How to evaluate an MDR service against your operating needs

A security lead buying managed detection and response is buying decisions outside the team’s normal working day. The difficult procurement question is what happens after the provider finds something serious and nobody inside the business answers the phone.

The service may investigate quickly and still be unable to contain an incident. That can be the right arrangement for a production system where an incorrect shutdown is costly. It is a poor arrangement if the customer assumes containment has been outsourced and has removed its own overnight cover.

Response authority changes what you are buying

Sophos’s MDR documentation makes this distinction explicit. Its Collaborate mode requires customer consent for response actions; Authorize allows the operations team to perform containment. The documentation also describes an optional fallback to Authorize when designated contacts cannot be reached. These are materially different operating arrangements within one provider’s service.

Use that distinction when comparing any shortlist. Ask who may disable an account, isolate an endpoint or interrupt a connection, and which actions still require an internal decision. The answer should identify actual systems and circumstances. “We respond 24/7” leaves too much unresolved.

For an IT director with a small security team, the retained work deserves its own staffing estimate. Someone must maintain integrations, investigate business context the provider cannot see, approve disruptive actions and coordinate recovery. A service can reduce that burden without eliminating it.

Run three scenarios through the proposed service

Give each supplier the same situations. Where the service uses an AI analyst, include the correction work and escalation quality in the evaluation. Use an overnight identity alert, a missing log feed and suspected compromise of a business-critical endpoint. Ask the supplier to walk through the evidence available, the action it can take and the point at which it needs the customer.

Scenario	What the demonstration should establish
Suspicious overnight sign-in	Who investigates, who can restrict access and what happens if the approver is unavailable.
Telemetry stops arriving	How the loss becomes visible and who restores coverage.
Critical endpoint appears compromised	Whether containment is supported and who weighs its business consequences.

These tests expose different weaknesses. Fast escalation does not compensate for missing telemetry. Broad telemetry does not establish authority to act. An impressive investigation does not restore a service. Keep those outcomes separate when scoring the offers.

The unanswered call belongs in the commercial discussion

Consider a hypothetical Friday-night incident. The provider can investigate a compromised account but needs permission to suspend it. The only authorised customer contact is unavailable. The response process has reached a predictable dead end.

There are several ways to change that outcome: staff an escalation rota, grant limited advance authority, or define a fallback for specified conditions. The appropriate choice depends on what an incorrect suspension would interrupt. A payroll administrator and an account controlling an industrial process should not inherit the same assumptions simply because both appear in an identity platform.

Put the agreed authority, exclusions and escalation route beside the price. Ask the supplier to distinguish acknowledgement, investigation and containment commitments. A contractual response clock may start at a different point from the one the business cares about.

Choose the service your team can operate

Before signing, check how you retrieve investigation records, how long relevant data remains available and what happens during exit. Establish who owns integrations and how changes in the estate reach the provider. Otherwise coverage can drift while the invoice remains unchanged.

Use the distinction between SIEM, XDR and MDR to check whether the gap is missing evidence, investigation capability or an operated response service. The chosen service must leave responsibilities your organisation can sustain. If the main gap is specialist help after a major incident, compare the scope with an incident-response retainer. If it is continuous monitoring and response, evaluate the in-house and managed SOC options against the same staffing and authority requirements.