Best 10 MDR Solutions For MSPs (2026)
We reviewed 10 MDR services for MSPs on partner billing, multi-tenant management, EDR integrations, what the SOC can do without your approval, and how incidents reach your PSA.
Written by
Caitlin Harris
Most remote management tools cover every client you look after under one roof. While this does reduce management overhead, it also means that if you miss an alert, multiple businesses could feel the impact. To solve that problem in-house, you’d need to hire a team of analysts to swiftly investigate and act on alerts on every shift, every day of the year—which is unfortunately too costly for many MSPs.
Managed detection and response (MDR) services let you offer your clients a vendor’s 24/7 analysts, who investigate alerts and act to stop attacks. Some work by responding to alerts from EDR tools that your clients already run, such as Microsoft Defender for Endpoint; others let you define which actions the SOC can take without approval for each client, such as isolating a device or disabling an account. MDR services also differ in how alerts reach your PSA system as tickets, what reports you can share with clients, and how partners are billed.
We’ve put together this guide to the top MDR services for MSPs to help you navigate these differences and find the right solution for your team and your clients. We looked at partner billing, EDR integrations, multi-client management, approvals/permissions for analyst response actions, PSA ticket integration, and the reports you can share with your clients.
What is MDR for MSPs?
MDR for MSPs is a 24/7 security service that lets an MSP offer round-the-clock threat response without hiring and running its own security operations center (SOC). The vendor's analysts monitor client devices and accounts, check whether alerts are real attacks, and act to stop them, for example by cutting an infected laptop off the network. With some services, the MSP handles all communication with the client during an incident.
MDR services collect activity data from client devices through an endpoint detection and response (EDR) agent. Some require the vendor's own agent; others work with the EDR product a client already runs, so the MSP doesn't have to replace it. Many also monitor cloud email and identity accounts, firewalls, and cloud workloads. When the analysts detect a threat, they respond to it (for example, by isolating a device or disabling a compromised account) within parameters agreed with the MSP in advance. The key question for an MSP is what the SOC can do without its approval, and whether it can set those permissions for each client.
MDR services for MSPs offer a multi-tenant console that keeps each client's data separate, while letting the MSP's team manage every client from one place. They integrate with PSA tools to turn incidents into tickets in the system the MSP already works from, and they offer reports that show each client what the SOC found and what it did.
Managed Detection and Response Solutions for MSPs Compared
A high-level comparison of the 10 MDR services for MSPs reviewed in this guide.
| Product | Best For | Works with Third-Party EDR | Microsoft 365 / Identity Response | White-Label Client Reports | PSA Ticket Integration | Monthly or Usage-Based Partner Billing |
|---|---|---|---|---|---|---|
|
Blackpoint Cyber MDR
|
MSPs that want a 24/7 SOC to remediate client threats
|
Yes
|
Yes
|
No
|
Yes
|
Yes
|
|
Arctic Wolf Aurora MDR Connect
|
MSP-led remediation backed by Arctic Wolf's SOC
|
Yes
|
Yes
|
No
|
Yes
|
No
|
|
Bitdefender MDR for MSPs
|
Per-client pre-approved response actions
|
No
|
Yes
|
No
|
Yes
|
Yes
|
|
ConnectWise Managed EDR
|
A 15-minute response SLA backed by service credits
|
Yes
|
Yes
|
No
|
Yes
|
No
|
|
CrowdStrike Falcon Complete
|
White-labeled MDR with fully managed remediation
|
No
|
Yes
|
Yes
|
No
|
No
|
|
Huntress Managed EDR
|
Published per-endpoint pricing and broad PSA support
|
No
|
Yes
|
Yes
|
Yes
|
Yes
|
|
Kaseya MDR
|
MSPs running the Kaseya and Datto stack
|
Yes
|
Yes
|
No
|
Yes
|
No
|
|
N-able MDR
|
Combined MDR and SIEM
|
Yes
|
Yes
|
No
|
Yes
|
No
|
|
Sophos MDR
|
Working with clients' existing security tools through 500+ integrations
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
|
Todyl MXDR
|
Consolidated SASE, endpoint, ITDR and SIEM on one agent
|
No
|
Yes
|
No
|
Yes
|
No
|
How We Tested
Expert Insights evaluated 10 MDR services that MSPs can sell to their clients. We tested each one hands-on, looking at partner billing, support for the EDR tools clients already run, multi-client management, what the provider’s analysts can do without the MSP’s approval, how incidents reach the MSP’s PSA, and the reports MSPs can share with clients. This guide was researched and written by Joel Witts and technically reviewed by Mirren McDade. Read our full methodology
Blackpoint Cyber MDR
Blackpoint Cyber
Best for MSPs that want a 24/7 SOC to remediate client threats
Blackpoint Cyber MDR is a 24/7 managed detection and response (MDR) service built for MSPs and MSSPs, founded by former NSA cybersecurity experts.
Blackpoint’s security operations center (SOC) takes ownership of threats across your clients’ endpoints and cloud accounts, investigating, containing, and remediating them. Live security experts are reachable by phone around the clock, and you get a dedicated overwatch manager.
Blackpoint delivers MDR through CompassOne, where the Tenant Administrator console gives you one dashboard to manage every client environment, billing, and risk.
The SOC also responds to Microsoft Defender for Endpoint and Defender for Business alerts, and SOC alerts can open tickets in ConnectWise Manage, Autotask, and HaloPSA.
- Live security experts reachable by phone and a dedicated overwatch manager, 24/7
- Lightweight, proprietary endpoint agent with no SIEM required
- Microsoft 365 account protection; Blackpoint says it disrupted a compromised account every 18 minutes on average in 2025
- Application control and vulnerability scanning
- SIEM with 365 days of log storage on the Standard package
- Security Posture Rating aligned with the NIST Cybersecurity Framework
We think Blackpoint is a strong fit for MSPs that want a SOC to take full ownership of client incidents, around the clock and managed from one console.
We also like that CompassOne lets you add more services as clients grow. ITDR, vulnerability management, application control, and SIEM logging all run on the same platform, with no extra vendor to bring in.
If you want an MDR service built for MSPs, with identity response and room to add more services from the same console, Blackpoint is well worth considering.
Strengths
Cautions
Arctic Wolf Aurora MDR Connect
Arctic Wolf
Best for MSP-led remediation backed by Arctic Wolf's SOC
Arctic Wolf Aurora MDR Connect is a managed detection and response service that Arctic Wolf sells only to MSPs. Arctic Wolf doesn’t deal directly with your clients; they run the security operations center (SOC) that triages and responds to alerts on the MSP’s behalf, while you manage your client relationships and service delivery, including remediation.
Aurora MDR Connect has more than 250 built-in integrations, and Arctic Wolf’s analysts can take response actions within your clients’ EDR tools, in Microsoft Entra ID, and in Microsoft 365, where they can delete malicious emails.
There’s no network sensor to ship or install, and Arctic Wolf says MSPs can deploy the service within hours. It’s available in the US, Canada, EMEA, and Australia and New Zealand.
- Arctic Wolf’s SOC triages and responds to alerts for each client on your behalf
- More than 250 built-in integrations with other third-party security tools
- Analysts can contain hosts through SentinelOne, CrowdStrike Falcon, Microsoft Defender for Endpoint, and other EDR tools
- In Microsoft Entra ID, analysts can disable users, close their sessions, and force password resets
- Incident tickets sync between Arctic Wolf and ConnectWise
- The MSP Portal produces a monthly executive summary of tickets for each client
- Partners get volume-based pricing from their first deal, with deal minimums that step up as volume grows
- A one-year data retention add-on is available
We think Aurora MDR Connect is a strong option for MSPs that want Arctic Wolf’s SOC working on their clients’ alerts while they keep full ownership of the client relationship. Arctic Wolf’s analysts handle triage and response, and your team handles remediation and every conversation with the client.
Something to be aware of is that, because remediation stays with your team, you need technicians ready to act on what the SOC finds. Also, to be able to access this service, you’ll need to pass Arctic Wolf’s technical validation and complete its MSP training program.
If you have the staff to handle remediation and want an outsourced SOC behind your own MDR service, we recommend considering Aurora MDR Connect.
Strengths
Cautions
Bitdefender MDR for MSPs
Bitdefender
Best for per-client pre-approved response actions
Bitdefender MDR for MSPs is a 24/7 managed detection and response service. The service is sold as the GravityZone MSP Secure Plus package and runs on Bitdefender’s own EDR. You can switch it on for each of your clients in the GravityZone console, and you have to enable Bitdefender EDR for each client. Once enabled, it covers Windows workstations and servers, Linux, and macOS. The Secure Extra package adds detection and response for user identities and productivity apps.
Bitdefender’s SOC responds to threats using actions you approve in advance for each client, such as isolating a host or deleting malicious files. Analysts also hunt for threats including fileless malware, lateral movement, and attacks that misuse tools already on the system.
Bitdefender bills you monthly on usage, with no minimum commitments, and you can combine usage across all your clients for volume pricing.
- You choose the response actions Bitdefender’s SOC can take for each client without waiting for your approval
- Pre-approved actions include isolating a host, deleting an email, disabling a user, forcing a password reset, and blocking an IP address
- Onboarding sets a security baseline for each client before the service goes active, and usage is counted from that point
- A multi-tenant dashboard lets you manage all your clients from one place
- The MDR Portal gives you live dashboards, monthly reports, and investigation reports
- Optional XDR sensors extend detection to the network, cloud services, productivity apps, and identities
- GravityZone integrates with RMM and PSA tools including ConnectWise, Kaseya, NinjaOne, Atera, and HaloPSA, and opens ConnectWise PSA tickets for EDR events
We think Bitdefender MDR for MSPs is a strong option for MSPs that already use GravityZone for their clients’ endpoint security, or plan to standardize on it. We like that you set the SOC’s pre-approved actions client by client, so each client gets the level of hands-on response it has agreed to.
The usage-based monthly billing with no minimums also makes this service suitable for MSPs that add clients gradually.
Something to be aware of is that the service requires Bitdefender’s EDR on every client, so clients running another vendor’s EDR would need to move to GravityZone first.
Strengths
Cautions
ConnectWise Managed EDR
ConnectWise
Best for a 15-minute response SLA backed by service credits
ConnectWise Managed EDR (formerly ConnectWise MDR) is a managed detection and response service for MSPs. It pairs the EDR tool you choose (Bitdefender, Microsoft, or SentinelOne EDR) with a fully staffed ConnectWise SOC that continuously monitors, detects, and responds to threats. It also protects your clients’ Microsoft 365 environments.
ConnectWise commits to addressing verified incidents within 15 minutes, and gives service credits if it misses that commitment. The commitment covers detection, analysis, triage, and, where appropriate, containment and remediation, and applies with specific EDR vendors.
- MSPs choose Bitdefender, Microsoft, or SentinelOne as the EDR tool behind the service
- ConnectWise addresses verified incidents within 15 minutes, with service credits if it misses that target
- The SOC handles detection, analysis, triage, containment, and remediation
- One dashboard gives you visibility across your security tools and client tenants
- The service includes protection for Microsoft 365 environments
- ConnectWise PSA creates and syncs tickets for incidents the SOC works on
- The Threat Analysis Report explains incidents in terms your clients can understand
- ConnectWise also sells Managed EDR in Modern Threat Protection, a bundle with ConnectWise SIEM and ConnectWise Email Security
ConnectWise’s 15-minute commitment backed by service credits really stands out, and it makes this service a strong option for MSPs that want a guaranteed response time they can build their own client agreements around.
We also like that you can keep the EDR your clients already run, if it’s one of the supported tools. ConnectWise also sells ConnectWise PSA to MSPs, and Modern Threat Protection lets you add SIEM and email security from the same vendor. Something to be aware of is that the 15-minute commitment only applies with specific EDR vendors, so check which tools your clients use first.
Strengths
Cautions
CrowdStrike Falcon Complete
CrowdStrike
Best for white-labeled MDR with fully managed remediation
CrowdStrike Falcon Complete is an MDR service run by CrowdStrike’s own SOC on its Falcon platform. Through Falcon Complete for Service Providers, you can deliver the service to clients under your own brand or co-branded with CrowdStrike. You keep full ownership of the customer relationship, while CrowdStrike’s analysts provide 24/7 protection and carry out full remediation on your behalf.
Falcon Complete pulls together Falcon platform data from endpoints, identities, AI agents, cloud workloads, and SaaS apps, along with data from third-party tools. Analysts can also contain threats that involve compromised user identities.
- Sell the service white-labeled or co-branded with CrowdStrike
- You keep full ownership of your customer relationships
- CrowdStrike’s analysts carry out full remediation on your behalf
- Analysts contain threats involving compromised user identities
- The service correlates data from endpoints, identities, AI agents, cloud, SaaS, and third-party sources
- Falcon Complete is backed by warranty coverage of up to $2 million
- The program is open to MSPs, MSSPs, system integrators, and global system integrators
We think Falcon Complete stands out for its white-label and co-brand options, as well as CrowdStrike’s commitment to carry out full remediation for you.
CrowdStrike also sells Falcon endpoint protection plans and Next-Gen SIEM on the same platform, so MSPs that standardize clients on Falcon can buy more of their security stack from one vendor.
Something to be aware of is that Falcon Complete runs on CrowdStrike’s own Falcon agent. CrowdStrike’s service provider pages don’t cover support for clients’ existing third-party EDR tools, PSA ticketing, or partner billing terms, so ask about all three before you sign.
Strengths
Cautions
Huntress Managed EDR
Huntress
Best for published per-endpoint pricing and broad PSA support
Huntress Managed EDR is a managed endpoint detection and response service built for MSPs and organizations without a dedicated security team. It pairs a lightweight agent for Windows, macOS, and Linux with a 24/7 AI-centric, human-led SOC.
With Huntress’s service, you manage all your clients from the Huntress partner portal. The agent can run alongside existing antivirus and EDR products, including Microsoft Defender and SentinelOne, and Huntress manages Microsoft Defender Antivirus at no additional cost.
- 24/7 SOC monitors and responds to threats on Windows, macOS, and Linux endpoints
- The agent runs alongside Microsoft Defender, SentinelOne, and other antivirus and EDR products
- Huntress manages Microsoft Defender Antivirus at no additional cost
- The partner portal lets you manage every client organization in one place
- PSA integrations cover ConnectWise Manage, Autotask, Syncro, Kaseya BMS, and HaloPSA
- You can add your own company branding to Huntress reports
- MSPs get free not-for-resale (NFR) licenses through the Huntress Neighborhood Watch program
We think Huntress Managed EDR is a very strong option for MSPs that want a managed EDR service that’s straightforward to roll out through the RMM tools they already use, and that doesn’t need an in-house security analyst to run it.
Something to be aware of is that identity and email protection for Microsoft 365 and Google Workspace is a separate Managed ITDR subscription.
Strengths
Cautions
Kaseya MDR
Kaseya
Best for MSPs running the Kaseya and Datto stack
Kaseya MDR (formerly RocketCyber) is a managed detection and response service for MSPs. Kaseya’s 24/7 SOC, with teams in Florida and Ireland, monitors and responds to threats across endpoints, firewalls, and Microsoft 365, with AI-augmented, human-led threat detection and response.
Kaseya MDR works with Kaseya’s own Datto AV and Datto EDR as well as third-party EDR tools. It uses the same agent as RocketCyber, and existing RocketCyber customers can move to Kaseya MDR at no additional cost.
Kaseya sells the service on its own, priced per endpoint, and includes it in the Kaseya 365 Endpoint Pro bundle.
- Kaseya’s 24/7 SOC covers endpoints, firewalls, and Microsoft 365
- The service works with Datto AV, Datto EDR, and third-party EDR tools
- Analysts can kill malicious processes and isolate devices individually or in bulk
- You can customize Microsoft 365 detection and automated response rules
- Detected threats are sent directly into your PSA as tickets
- You set default policies once and override them for individual client organizations
- Reports help you show clients and stakeholders the value of the service
- Kaseya MDR runs alongside RocketCyber, so you can move clients over without a forced migration
We think Kaseya MDR is a strong option for MSPs that serve SMB clients and already run Kaseya’s IT management tools. Threats arrive in your PSA as tickets, and the service connects to Kaseya’s RMM, PSA, backup, and Datto endpoint security products, so your technicians can work incidents in tools they already use.
MSPs already on the Kaseya 365 Endpoint Pro bundle get MDR as part of it.
Something to be aware of is that Kaseya doesn’t publish its per-endpoint price, so you’ll need a quote to work out your margin.
Strengths
Cautions
N-able MDR
N-able
Best for combined MDR and SIEM
N-able MDR, powered by Adlumin, is a managed detection and response service that gives MSPs 24/7 SOC coverage for their clients. It runs on the Adlumin platform, which combines extended detection and response (XDR) with log collection and search (SIEM), and N-able’s SOC monitors across the security tools your clients already use.
- N-able’s 24/7 SOC monitors the security tools your clients already run
- Supported EDR tools include CrowdStrike, SentinelOne, Sophos, Bitdefender GravityZone, Huntress, and Webroot
- Automated playbooks can isolate endpoints, disable user accounts, and enforce password resets
- One multi-tenant view covers endpoints, identities, networks, and cloud services for every client
- Per-tenant reports cover detections, compliance, and security posture
- Incidents open as tickets in ConnectWise Manage, and clients with identity threat detection (ITDR) enabled can also connect to HaloPSA, Autotask, and MSP Manager
- Partners create new client tenants themselves, without a support request
- Every deployment comes with a $100,000 cyber warranty
We think the combination of managed response with SIEM log collection on one platform is a real strength of N-able MDR. You get a SOC watching your clients’ existing security tools, plus the log data to investigate what happened, without piecing together separate products.
The included $100,000 cyber warranty is also a useful extra, but it’s important to note that the higher warranty of up to $500,000 is only included with the Adlumin Protection Plus suite.
Strengths
Cautions
Sophos MDR
Sophos
Best for working with clients' existing security tools through 500+ integrations
Sophos MDR is a 24/7 managed detection and response service that MSPs can resell alongside the rest of the Sophos portfolio. It works with Sophos’s own security products and with other vendors’ tools, including Microsoft, CrowdStrike, and SentinelOne, through more than 500 integrations, and it’s validated for Microsoft Defender for Endpoint and Defender for Business.
- Sophos’s 24/7 SOC monitors and responds to threats in Sophos and third-party environments
- More than 500 integrations cover tools from Microsoft, CrowdStrike, SentinelOne, and other vendors
- In Microsoft 365, analysts can block user sign-ins, end sessions, and disable suspicious inbox rules
- Sophos Fusion (formerly Sophos Central) lets you manage all client environments from one multi-tenant console
- PSA and RMM integrations cover ConnectWise PSA, Autotask PSA, ConnectWise Automate, and Kaseya VSA
- A quarterly security posture report helps you show clients the value of the service
- You can add your own logo to Endpoint and Server PDF reports and the Self Service Portal
- The MSP Flex program bills partners monthly for combined usage across all clients
- Backed by a breach protection warranty
We were impressed by the number of integrations Sophos MDR offers, which means you can use this service on top of most clients’ existing security tools without a rip-and-replace. The monthly usage-based billing through MSP Flex is also really helpful, as Sophos bills you monthly for what your clients use across the Sophos portfolio.
Something to be aware of is that Sophos doesn’t publish the amount covered by its breach protection warranty, so ask before you rely on it in client contracts.
Strengths
Cautions
Todyl MXDR
Todyl
Best for consolidated SASE, endpoint, ITDR and SIEM on one agent
Todyl MXDR is a managed detection and response service that Todyl sells only through MSPs. It runs on the Todyl platform, which combines secure network access (SASE), endpoint security, SIEM, security automation, and governance and compliance tools in a single agent with multi-tenant management.
In terms of the “managed” aspect of the service, Todyl’s analysts cover threats to endpoints, networks, and users, including identity attacks, and you also get recommended response actions you can run with one click.
- Todyl’s analysts monitor and respond to threats across endpoints, networks, and users
- Todyl SIEM collects Microsoft 365 log data to detect compromised identities
- Automated playbooks can revoke, disable, or delete compromised accounts
- Recommended response actions can be run with one click
- One agent delivers secure network access, endpoint security, SIEM, and managed response
- Multi-tenant management covers all your clients
- Every MXDR partner gets an assigned Detection & Response Account Manager
We think Todyl MXDR is a strong option for MSPs that want to deliver network security, endpoint security, log monitoring, and managed response from one vendor, through one agent on each device. Running one agent and one multi-tenant console across your clients means fewer tools for your technicians to deploy and maintain, and the assigned account manager gives you a named contact at Todyl.
Something to be aware of is that Todyl’s site doesn’t name the third-party EDR or PSA tools it integrates with, so confirm your current stack is supported before you commit.
Strengths
Cautions
Other MDR Solutions for MSPs
Beyond our top 10, you may want to consider these MDR services:
An MDR service for MSPs, run by WatchGuard's own team, that covers endpoints, user identities, networks, and cloud services.
A 24/7 threat detection and response service that Acronis launched in April 2026 for MSPs of any size.
An MDR service that MSPs offer to their own customers.
An MDR service that ESET built for MSPs to detect and respond to security incidents.
Managed detection and response with 24/7 support from ThreatLocker's Cyber Hero team.
Detects and responds to threats on clients' systems on the MSP's behalf, available through Field Effect's MSP partner program.
A security platform for service providers, with Cynet's 24/7 CyOps MDR service and incident response support included.
MDR Solutions for MSPs Pricing
Most MDR services for MSPs are sold on a quote basis. Vendors usually price partners per endpoint or per seat, with lower rates as volume grows, and several bill monthly on the endpoints you actually protect. Huntress is the only provider on this list that publishes a price. Prices below are in US dollars, as each vendor publishes them on its own website at the time of writing.
| Product | Starting Price | Billing | Link |
|---|---|---|---|
|
Blackpoint Cyber MDR
|
Contact for quote. No setup fees or long-term contracts
|
Per seat, per month (subscription)
|
|
|
Arctic Wolf Aurora MDR Connect
|
Contact for quote. Volume-based pricing for MSP partners
|
|
|
|
Bitdefender MDR for MSPs
|
Contact for quote. No minimum commitments; usage across all clients counts toward volume pricing
|
Monthly, by usage
|
|
|
ConnectWise Managed EDR
|
Contact for quote
|
|
|
|
CrowdStrike Falcon Complete
|
Contact for quote
|
|
|
|
Huntress Managed EDR
|
$8.99 per endpoint, per month (MSRP). The per-endpoint rate drops as volume grows
|
Monthly, in arrears on deployed endpoints (12-month term)
|
|
|
Kaseya MDR
|
Contact for quote. Priced per endpoint; also included in the Kaseya 365 Endpoint Pro bundle
|
|
|
|
N-able MDR
|
Contact for quote
|
|
|
|
Sophos MDR
|
Contact for quote
|
Monthly, by usage (Sophos MSP Flex program)
|
|
|
Todyl MXDR
|
Contact for quote
|
|
|
MDR Solutions for MSPs Checklist
Use these criteria to compare MDR services before you sell one to your clients.
Ask for the full list of actions the SOC takes without contacting you, and whether you can set different actions for each client. Check how the SOC will communicate with both you and the client when it acts.
Some MDR services need the vendor's own EDR agent on every device. Others work with third-party EDR products, so your clients don't have to replace tools they already pay for. Ask for the list of supported EDR products, and check whether the SOC can take the same response actions with each one.
During a trial, add a new client, deploy agents, and set that client's policies. Check that each client's data stays separate, that technicians only see the clients you assign them, and that you can search for a threat across every client at once.
Ask whether the SOC's incident findings create tickets in your PSA tool, or only platform alerts do. Check that notes and status changes sync both ways, so the ticket closes when the SOC closes the incident.
Ask for a sample monthly client report. Check whether you can add your own branding (some vendors only support branding on certain report exports), and whether a client without a security background will be able to understand what the SOC found and what actions it carried out.
- Many services also monitor Microsoft 365 accounts, firewalls, and cloud workloads, but some vendors only sell this coverage in a higher tier or as a paid add-on. Check whether the SOC can act in those systems, for example by disabling an account or ending a user's sessions, or whether they just alert you to any issues.
- You should also ask how long the service keeps client data, and whether longer retention costs extra.
Billing terms vary between vendors. Some bill monthly for the endpoints you've deployed, with no minimums. Others set deal minimums, volume commitments or 12-month terms. Ask when billing starts for a new client, whether usage across all your clients counts toward volume pricing, and whether any integrations carry a separate fee. Then work out your margin at your current client count and at the count you plan to reach.
Check whether the vendor requires training or technical validation before you can sell the service, how it sets partner tiers, and whether you get not-for-resale (NFR) licenses, which are free licenses for internal use. Confirm who leads communication with the client during an incident, and who owns the client relationship if you leave the program.
The Bottom Line
MSPs buy MDR to give their clients 24/7 detection and response without hiring analysts to staff a security operations center (SOC). An MDR service for MSPs has to watch every client around the clock, confirm which alerts are real attacks, and act on them within limits the MSP sets. It also has to fit how an MSP works: one console for every client, incidents that arrive as tickets in the PSA, reports a client can follow, and partner billing that leaves room for a margin.
When comparing MDR tools, start by looking at which EDR tools your clients already run. Some services respond to alerts from third-party EDR, so clients keep the tools they already pay for; others require the vendor’s own EDR on every device, so clients on another product have to switch first. If your clients run a mix of EDR tools, shortlist the services that work with third-party EDR.
Next, decide how much of each incident you want your team to handle. Some vendors’ analysts carry out full remediation, while others leave remediation and all client communication to the MSP. Similarly, ask each vendor which response actions its SOC takes without your approval, whether you can set those actions for each client, and whether the SOC’s incidents, not only platform alerts, open tickets in your PSA.
Finally, before signing, check the commercial terms and get quotes from any vendors you’re considering. Some vendors bill monthly for the endpoints you’ve deployed, with no minimums. Others set deal minimums, and some require a 12-month term.
Everything You Need To Know About MDR For MSPs (FAQs)
Managed detection and response (MDR) is a service in which a vendor’s security analysts monitor an organization’s systems around the clock, investigate alerts, and act to stop confirmed attacks.
For an MSP, the difference is who the customer is. Instead of a customer buying MDR directly from a vendor, the MSP buys the service from the vendor and sells it to its own clients. So as well as being able to see how the SOC detects and stops attacks, an MSP needs a console that manages every client from one place, incidents that arrive as tickets in its professional services automation (PSA) tool, reports it can share with clients, and partner pricing it can resell at a profit.
Some services do. CrowdStrike Falcon Complete for Service Providers lets you white-label or co-brand the service, and Huntress and Sophos let you add your branding to certain reports. Others don’t say so on their websites, and some, such as Arctic Wolf, never contact your clients directly, so all communication comes from you. If you need your own branding on client reports, check with the vendor before you sign.
It depends on the service. Several integrate with the EDR tools your clients already run, while others only run on the vendor’s own platform. You’ll need to check this with the vendor before you sign, so you can see whether you’ll need to replace all your clients’ existing endpoint security tools.
That depends on the service, and with some, on what you agree for each client. Typical actions include isolating a device, ending a malicious process, disabling a user account and forcing a password reset. Before you sign, ask each vendor which actions need your approval and whether you can set them differently for each client.
That depends on how much resource your team has. An EDR tool such as Defender for Business detects threats and raises alerts; MDR adds analysts who investigate those alerts and respond 24/7, so that you don’t have to hire your own team of in-house analysts to investigate each alert.
Endpoint Security Resources
Further reading on endpoint security from Expert Insights — buyers' guides, comparison articles, and platform-specific shortlists.
Written By
Caitlin Harris is the Head of Content at Expert Insights. As an experienced content writer and editor, Caitlin helps cybersecurity leaders to cut through the noise in the cybersecurity space with expert analysis and insightful recommendations.
Prior to Expert Insights, Caitlin worked at QA Ltd, where she produced award-winning technical training materials, and she has also produced journalistic content over the course of her career.
Caitlin has 8 years of experience in the cybersecurity and technology space, helping technical teams, CISOs, and security professionals find clarity on complex, mission critical topics like security awareness training, backup and recovery, and endpoint protection.
Caitlin also hosts the Expert Insights Podcast and co-writes the weekly newsletter, Cyber Weekly.