beazley.security
©2025 Beazley Security. All rights reserved
Everything You Should Know About MDR
A complete guide to Managed Detection and Response functions, trends, shortcomings, and more
Start
The Why Behind Detection and Response
Cybersecurity is fundamentally a protective discipline. Ideally, all malicious and dangerous activity would be prevented at its source. Unfortunately, this is impossible.
Consider the NIST Cybersecurity Framework (CSF) 2.0 Core Functions: Govern, Identify, Protect, Detect, Respond, and Recover. Notice that fully half occur after protective measures have failed.
Threats continually evolve to bypass security measures, and human errors provide opportunities for attackers to access privileged systems and assets. So, even the best cybersecurity programs cannot rely exclusively on protection.
This is why Security Operations Centers (SOCs) and Incident Response (IR) teams are at the heart of cybersecurity.
Detection and response capabilities:
Lessons learned from detection and response should feed back into the wider security program to help prevent similar threats in the future. Through this circular process, organizations grow more secure and learn to allocate cybersecurity resources effectively.
Pick up where protective security controls end
Identify, analyze, contain, and remediate threats
Minimize harm from threats
Feed into recovery efforts where necessary
In-House or Outsource?
The need for detection and response is unavoidable, but its form can vary.
Very large organizations often build and maintain these capabilities in-house.
While this is expensive and difficult, it can be worth the investment for organizations with sufficiently large and complex IT environments, specialized requirements, and the capacity to hire and retain the necessary expertise.
However, most organizations lack the resources or inclination to invest so heavily in a function outside their core competencies. This is unsurprising given the logistics of building and maintaining an effective function and the resources needed to staff and maintain it.
It’s for these organizations that Managed Detection and Response (MDR) exists.
You may notice that monitoring isn’t prominently featured in the NIST Core Functions. That’s because monitoring isn’t an outcome. Despite this, it’s a fundamental requirement, and without it, the Detect, Respond, and Recover Functions are impossible.
All detection and response functions must be built on top of a comprehensive and continuous monitoring capability that covers the entire IT environment. This means monitoring data from all tools and systems, including endpoints, networks, identities, email systems, and cloud services, applications, and containers.
There’s No Detection or Response Without Monitoring
Defining Managed Detection and Response (MDR)
The term Managed Detection and Response (MDR) has been used and abused to sell a wide range of services, from technology offerings with minimal human intervention to fully outsourced SOCs. However, MDR does mean something specific — even if it’s frequently misused.
According to Gartner, MDR “provides customers with remotely delivered security operations center (SOC) functions”. This isn’t a great definition, which may explain why the term has been so misused. However, a closer reading of recent Gartner reports finds that — while there is wiggle room — criteria must be met for an offering to truly constitute MDR.
This must be delivered remotely, and threats must be identified, investigated, contained, and remediated rapidly to minimize harm to the client’s IT systems and resources.
MDR offerings invariably use technologies such as Endpoint Detection and Response (EDR). However, the heart of true MDR is a fully staffed and experienced Security Operations Center (SOC). While technology-centric offerings are often sold as “MDR,” they don’t meet the criteria.
Note: MDR offerings frequently include additional services such as threat hunting and Cyber Threat Intelligence (CTI). These are value-added services rather than core MDR functions.
Continuous monitoring that covers all endpoints, networks, identities, cloud instances and applications, containers, etc.
Rapid threat detection to uncover malicious or dangerous activity within the client’s environment.
Investigation and analysis to understand the extent of discovered threats and determine the best course of action.
Containment of threats to prevent further spread and harm.
Response actions to eliminate all traces of the threat and enable the client to return to normal operations.
At a minimum, MDR must include:
The Why Behind Detection and Response
Three Models for Detection and Response
How MDR is Changing To Reflect Client Needs
11 Capabilities You Should Expect from MDR
The MDR Life Cycle as It Should Be
MXDR: Detection & Response that Fuels Your Security Program
Contact us
To access the full report, please fill in your details below