The MDR market can be extremely difficult to navigate. Many providers make the same promises, even though they often have very different capabilities.
For example, several providers might promise 24/7 monitoring. That might mean there is a human analyst making key decisions when a middle-of-the-night attack occurs. Or it could mean that an automated tool monitors systems at night and generates alerts for suspicious activity, although no one reviews the output until the next business day. Both services might technically qualify as “24/7 monitoring,” but only the human-based approach will truly protect your organization.
While some providers turn to automated systems to deliver on their promises, others hire third parties. Two providers might offer security operations center (SOC) capabilities, but one might be using an outside vendor. If the provider hiring the third party does not disclose that information, it could cause a serious compliance issue down the road.
Defining Comprehensive Coverage
One of the most frequent provider claims is “comprehensive coverage.” But what exactly does that mean? Asking three specific questions can help define more precisely what each provider offers.
Who is responsible for configuration and optimization?
MDR providers use tools to monitor your environment. If those tools are misconfigured, the alerts they generate will be missed or meaningless. As part of your evaluation process, find out who owns tool configuration and optimization. Leaving your team in charge of those tasks might be fine, but you should be fully aware that this relationship will require greater internal resources.
What is pre-authorized during an active incident?
When an attack occurs, containment requires speed. If a provider requires your authorization before isolating a compromised endpoint, for example, the delay could allow an attack to move deeper into your environment. Of course, you might have good reason to require approval for some actions. Just make sure you’ve clearly determined which responses require pre-authorization before engaging a provider. Those responsibilities should be explicit in the contract.
What is out of scope?
Even when a provider does offer a comprehensive set of capabilities, some of those capabilities might cost extra. For example, providers might offer customization as an add-on service rather than part of the core MDR offering. If your organization needs tailored detection logic for a specific application or environment, confirm whether that’s included or priced separately.
Taking Cyber Insurance into Account
Before engaging with an MDR provider, be sure you understand how they can help you implement, maintain, and document controls required by your cyber insurance carrier. Without that assistance, you could face denied claims.
Cyber insurance carriers have significantly tightened their requirements. For example, many now expect multi-factor authentication (MFA) on all remote access; documented incident-response plans; active endpoint detection and response (EDR) tools; privileged access policies; tested backup and recovery processes; and more. These are becoming standard conditions for coverage.
The right MDR provider will help you handle those requirements. In particular, the provider can close documentation gaps that give an insurer a reason to deny an otherwise legitimate claim. So, when you evaluate a provider, ask directly whether they can help you meet and document the controls your cyber insurer requires.
Simplifying MDR Evaluations with Key Questions
Incorporating questions about coverage limitations and cyber insurance controls into other standard queries can help narrow the field of potential MDR providers. Here are questions that can help you cut through vague promises.
- Does 24/7 coverage mean a human analyst is always available to make judgment calls? Or is the after-hours response automated?
- What is your documented mean time to detect (MTTD) and mean time to respond (MTTR)? Can you show historical performance data rather than target ranges?
- Will your service integrate with our existing tools, or will we need to replace technology to use it?
- Which response actions would be pre-authorized, and which would require our explicit approval before you act?
- Can you produce sample compliance documentation for our specific framework?
- What is out of scope? Where does your responsibility end and ours begin?
- Would you be able to help us document the security controls our cyber insurer requires?
The evaluation experience itself is also a reliable signal for a future engagement. When providers are organized, specific, and honest during this process, they are more likely to be reliable partners when security incidents occur. Conversely, be wary of any provider that avoids answering questions or offers only vague responses.
Bringing Clarity to Provider Selection
As providers continue to multiply, selecting the right partner to manage cybersecurity will become only more difficult. If you are just beginning your MDR provider search or considering a change, implementing an evaluation framework can help you gain a clearer picture of what each provider can truly deliver and at what price.
NexusTek offers a buyer’s guide that digs deeper into the framework for evaluating not only MDRs but also managed service providers (MSPs) that offer both IT and security services. Learn more about how to differentiate providers, assess the costs for services, and ask the right questions through the evaluation process.
Download the buyer’s guide. https://www.nexustek.com/cybersecurity-guide