Managed detection & response
We don't forward alerts. We stop the attack.
Analysts watch your endpoints, identities, cloud and email around the clock. When something is real, they contain it under playbooks you signed off, then explain what happened.
Works with most major EDR, identity and cloud platforms. Yours are confirmed at scoping.
ops.example.com/cases/CASE-8812
Simulated environment, real workflow.
Operating model
Detect, confirm, contain, write it up.
Detection runs on the tools you already own. Response follows rules you approved before the first alert.
Coverage
- Hours
- 24/7/365, follow-the-sun analyst shifts in the USA and India
- Telemetry
- Endpoint, identity, email, cloud and SaaS logs
- Response authority
- Pre-approved actions: isolate host, revoke sessions, block indicators, disable accounts
- Your contact
- Named lead analyst plus a shared incident channel
- Model
- Fully managed or co-managed with your team
Escalation flow
- 1
00:00 · detection
Detect
Detections from your EDR, identity provider and cloud are correlated into one case, not twelve alerts.
Continuous
- 2
00:04 · confirmed
Triage
An analyst confirms whether it is real, scopes affected users and hosts, and sets severity.
Target: per severity, in your SOW
- 3
00:09 · host isolated
Contain
Pre-approved actions run immediately. Anything outside the playbook waits for your approval.
Target: agreed in your SOW
- 4
00:12 · you are called
Escalate and report
You get a call for critical cases and a written summary for every case, with what we did and what is left.
Call for critical · summary same day
Clock times show one illustrative case. Your SOW sets the target for each stage.
What we commit to in your contract
Each metric gets a target per severity in your statement of work (SOW), and every monthly review reports our times against it.
- Critical response
- Under 15 minutes, 24/7Clock starts: critical alert or callClock stops: an analyst is working it
- Time to acknowledge
- Clock starts: Alert firesClock stops: a named analyst owns the case
- Time to contain
- Clock starts: Threat confirmedClock stops: first approved playbook action runs
- Time to notify
- Clock starts: Threat confirmedClock stops: you are told what we did
- Case write-up
- Clock starts: Case closedClock stops: written summary in your hands
How each severity reaches you
- Critical
Notify you: By phone
Containment: Playbook actions run at once
- High
Notify you: In channel
Containment: Playbook actions run at once
- Medium
Notify you: Daily digest
Containment: On your approval
- Low
Notify you: Monthly report
Containment: Not applicable
Measured every month
Containment gets faster as the playbooks grow.
Each case adds a pre-approved action, so more threats are contained before anyone has to wake up. These are the measures in your monthly report.
| Period | Value (m) |
|---|---|
| Jan | 94.0 |
| Feb | 71.0 |
| Mar | 58.0 |
| Apr | 46.0 |
| May | 38.0 |
| Jun | 31.0 |
| Jul | 27.0 |
| Aug | 22.0 |
Simulated environment, real workflow.
Contained by playbook
86%▲ 34%Time to triage
7m▼ 11mCases needing your approval
4▼ 10Detections from red-team findings
28▲ 22
| Measure | First | Latest |
|---|---|---|
| Contained by playbook | 52% | 86% |
| Time to triage | 18m | 7m |
| Cases needing your approval | 14 | 4 |
| Detections from red-team findings | 6 | 28 |
Simulated environment, real workflow.
Advice that stays
Every finding becomes a detection.
MDR is where consulting work keeps paying off: what our testers prove an attacker could do, our analysts watch for.
Red-team and pentest techniques are turned into detections and replayed to prove they fire.
AI-assisted triage correlates and explains alerts; containment actions always run under a playbook you approved.
Each closed case lands as evidence for SOC 2 and ISO 27001 controls, with no extra work from your team.
Every month
What lands on your desk.
A monthly service review with your lead analyst, backed by the documents below.
Case report
Every case opened, what caused it, what we did and how long each step took.
Response log
Each containment action with timestamp, approver and rollback status.
Detection changes
New and tuned rules, and noise removed, with the reason for each change.
Coverage gaps
Hosts without an agent, log sources gone quiet, and accounts outside monitoring.
Risk themes
Patterns across cases, ranked, with the fix that removes the most risk.
Service metrics
Time to acknowledge, contain and close, against the targets in your contract.
FAQ
Questions buyers ask us.
Anything else, ask an expert. You will talk to an analyst, not a script.
What is the difference between MDR and a managed SOC?
A managed SOC monitors and escalates. MDR also takes response actions on your systems, under playbooks you approve. Many customers start with SOC and add response later.
Do we need to buy new tools?
Usually not. We work with most major EDR, identity, email and cloud platforms you already run. We confirm yours at scoping.
What can your analysts do without asking?
Only what is in the playbook you signed: typically isolating a host, revoking sessions and blocking indicators. Everything else waits for your approval.
How fast do you respond?
Critical: under 15 minutes, 24/7. High: within 1 hour. Medium: within 4 business hours. Low: in the monthly report. We report against these every month.
How is MDR priced?
From $15 per endpoint per month, minimum $2,500 a month. You get a fixed quote after scoping.
What happens if the incident is bigger than MDR?
We bring in our incident response team under the same case, so nobody has to re-explain what happened.
Find out what we would have caught last month.
We review a sample of your recent alerts and show how MDR would have handled them.