Know what you're buying
Managed detection and response (MDR) means a provider watches your telemetry around the clock, investigates alerts and takes containment actions. A managed security service provider (MSSP) traditionally manages devices and forwards alerts for you to act on. A managed SOC can be either, depending on the contract. Write down which of these you need before you compare prices.
Coverage
- Telemetry: which sources are covered: endpoint, identity provider, cloud control plane, email, network, SaaS apps.
- Tools: do they work with the tools you own, or require their own stack?
- Exclusions: what is explicitly out of scope, in writing.
Response
- Actions: which can they take without asking, such as isolating a host, disabling an account or revoking sessions?
- Approval: which actions need your approval, and how fast can you give it at 3 a.m.?
- Playbooks: are they agreed during onboarding and reviewed afterwards?
- Escalation: is incident response included, or a separate retainer?
People and detection quality
- Staffing: is 24/7 coverage in-house, or partly subcontracted? Where are analysts located?
- Detections: who writes and tunes them, and how often are they reviewed against your environment?
- Hunting: is proactive threat hunting included, and what does a hunt report look like?
- Evidence: ask for a redacted sample incident report and a sample monthly review.
Transparency and data
- Visibility: can you see the raw events and the full investigation timeline, not just a summary?
- Ownership: who owns the data, where it is stored, and how you export it at contract end.
- Reporting: what you get each month, and who presents it.
Contract terms
- Response time: define it precisely. Time to acknowledge an alert is not time to contain a threat.
- Price drivers: endpoints, users, data volume or a mix; what happens when you grow.
- Exit: notice period, data return and handover of detections you paid to build.
Run a proof of value
Shortlist two or three providers and run each on your real environment for a few weeks. During the trial, run a controlled test, such as a purple-team exercise, and compare who detected what, how fast they told you, and how clear the explanation was.
- Red flag: response times quoted without a definition.
- Red flag: no access to underlying data.
- Red flag: a sample report full of alert counts and no decisions.
- Red flag: onboarding with no tuning period.