Skip to content
AI Cyber Compare

Operating model

What is MDR, and when does a managed service fit better than software?

The short answer

Managed detection and response is a service: a provider's analysts monitor your alerts, investigate them and respond or advise, usually around the clock. It fits teams with no analysts or no night shift. It strains when you want your own team to build knowledge of your environment or to see every step of a verdict.

By The Triage Desk · AI Cyber Compare · Published 2026-10-08

Desk research from public vendor pages: vendor facts read September 2026, updated 2026-10-13. Editorial reading of what vendors publish; we did not run the products and did not interview vendors.

What is MDR, in one paragraph?

A service in which a provider's analysts monitor your alerts, investigate them and respond or advise, usually around the clock.

What you buy: People and process from a provider, delivered on a contract, usually with the provider's tooling or access to yours.

Who decides: The provider's analysts work the queue. The contract sets which actions they may take and which they escalate to you.

Who carries each stage in MDR?

Work strip for Managed detection and response (MDR): Triage, provider's analysts; Investigate, provider's analysts; Respond, shared; Tune, provider's analysts; Nights and weekends, provider's analysts.TriageProvider's analystsInvestigateProvider's analystsRespondSharedTuneProvider's analystsNights and weekendsProvider's analysts
  • Your analysts
  • Rules you write
  • AI agent
  • Provider's analysts
  • Shared
  • Not described
  • Respond: Containment by the provider or by your team, as the contract states.
  • Tune: Detection tuning is part of many MDR contracts; check what yours covers.
  • Nights and weekends: The main reason many teams buy MDR.
Our reading of who carries each stage by default. For a product it reflects what the vendor's public pages describe, not how your deployment will be set up.

When does MDR fit?

  • You have no analysts, or too few to cover nights and weekends.
  • You want a contract that names who responds, and how fast.
  • Your team prefers to own decisions on escalations rather than the whole queue.

When does MDR strain?

  • You want your own team to build knowledge of your environment.
  • You need to see every step of how a verdict was reached.
  • Your environment is unusual and the provider's standard process fits it poorly.

Which profiled vendors work this way?

Profiled providers

Arctic Wolf Aurora MDR

Arctic Wolf's managed detection and response, with 24x7 monitoring, response actions and a named Concierge team for every customer.

Work strip for Arctic Wolf Aurora MDR: Triage, provider's analysts; Investigate, provider's analysts; Respond, provider's analysts; Tune, not described; Nights and weekends, provider's analysts.TriageProvider's analystsInvestigateProvider's analystsRespondProvider's analystsTuneNot describedNights and weekendsProvider's analysts
CrowdStrike Falcon Complete

CrowdStrike's 24/7 managed detection and response service, which it calls agentic MDR.

Work strip for CrowdStrike Falcon Complete: Triage, provider's analysts; Investigate, provider's analysts; Respond, provider's analysts; Tune, not described; Nights and weekends, provider's analysts.TriageProvider's analystsInvestigateProvider's analystsRespondProvider's analystsTuneNot describedNights and weekendsProvider's analysts
Daylight Security

An AI-native managed service in which AI agents and Daylight's senior experts run detection, investigation and response 24/7.

Work strip for Daylight Security: Triage, shared; Investigate, shared; Respond, provider's analysts; Tune, provider's analysts; Nights and weekends, provider's analysts.TriageSharedInvestigateSharedRespondProvider's analystsTuneProvider's analystsNights and weekendsProvider's analysts
Expel MDR

Expel's managed detection and response, sold in three packages that all include 24x7 Expel SOC monitoring and access to Expel Workbench.

Work strip for Expel MDR: Triage, provider's analysts; Investigate, provider's analysts; Respond, shared; Tune, not described; Nights and weekends, provider's analysts.TriageProvider's analystsInvestigateProvider's analystsRespondSharedTuneNot describedNights and weekendsProvider's analysts
Zscaler MDR (formerly Red Canary)

Red Canary's MDR, now sold as Zscaler Managed Detection and Response: 24/7 human-led, AI-powered support across identity, endpoint, cloud, email and network.

Work strip for Zscaler MDR (formerly Red Canary): Triage, shared; Investigate, provider's analysts; Respond, provider's analysts; Tune, shared; Nights and weekends, provider's analysts.TriageSharedInvestigateProvider's analystsRespondProvider's analystsTuneSharedNights and weekendsProvider's analysts

Also covers this model

  • 7AI: PLAID ELITE is a service in which 7AI experts run the platform 24x7, which puts it close to the MDR model.
  • Artemis Security: Artemis includes an AI-native SOAR builder aimed at teams maintaining a SOAR, and offers an MDR option in which its senior analysts operate the platform 24/7.
  • Exaforce: Exaforce can also run the platform for you, with its analysts and Exabots working 24/7, which puts that option in the MDR model.
  • Prophet Security: Prophet AI Watchtower is a 24x7x365 human-in-the-loop expert service, which brings the provider's analysts into the loop as in the MDR model.

Model definitions are general descriptions of each category. MDR providers and SIEM copilots have lighter profiles built from vendor pages read in October 2026; they are not in the fact table, fit finder vendor list or pair pages, which compare the thirteen AI SOC and SOAR products on the same 11 capabilities.

What should you ask before buying MDR?

  1. Which actions may the provider take without asking us?
  2. Which of our tools does the provider use, and which does it bring?
  3. What does an escalation to us contain?
  4. Is detection tuning in the contract?
  5. How do we leave, and what data and detections do we keep?

How does MDR compare with the other models?

Dispatches on this model

Asked often about this page

Is MDR the same as an MSSP?

They overlap. An MSSP is a provider of managed security services, often across many tools; MDR names a service focused on detecting and responding to threats. Many providers sell both. Some AI SOC vendors, such as Dropzone AI and Conifers, offer multi-tenant editions built for MSSPs.

Can an AI SOC platform replace MDR?

Only if you have people to own decisions. The software does the first pass; someone still approves actions and handles new cases. Prophet Security and 7AI sell optional services in which their own people cover that layer.

Which MDR providers are profiled?

Arctic Wolf Aurora MDR, CrowdStrike Falcon Complete, Daylight Security, Expel MDR and Zscaler MDR (formerly Red Canary), with facts read in October 2026. None publishes a price on the pages we read.

Read next

Which modelThe decision guide for all four models.Fit finderFive questions that order the models by your answers.Fact tableAll thirteen vendors side by side.Four operating modelsPrimer lesson on how the models divide the work.