MDR explained: what a 24/7 managed response service actually does

Managed detection and response, or MDR, is one of those terms that gets used loosely. Some providers use it for a service that emails you when something looks wrong. Others mean a team that will isolate a laptop at 3am, kill the malicious process, clean up what the attacker left behind and tell you about it in the morning. Those are very different services, and the difference matters most at exactly the moment you can least afford confusion.

This guide explains what MDR is, what a good service actually does when an alert fires, where its limits are, and how to work out whether your business needs one.

What MDR is, in plain English

MDR has three parts, and the name gives them away:

• Managed: people, not just software. A provider's security analysts do the work.
• Detection: spotting malicious activity on your devices, usually using an endpoint detection and response (EDR) tool already installed on them.
• Response: doing something about it, such as stopping a process, isolating a device or removing what the attacker installed.

The software side is EDR. If you are not sure what that is, our guide on what EDR is and whether a small business needs it covers it. In short, EDR records what happens on each device and flags behaviour that looks like an attack. What it cannot do on its own is decide whether an alert is real, work out how far the attacker got, or act with judgement at 2am on a bank holiday. That is the gap MDR fills.

EDR, threat hunting and MDR compared

These three things are often bundled together, so it helps to separate them.

Threat hunting is the middle ground. Hunters look for the quiet signs of an intruder that automated detection might not flag, then write up what they found. The catch is that someone at your end still has to read the write-up and act on it.

What actually happens when an alert fires

Here is the general shape of how a hands-on MDR service handles a serious alert. The details vary between providers, but this is what you are paying for.

1. The alert arrives. Your EDR spots something, for example an Office document launching PowerShell, which then tries to download a file and disable security tools.
2. Triage. An analyst looks at it within minutes. Is this a known admin script, or is it malicious? Most of the value is here: filtering out the noise so real threats get attention.
3. Investigation. If it looks real, the analyst follows the trail. What started it? Which user account is involved? Has the same thing happened on other devices? Has anything left the network?
4. Containment. The analyst isolates the affected device from the network so it can only talk to the security platform. The user loses network access, but the attacker loses their foothold.
5. Remediation. The team removes what the attacker added: malicious files, scheduled tasks, new accounts, registry changes used to survive a reboot.
6. Reporting. You get a written summary of what happened, what was done, and anything you need to do yourself, such as resetting a password or reviewing how the phishing email got through.
7. Release. Once the device is clean, it is taken out of isolation.

The steps that separate MDR from a monitoring service are 4 and 5. If a provider stops at "we told you", you have a monitoring service, which may still be useful, but it is not the same thing.

What MDR does not do

Being clear about the limits avoids nasty surprises during an incident.

• It does not rebuild your business. If ransomware has already encrypted a file server, MDR can stop the attack and remove the attacker, but restoring data from backups is a job for your IT provider.
• It only covers what it can see. If a device does not have the agent installed, the MDR team is blind to it. Old servers, forgotten laptops and personal devices are common gaps.
• It does not fix your email or your accounts by default. Many MDR services focus on endpoints. Phishing, stolen Microsoft 365 passwords and invoice fraud may sit partly or entirely outside the scope. Check what is covered.
• It is not legal or regulatory advice. Deciding whether to report a breach to the ICO, which must happen within 72 hours of becoming aware of it if the breach is reportable,¹ is your decision. Your provider can give you the facts to base it on.
• It is not a substitute for basics. Patching, multi-factor authentication and tested backups still matter. Insurers ask about all of them, as our guide on what cyber insurers ask about EDR, MFA and backups explains.

Notify-only versus hands-on response

The biggest single question when comparing MDR services is: who presses the button?

Some services detect and notify. They will email or call you with what they have found and a recommended action, then wait. That works if someone at your end is reachable and able to act at any hour.

Others act on your behalf. They contain and remediate within limits you agree up front, then tell you what they did. For a small business without its own security team, this is usually what people mean when they say they want MDR.

As an example of how this plays out in practice, our own plans split along exactly this line. Defend Plus includes Falcon OverWatch threat hunting: CrowdStrike's hunters write up what they find and send it to you, and you act on it. Complete adds Falcon Complete, where CrowdStrike's own team investigates, contains and removes threats for you. CrowdStrike describes Falcon Complete as 24/7 managed detection and response, with its analysts delivering "full-cycle remediation" on the customer's behalf.² Coffee Cyber itself does not investigate alerts; on Complete, CrowdStrike does. More detail is on our managed response page.

Neither model is wrong. The right one depends on whether you have someone who can act quickly when the alert lands.

Do you need MDR?

The honest answer is "it depends who is watching". The UK government's Cyber Security Breaches Survey found that 43% of UK businesses had a cyber breach or attack in the last 12 months, rising to 65% of medium businesses.³ The same survey found that in the smallest businesses, cyber security is most often looked after by an office manager, while most larger businesses use an outside provider.³

Ask yourself these questions:

• If an alert fired at 11pm on a Friday, who would see it, and when?
• Could that person tell a real attack from a false alarm?
• Could they safely isolate a device and investigate what happened?
• Does your IT provider's contract include out-of-hours security response, or just business hours support?

If the answers are "nobody until Monday", "probably not" and "not sure", MDR is worth serious consideration. Attackers often choose evenings and weekends precisely because nobody is looking.

If you already have a capable IT provider with a security team that monitors alerts and responds out of hours, you may be well covered without a separate MDR service. In that case, EDR with alerts sent to them, plus threat hunting, can be a sensible and cheaper combination. Many businesses using Microsoft Defender through Microsoft 365 Business Premium rely on their IT provider in exactly this way, and it can work well when the provider is genuinely watching.

Questions to ask any MDR provider

Whoever you are considering, these questions will tell you a lot:

1. Is it genuinely 24/7, every day of the year, including bank holidays and Christmas?
2. Will you take action, or only notify? Which actions need my approval?
3. How quickly will you respond? Ask for the commitment in writing, not a marketing figure.
4. What exactly is covered? Windows, Mac, Linux, servers, cloud workloads, identities, email?
5. What happens to devices without the agent? How do you help find them?
6. What do I receive after an incident? A useful report should explain what happened in plain English and what you need to do.
7. Who does the work? Is it the vendor's own team, or a reseller's?
8. What is not included? Incident recovery, forensics and legal support are often separate.
9. How do you contact me in an emergency, and what if I do not answer?

It is also fair to ask for independent evidence. For example, CrowdStrike was named a Leader in the Forrester Wave for MDR services in Europe in Q3 2025.⁴ Analyst reports are one input, not proof that a service suits you, but they are better than self-assessment.

Getting value from MDR

If you do buy MDR, a few things make it work far better:

• Install the agent everywhere. Every device without it is a blind spot.
• Agree response rules in advance. Decide which devices can be isolated without asking (most laptops) and which need a call first (perhaps the one server that runs your tills).
• Keep contact details current. Make sure the provider has at least two people they can reach, including out of hours.
• Read the reports. Recurring findings, such as the same user clicking phishing links, point to fixes outside the security tool.
• Write a short incident plan. Only 25% of UK businesses have a formal incident response plan.³ Even one page listing who to call, and in what order, helps. Our guide on what to do in the first hour of a ransomware attack is a good starting point.

MDR is not magic. It is skilled people with good tools, watching when you cannot and acting when it counts. For many small businesses, that is exactly the missing piece.

Common questions