Glossary
MDR (managed detection and response)
Also called: Managed detection and response
In one sentence
MDR is a service where a team of security analysts watches your security tools' alerts, investigates them, and takes action to contain threats on your behalf.
Tools like EDR and XDR are very good at raising alerts. The hard part is what happens next: someone has to decide whether an alert is a real attack or a false alarm, and act quickly if it's real — including at 2 a.m. on a Sunday, which is when many ransomware attacks are launched. MDR is that people-and-process layer, sold as a service.
A typical MDR service includes alert triage, investigation, threat hunting (looking for signs of attackers that didn't trigger an alert), and containment actions such as isolating a device or disabling an account, followed by a report explaining what happened. Some MDR providers use their own tools; others work with what you already have, such as Microsoft Defender.
Why it matters: for a small practice or business, staffing your own security operations center isn't realistic. MDR gives you trained analysts without the payroll. When comparing providers, ask exactly what they will do on their own authority, how quickly, at what hours, and what they'll leave for you or your IT provider to fix.
Example: on a holiday weekend, a dental office's server starts showing signs of an attacker testing stolen credentials. The MDR team sees the alert, confirms it's malicious, isolates the server and disables the account, then hands the cleanup plan to the practice's IT provider on Monday morning.
MDR is different from 24/7 monitoring alone: monitoring sends alerts; MDR includes people who respond. Ask any provider which one you're getting. Our ransomware guide covers how these layers fit together.
Related terms
- EDR (endpoint detection and response)EDR is security software on each computer that watches for suspicious behavior, records what happens, and lets defenders stop and isolate an attack in progress.
- XDR (extended detection and response)XDR connects security signals from computers, email, sign-ins and cloud apps so an attack can be seen and stopped as one connected incident instead of scattered alerts.
- SOC (security operations center)A SOC is a team — in-house or outsourced — whose job is to watch an organization's security alerts, investigate them and respond to attacks.
- SIEM (security information and event management)A SIEM is a system that collects logs from across your environment in one place, keeps them, and analyzes them to spot and investigate security problems.
- MSSP (managed security service provider)An MSSP is a company that provides ongoing, outsourced security services — such as threat monitoring, log analysis and incident response — rather than general IT support.
- Incident response planA written, step-by-step plan for what your business does when a security incident happens — who to call, what to shut off and what to record.