MDR, managed detection and response, is a service that watches your systems for signs of a break-in and acts when one is real. It has moved from security-conference vocabulary to a line item on cyber-insurance applications, which is how New York firms that never asked about it come to be asked. Stedholm’s own practice is described on the Cybersecurity page; this article is the background reading.
MDR in one paragraph
MDR stands for managed detection and response, and it is a service rather than a product you install. A provider gathers the records your systems already produce (which programs ran on each machine, who signed in from where, what arrived by email), watches those records with detection software, puts people in front of whatever the software flags, and acts when something turns out to be real: cutting a machine off the network, switching off an account. Those records are what the industry calls telemetry, and the word means nothing more exotic than logs of activity. The service exists to answer one question: if an attacker is inside your systems right now, who notices, and what happens next?
Four steps, and the one most often missing
- Collection comes first. An EDR agent (endpoint detection and response: software installed on each computer that records what programs do there and lets a responder act on that machine remotely) covers laptops and servers, while sign-in records, email events and cloud administrative logs feed the same pipeline. Coverage matters more than any single product choice.
- Detection is the analysis that flags suspicious behavior: one account signing in from two places too far apart to be the same person, stolen passwords being reused, an attacker stepping from the first machine onto others, files being encrypted en masse. Watching behavior catches what antivirus misses, because an intruder who signs in with a valid password and uses the tools already present on the machine leaves nothing for antivirus to match against.
- Triage is a person separating real compromise from the false alarms that behavioral detection produces in volume. The team doing that work is what vendors call a SOC, a security operations center, which is the staffed desk that reads the alerts. It is what separates MDR from software you bought and nobody reads, and it is the step most often missing.
- Response is containment under authority you granted in writing, followed by remediation guidance and a written incident report.
Coverage decides the outcome
Buyers tend to compare detection products, and the product matters less than what it can see. An attacker who avoids your instrumented laptops but owns the system that holds your staff accounts and passwords, your identity provider, has won regardless of which EDR you licensed.
| Source | What it reveals | What you lose without it |
|---|---|---|
| Endpoints, through an EDR agent | Which programs ran, what scripts did, files being encrypted | An attacker typing at a keyboard on your laptops and servers |
| Accounts: Entra ID or Active Directory sign-in records | Where a sign-in came from, whether the second factor passed, new permissions granted | Account takeover: an intruder working with valid credentials, leaving no malware to find |
| Inbound threats, new mailbox rules, forwarding changes | Business email compromise, including hidden mailbox rules and quiet forwarding changes | |
| Cloud and software-as-a-service administration | Administrative changes in Microsoft 365, Azure and connected apps | Footholds the attacker creates after taking over an account |
| Network edge and firewall | What leaves the network, remote access, exposed services | Anything that cannot run an agent, including printers, cameras and contractor devices |
Ask any prospective provider which of those five sources it will be reading from the start and which belong to a later phase. A quote that covers endpoints only is a legitimate product, priced accordingly, and it is less than your insurer assumes it is buying. An endpoint-only quote leaves the account records unread, which is why identity hardening belongs in the same discipline rather than beside it.
MDR beside the things it is confused with
| Tool or service | What it is | What it leaves out |
|---|---|---|
| Antivirus, sold as EPP, an endpoint protection platform | Software that blocks malware it already knows about | Nobody is watching, and attacks that use stolen passwords walk past it |
| EDR | Software that records what happens on a computer and allows remote response | A tool without a service. Unmonitored EDR is a flight recorder for a crash nobody prevented. |
| SIEM | Security information and event management: one system that collects logs from everywhere so they can be searched together | Without people reading it, a log archive |
| MDR | People operating that detection tooling: triage, containment, reporting | Patching, and everything else an IT department does |
| MSSP | Managed security services provider: the broader relationship, including vulnerability management, reporting and evidence | MDR is usually one service inside it |
The category lines are easy to confuse. The comparison of the managed service provider, the MSSP and MDR covers where the boundaries sit, and the Cybersecurity page shows how the pieces assemble into a full scope.
Containment authority, decided in advance
Detection is worth little if the responder has to reach a partner outside working hours for permission to switch off an account. The fix is a pre-authorization matrix agreed at onboarding, listing which actions the provider may take on its own and which require a call. Something close to this is a sensible starting point.
| Containment action | Effect on the business | Reasonable default |
|---|---|---|
| Cut one computer off the network | That machine loses everything except the response tooling | Pre-authorized, no call needed |
| Switch off a user account and end its active sessions | That person cannot work until re-enabled | Pre-authorized, with notice to a named contact |
| Block a sender or pull back a mail campaign | Some legitimate mail may be delayed | Pre-authorized |
| Switch off a service or shared account | May halt a business process | Call first, except during confirmed ransomware activity |
| Take a production server offline | Business interruption | A named decision-maker, with a written fallback if unreachable |
A matrix nobody has read is a matrix nobody follows in the middle of an incident. Whatever you agree, agree it in writing and rehearse it once, so the first reading is not under pressure.
Why New York firms keep hearing the acronym
Insurers ask first. Where a cyber-insurance application or a renewal questionnaire asks what watches your endpoints and who responds to what it finds, the answer it is looking for is a description of this service, under whatever name.
Regulators assume the monitoring exists. For firms covered by NYDFS Part 500, meaning anyone licensed under New York’s Banking, Insurance, or Financial Services Law, section 500.14 requires controls designed to monitor what authorized users do and to detect unauthorized access, and it requires the largest covered firms (the ones the rule calls Class A companies) to run an endpoint detection and response solution and to centralize logging and security event alerting, unless the chief information security officer approves something else in writing. Section 500.16 requires a written incident response plan on top of that. Both of those obligations fall away for a firm inside Part 500’s limited exemption (broadly the smallest, measured by headcount including contractors, by gross annual revenue, or by year-end total assets), which is exempt from the monitoring and endpoint-detection provisions of 500.14 and from 500.16 entirely. The exemption does not reach 500.12, so an exempt firm still owes multi-factor authentication, and still has to answer the insurer and the client questionnaire that ask who is watching. The HIPAA Security Rule tells covered entities to review records of system activity such as audit logs and to hold procedures for responding to security incidents. The FTC Safeguards Rule tells covered financial institutions to monitor and log what authorized users do and to detect unauthorized use of customer information, and the FTC’s own plain-language guide walks through the rest of it. None of those texts names MDR; MDR is how smaller firms operate the monitoring the rules take for granted.
Clients put it in writing too: outside-counsel guidelines and vendor security questionnaires ask directly who monitors endpoints and how incidents are contained. Both expect a named monitoring arrangement, and “we have antivirus” satisfies neither.
What MDR leaves to other disciplines
MDR is one control inside a program, and detection without authority to fix things lengthens every incident, so it is worth being precise about the edges.
- Patching is separate work: detection tells you an unpatched server was exploited, and vulnerability management prevents the sequel.
- Recovery depends on backups someone has tested, because containment limits the damage and restores nothing.
- The risk assessment, the policies and the evidence trail are the program around MDR, and they are produced elsewhere.
- On a network with no internal boundaries and shared administrative passwords, containment repeats itself, because the same weaknesses keep producing incidents; the environment has to be hardened as well as watched.
- Help desk tickets belong to IT operations, even when both jobs sit under one accountable roof.
Five questions for any MDR provider
- Which of the five sources above are in scope from the start, and which are a later phase?
- Who reads the alerts, on what staffing model, and in which time zone? Accept only a precise answer.
- Which response actions are pre-authorized, and where is that written down?
- What do I receive after an incident, and will it stand in front of my insurer or my regulator?
- If I leave, do I keep the collected records and the reports?
On the second question, Stedholm’s answer is on the Cybersecurity page, in the part that sets out what being monitored means here. If you want to know what your current tooling would catch, a scoped IT and security assessment maps what it can and cannot see.