What MDR Solves for an MSP
MDR solves the operating problem rather than the tooling one. Most smaller MSPs cannot staff round the clock monitoring, and detection that is only reviewed during business hours leaves uncovered the nights and weekends attackers prefer. An MDR provider supplies the analysts, watches your EDR and often identity and email signals, and acts on what it finds.
It also changes who your team needs. With an outside team watching overnight, your technicians stop being the last line of detection and become the people who fix what the provider finds. That is a better use of an L1 or L2 technician, but only if the handoff between the provider and your service desk is written down and tested before the first real incident.
It is the usual answer to the question of whether you need your own security operations center. For the build versus buy reasoning, read do I need a SOC for my MSP; this entry covers what to check when you buy.
What to Check Before Signing
"Managed" spans a wide range. Some services notify you and wait; others isolate a machine at three in the morning without asking. Both are defensible, but you need to know which one you bought, and so does your client.
| Question | Why it matters to the MSP |
|---|---|
| What may they do without asking? | Decides whether an incident is contained overnight or waits for your on call technician. |
| Which signals do they watch? | Endpoint only leaves identity and email attacks to you. |
| How do alerts reach you? | A ticket in your PSA gets worked; an email to a shared inbox gets lost. |
| Who talks to the client? | Clients should hear from you, not a vendor they have never met. |
| Will they sign a BAA? | Healthcare clients need one with every subcontractor that sees their data (see BAA). |
Making the Margin Work
MDR is priced per endpoint or per user, and it lands in cost of goods, so it has to be built into your security bundle rather than absorbed. The work does not disappear either: your team still handles remediation, rebuilds and the conversation with the client after an incident.
- Include it in a standard security tier rather than selling it as an optional extra.
- Budget technician time for the remediation tickets it generates.
- Track it against managed services gross margin so security stack growth does not quietly erode profit.
- Review incidents in the QBR, which is where clients see what they pay for.
If clients need correlation across identity, email and cloud as well as endpoints, look for providers that operate on an XDR platform.
Common Questions
Is MDR the same as a SOC?
No. A SOC is a team and function you could build or buy; MDR is one way of buying detection and response from an outside team.
Can I white label an MDR service?
Many MSP focused providers allow it. Decide early whether your clients know the provider exists, because it affects incident communication and contracts.
Does MDR cover cloud and Microsoft 365?
Some services do and some watch endpoints only. Ask for the exact list of data sources included at your price.
Who is liable if MDR misses an attack?
Read the provider contract closely; most limit liability heavily. Your client agreement should reflect what you can actually pass through.