What Is Managed Detection and Response (MDR), and What Does It Cover?

Executive summary

Managed detection and response (MDR) is a security service in which a provider's analysts watch your devices around the clock, investigate what the software flags and contain confirmed threats on your behalf. The software underneath is usually EDR; what MDR adds is the people who read its alerts at 3 a.m. and act on them. Of the 17 small-business endpoint products Endpoint Index tracks, 3 include 24/7 managed response in the price and 2 sell it as a paid add-on, as of 2026-10-02.

For a small business the deciding question is whether anyone on staff can respond to an alert within the hour, every hour. If nobody can, MDR is the version of endpoint security that gets used.

What does an MDR provider do?

An MDR provider's work follows one loop, repeated all day and night:

1. Monitor. Analysts watch alerts from the agent on every device, 24 hours a day.
2. Triage. They separate real threats from noise. ThreatDown says its MDR team filters out 95% of alerts before they reach the customer.
3. Investigate. They work out what happened, on which machine and how far it spread.
4. Contain. They act on the device directly: isolate it from the network, stop a process, remove malware. ThreatDown lists process termination, endpoint isolation and malware removal; Huntress describes containing the threat and removing the attacker's foothold.
5. Report and advise. You get a written account and the steps left for you, which Huntress calls a remediation plan rather than an alert.

Some providers also hunt for threats the software didn't flag, and some offer to hand the clean-up to your own IT person with guidance instead of doing it themselves. Ask which one you are buying.

What does MDR leave to you?

MDR contains threats. Four jobs usually stay with you or your IT provider:

• Keeping the agent on every device. A laptop without it is invisible to the analysts.
• Acting on the remediation plan: resetting passwords and closing the hole the attacker came through.
• Full incident response after a major breach, when legal or forensic work starts. Most providers sell that separately; ThreatDown keeps root cause analysis and its malware removal service for the higher MDR Plus tier.
• Anything beyond the endpoint. Email filtering and backups are separate products unless the MDR contract names them.

How is MDR different from managed EDR and an MSSP?

The names overlap, and vendors use them loosely:

For pricing, managed EDR and MDR are sold the same way, per endpoint or user a year. The practical difference with an MSSP (managed security service provider) is the response: an MSSP may forward an alert and stop there, while an MDR provider's job is to act. Some MSPs and MSSPs resell a vendor's MDR service, such as Huntress Managed EDR, so ask who employs the analysts. The EDR vs MDR vs XDR comparison covers the software side of the same choice.

Does a small business need MDR?

Start with who answers an alert on a Sunday night. If the honest answer is nobody, buy MDR or managed EDR, because an unread EDR alert doesn't stop an attack. A business with an IT person who watches the console and can act within the hour can run EDR without the managed layer.

If you already pay an MSP, ask whether its contract includes 24/7 monitoring and response and who does the work, before you buy a second service that may duplicate it.

Then agree, in writing, what the analysts may do without asking. Isolating a laptop stops an attack, and it also stops whoever was working on it.

How is MDR sold and priced?

MDR is priced per endpoint or per user, usually for a year, and response figures are mostly marketing rather than contract terms. Huntress publishes an 8-minute mean time to respond and ThreatDown a 19-minute median time to contain, but ThreatDown keeps contract-backed response times for MDR Plus, and Huntress's public pricing FAQ makes no commitment. Minimums are common: Huntress Managed EDR bought direct starts at 50 endpoints.

Many MDR providers sell only by quote. The MDR pricing page lists every provider that publishes a price, per unit a month and a year, alongside the ones that won't say.

Which tracked products include MDR?

3 of the 17 products Endpoint Index tracks include 24/7 managed response in the price. WatchGuard Endpoint Security 360, Webroot Business Endpoint Protection sell it as a paid add-on. The ranking of endpoint protection with managed response compares the bundles on Fit Score, price and terms.

SOC, MSSP, threat hunting and the other terms providers use are defined in our glossary of endpoint security terms.

Frequently asked questions

Methodology and caveats

Product counts come from the 17 endpoint products Endpoint Index tracks, using each product's published capabilities as of 2026-10-02. Descriptions of what providers do are taken from the providers' own pages, quoted where possible; response times are the figures each vendor publishes for its own service and are not independently measured. Service names vary by vendor, so the comparison table describes the usual case, not every contract.

Sources

• ThreatDown, Managed Detection and Response: service activities, alert filtering, median detection and containment times, MDR Plus inclusions.
• Huntress, Managed EDR: human review of alerts, containment, remediation plan.
• Huntress, 24/7 SOC: published mean time to respond.
• Endpoint Index, SMB Endpoint Security Price Index and MDR pricing: prices, minimums and quote-only providers.