Published November 11, 2026
Managed detection and response (MDR) is a service in which a provider's security analysts watch an organization's security alerts around the clock. They triage and investigate incidents, then either take containment actions themselves or guide the customer's team through the response. The provider works from telemetry collected by endpoint, identity, cloud, email and network tools, either its own or ones the customer already runs.
Where the market stands
Sophos completed its acquisition of Secureworks on February 3, 2025. The all-cash deal valued Secureworks at about $859 million and brought its Taegis XDR and MDR platform. Sophos announced in October 2025 that Sophos Endpoint is included with all Taegis XDR and Taegis MDR subscriptions. In July 2026 Sophos announced Sophos Fusion, which it calls the evolution of Sophos Central. It set August 15, 2026 for general availability of Sophos XDR, rebuilt on Taegis analytics, and an expanded Sophos MDR. A later Sophos partner notice says both are now generally available, and that Sophos MDR Complete is now Sophos MDR Plus.
BlackBerry completed the sale of its Cylance endpoint security assets to Arctic Wolf on February 3, 2025. It received about $80 million in cash and 5.5 million Arctic Wolf shares at closing. Its filing said it expected about $40 million more in cash on the first anniversary of closing.
Zscaler completed its acquisition of Red Canary on August 1, 2025. Zscaler said Red Canary would initially operate as a separate business unit. Zscaler's MDR page now says Red Canary is part of Zscaler.
LevelBlue completed its acquisition of Trustwave on August 19, 2025, and of Cybereason on November 25, 2025. On January 27, 2026 it announced it would acquire Fortra's Alert Logic MDR business. LevelBlue's site now says Alert Logic MDR and Managed WAF services are part of LevelBlue.
Several vendors renamed or relaunched their services. SentinelOne announced Wayfinder Threat Detection and Response on November 5, 2025, and said it would be generally available that month. Microsoft renamed Defender Experts for XDR to Defender Experts MDR, now its Plan 1. Rapid7 made MDR for Microsoft, a service run on Microsoft Defender, available on January 21, 2026.
Vendor-native and vendor-agnostic MDR
Providers fall into two models.
- Vendor-native. The provider runs the service on its own endpoint platform. CrowdStrike sells Falcon Complete. SentinelOne sells Wayfinder MDR Essentials and Wayfinder MDR Elite. Microsoft's Defender Experts MDR Plan 1 covers Microsoft Defender workloads. Plan 2 adds selected non-Microsoft sources collected in Microsoft Sentinel, such as Okta, Proofpoint TAP, AWS CloudTrail and four network security products. Plan 2 requires Sentinel and at least 1,500 licensed seats.
- Vendor-agnostic. The provider connects to the tools the customer already runs. Expel lists more than 160 integrations and deploys no agent of its own. Arctic Wolf lists more than 200. Since November 2025, Sophos MDR and Sophos XDR subscriptions include third-party integrations across endpoint, firewall, network, cloud, email, identity, backup and productivity tools at no additional cost. Zscaler's MDR isolates endpoints through the customer's EDR and suspends users through the customer's identity provider.
Decide first whether you will keep your current endpoint and SIEM tools. A vendor-native service runs on that vendor's platform. A vendor-agnostic service depends on what your existing tools let the provider do.
Who is allowed to act
Providers differ in what they do without asking. CrowdStrike says Falcon Complete analysts carry out full-cycle remediation on the customer's behalf. Expel says its analysts take containment and remediation actions on the customer's behalf, and its AI executes response workflows after analyst validation. Rapid7 says its responders investigate, contain and fully eradicate threats. Zscaler offers human-in-the-loop controls: the customer's team can initiate specific response actions, or the customer can automate them with no-code playbooks. Microsoft's Defender Experts take action or guide the response on Microsoft Defender workloads. For third-party products under Plan 2, they provide guidance only.
Sophos's warranty names four threat response modes: Notify only, Collaborate, Collaborate with authorize, and Authorize. Its breach protection warranty does not apply under Notify only or Collaborate.
Agree in the contract which actions the provider may take unattended for each class of asset: isolating a host, killing a process, disabling an account. Name the people the provider calls for everything else, and test the call path before go-live.
What the published terms include and cost
These terms are as published on October 17, 2026. None of the six providers below publishes a price for the MDR service itself.
- CrowdStrike Falcon Complete. Priced through sales. Its warranty covers ransomware incidents, up to $1 million for customers with EDR and up to $2 million with EDR and Falcon Identity Threat Protection, calculated at $2,000 per impacted endpoint. Endpoints must stay at Falcon Complete's recommended Measured Security Posture, and internet-facing services need multifactor authentication. The warranty cannot be bought separately.
- SentinelOne. MDR is not included in Singularity Complete, at $179.99 per endpoint per year. It is an add-on to Singularity Commercial, at $229.99, and to Singularity Enterprise, priced through sales. SentinelOne says Wayfinder MDR includes a $1 million breach response warranty. SentinelOne says the prices are in US dollars, apply to 5 to 100 workstations, and that purchases go through partners whose pricing governs.
- Sophos MDR. No published prices. Sophos says confirmed threats are contained and removed with no limits or extra fees. Its breach protection warranty is for MDR Plus subscribers. It pays up to $1,000 per endpoint and $1 million a year in total, with ransomware payments capped at $100,000 per claim, and requires at least $5,000 of out-of-pocket expenses.
- Arctic Wolf. No published prices. Its Security Operations Warranty offers up to $3 million in financial assistance, only with the Total Security Operations Bundle and Aurora Managed Endpoint Defense on a three-year term.
- Rapid7. Asset-based pricing with no published figures. MDR for Microsoft includes unlimited incident response and 13 months of data retention as standard.
- Microsoft Defender Experts MDR. Sold separately from Defender products, with no published price. It does not provide incident response for an active compromise and does not cover Microsoft Defender for Cloud workloads. Under Plan 2 the customer still owns Sentinel connectors, retention and ingestion costs.
Ask every provider for a quote that separates the service fee, the agents or sensors, log ingestion and retention, incident response hours and the warranty. Read each warranty's conditions against how you will configure the service.
Reporting deadlines the contract must meet
Under SEC rules adopted on July 26, 2023, a US public company's Form 8-K Item 1.05 disclosure of a material cybersecurity incident is generally due four business days after it determines the incident is material.
The EU's NIS2 Directive requires essential and important entities to send an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours of becoming aware, and a final report within one month of that notification.
Write into the contract how fast the provider must tell you about a confirmed incident, and what evidence it hands over. Your reporting clock may start with that call.
What onboarding requires
- Define which assets and data sources are in scope, and confirm incident response, warranty and retention terms in the contract.
- Connect endpoint, identity, cloud, email and network sources, and check that the provider receives and parses each one.
- Set the response mode for each asset class and record the escalation contacts.
- Trigger a benign but suspicious technique on a test host. Time how long the provider takes to call, and check what it does.
- Hold regular service reviews, and retest response and offboarding as the estate changes.
Ask how you leave: which logs, detections and case history you take with you, and in what format.
Questions to settle first
Settle these before choosing a provider.
- Will you keep your current endpoint and SIEM tools, or adopt the provider's?
- Which actions may the provider take at 3 a.m. without calling you?
- Does the provider handle a full incident response, or hand off to a separate team or retainer?
- Who owns the provider now, and what does its owner's roadmap mean for your contract term?
- Which reporting deadlines apply to you, and does the provider's notification time leave room to meet them?
Ask to contribute
Vendors in this market can ask to answer the six questions for State of Play 2026: Managed Detection and Response. Use an email address on your company’s own domain: answers come from the company itself, not from an agency. We email a link to confirm the request.