MDR (Managed Detection and Response)

MDR (Managed Detection and Response) is a service in which a provider helps operate detection, investigation and response using agreed telemetry and tools. Scope may include endpoints, identity, network or cloud, but complete coverage or continuous attention should not be assumed unless the contract states it. MDR and EDR are not equivalent: one describes a managed operation and the other a technology capability. Before contracting, organisations should define sources, hours, severities, contacts, authority to contain, evidence preservation and retained responsibilities. Integrations and agents need health monitoring because a failed source reduces visibility. Evaluation should follow simulated cases from detection to closure and measure decision quality and time. More alerts or an attended console do not guarantee lower risk.