability | What to ask | Evidence to request |
|---|---|---|
| Coverage | Which of our endpoint, identity, cloud, email and network products do you read, and which can you act through? | The integration list, marked read-only or response-capable |
| Response authority | Which actions do you take without calling us, and how is that set per asset class? | The response policy you will sign, with examples |
| Speed | How do you measure time from alert to analyst, and from analyst to containment? | Monthly figures from a customer of our size, anonymized |
| Incident response | What is included after containment, and where are the caps? | The service description, with forensics and recovery called out |
| Threat hunting | How often do you hunt in our environment, and what do we receive? | A sample hunt report |
| Transparency | Can we see every investigation and action as it happens? | Access to the console during the trial |
| Exit | What data and detections do we keep if we leave, and in what format? | The offboarding clause and a sample export |
Vendors in Managed Detection and Response (MDR) Services
Representative vendors include Arctic Wolf, CrowdStrike Falcon Complete, eSentire, Expel, Rapid7, Red Canary (Zscaler MDR), SentinelOne and Sophos MDR. The list is alphabetical, is not a ranking, and is not for sale. How we choose vendors
The approaches below follow two questions: whose platform does the service run on, and what does it connect to? Those answers separate the providers more than feature lists do.
Two endpoint vendors run MDR on their own platforms. CrowdStrike states that Falcon Complete analysts correlate Falcon platform telemetry across endpoints, identities, AI agents, cloud, SaaS, and third-party data. SentinelOne states that Wayfinder TDR combines managed detection and response, threat hunting, and incident readiness into one unified framework. SentinelOne states that every service is delivered through the Singularity Platform by the same team of elite analysts, threat hunters, and incident responders. SentinelOne lists 24/7 expert monitoring, investigation, and response across endpoints, cloud, and identity, with a breach response warranty.
A security product vendor can also run MDR on other vendors’ tools. Sophos states that Sophos MDR is trusted by organizations running Microsoft, CrowdStrike, SentinelOne, and other vendor environments. Sophos states that Sophos MDR is backed by a breach protection warranty and operates nine regional security operations teams for global coverage. Sophos offers Taegis MDR, powered by Secureworks, as part of the Sophos portfolio for organizations requiring an enterprise-grade MDR service.
Two providers bring their own platform and connect it to what you run. Arctic Wolf states that every customer receives the Arctic Wolf Concierge Experience with security experts that understand the organization’s environment, priorities, and risks. eSentire states that the Atlas Platform connects to any signal, whether that's endpoint, network, logs, cloud, vulnerability scanner, browser, or identity provider.
One provider ties detection to vulnerability data. Rapid7 states that Rapid7 MDR is designed to anticipate where attackers are likely to succeed and disrupt them by combining exposure context, detection, and response into a single operational loop. Rapid7 states that Rapid7 MDR is delivered on Rapid7’s SIEM.
Another works only through the tools you own. Expel states that it is vendor-agnostic and works with the security technology you already own, with no rip-and-replace required.
The last approach comes from a network security vendor. Zscaler announced that it has completed its acquisition of Red Canary. Following the close of the acquisition, Red Canary will be branded as Red Canary, a Zscaler company. A request for redcanary.com is answered by zscaler.com. Zscaler states that Zscaler MDR unifies data from AWS, GCP, Azure, and leading cloud security tools like Wiz to detect and stop cloud threats before impact.
| Vendor | Approach | Where it fits |
|---|---|---|
| Arctic Wolf | Concierge MDR on an open XDR platform | The Concierge Experience on the Aurora open XDR platform |
| CrowdStrike Falcon Complete | Endpoint vendor’s own MDR | 24/7 MDR on the Falcon platform, with full-cycle remediation on your behalf |
| SentinelOne | Endpoint vendor’s own MDR | Wayfinder TDR: MDR, threat hunting and incident readiness on the Singularity Platform |
| Red Canary (Zscaler MDR) | MDR from a zero trust platform vendor | Red Canary, now a Zscaler company, sold as Zscaler MDR with Zscaler Internet Access data |
| Expel | MDR on the tools you already own | Vendor-agnostic MDR with investigations and metrics visible in Expel Workbench |
| Rapid7 | MDR with exposure management | MDR on Rapid7’s SIEM with exposure context, priced by endpoints, servers and networks |
| eSentire | Multi-signal MDR with response included | The Atlas Platform across any signal, with unlimited threat hunting and incident handling |
| Sophos MDR | Security suite MDR on any stack | MDR across Sophos and other vendors’ tools, with Taegis MDR for enterprise needs |
The eight providers from the previous edition stay, each placed in one of seven approaches that were written before any row was filled; two endpoint vendors share the first. No row here is for sale. The field is wider, including MDR from managed service providers and from cloud and identity vendors, and any provider can make its own case in the Spotlight below.
How Is Managed Detection and Response Priced?
MDR is priced on a count of what the provider protects, and the unit differs by provider. Rapid7 states that Rapid7 MDR pricing is based on the number of endpoints, servers, and networks it protects, not by data volume ingested into its SIEM nor the number of incidents requiring response. eSentire’s SOC Pricing Calculator takes your number of users and calculates SOC pricing as part of the eSentire MDR service against the cost of building an internal SOC. eSentire defines users as any employee or person acting on your behalf who utilizes a computer, network service, application, or other asset which is under the protection and monitoring of the SOC. Expel states that the per-endpoint pricing model has become standard in the MDR industry.
Published list prices cover endpoint software more often than the managed service. CrowdStrike lists Falcon Enterprise at $184.99 per device, billed annually. CrowdStrike lists Falcon Complete, 24/7 expert-led, AI-accelerated managed detection and response (MDR), with the CrowdStrike Breach Prevention Warranty and a Contact sales option. SentinelOne lists Singularity Commercial at $229.99 per endpoint per year, with Managed Threat Hunting for proactive threat discovery among its features. Managed threat hunting in a software tier is not a 24-hour MDR service, so ask what each price includes.
Packages change what the same count buys. Rapid7 lists three MDR packages: Essential, Advanced and Ultimate. Compare packages line by line for incident response, third-party tool coverage, data retention and advisory time, and price the package that includes what you need rather than the entry tier.
The first-year quote rarely shows the full cost. Expel lists limited native integrations that require custom development, data ingestion charges beyond certain thresholds, premium pricing for less common tools, and professional services fees for complex setups, none of which typically appear in the initial proposal. Ask for multi-year pricing that includes every integration and log source you plan to connect, and the unit price at the size you expect in year three.
| Meter | You are charged for | Grows with | Where it goes wrong |
|---|---|---|---|
| Endpoints or assets | Each protected workstation, server or device | Hiring, servers and virtual machines | Short-lived cloud instances counted as assets |
| Users | Each person whose accounts and devices are monitored | Headcount and contractors | Contractors left out of the count |
| Data sources or volume | Integrations connected or log data ingested | New tools and log sources | Ingestion charges beyond a threshold |
| Service package | More advisory time, hunting or response | Program maturity | Response or forensics only in the top package |
| Incident response | Hands-on work after containment | Number and size of incidents | Hourly caps or a separate retainer |
| Endpoint software | The agent the service runs on | Endpoint count | Left out when comparing with a provider that uses your agent |
Onboarding and the First 90 Days
Most onboarding work is yours: listing assets, connecting sources and deciding what the provider may do. Give it an owner and a date, and do not count the service as live until a test incident has run end to end.
List devices, users, cloud accounts and log sources in scope. Agree the response actions the provider may take without a call, for each class of asset. Name the escalation contacts and out-of-hours numbers, and confirm what the contract says about incident response and data retention.
Deploy any agent the service needs. Connect identity, cloud, email and network sources, and confirm with the provider that each one arrives and is parsed. Record the devices that cannot run the agent and decide how they are covered.
Suppress known-good activity with the provider, so alerts that reach you are worth a call. Run harmless test techniques on a test host and time the detection, the call and the containment. Rehearse the escalation path out of hours.
Review the provider’s metrics each month and the response policy each quarter. Repeat the test after major changes to your environment, and check the offboarding terms before each renewal.
What should you ask vendors about Managed Detection and Response (MDR) Services?
Ask each provider to answer in writing and to show the timeline of a real incident, with names removed.
-
Is one endpoint platform deployed on nearly every device?Yes Shortlist that vendor’s own MDR, and test response outside the endpoint.No Shortlist providers that connect to your existing tools, and test response through each tool.
-
May the provider contain threats without calling you first?Yes Write the approved actions for each class of asset into the contract.No Expect containment to wait for your on-call engineer, and staff that rota.
-
Do you already hold an incident response retainer?Yes Agree how your retainer firm and the provider’s responders hand over.No Prefer a provider whose base service includes incident handling, and read its limits.
RFP packages are a separate paid product. Vendors do not pay to appear in buyer guides.