Skip to content
AI Cyber Compare

LESSON 2 OF 10 · MODELS · 3 MIN READ

What an MDR service buys you, and what to check in the contract

The short answer

MDR buys analysts and hours: a provider watches your alerts, investigates and responds or advises under a contract. Whether it works depends on three things the contract must spell out: which actions the provider may take alone, what an escalation to you contains, and what you keep if you leave. This lesson covers the model in general; five MDR providers have profiles on the MDR model page.

By The Triage Desk · AI Cyber Compare · Published 2026-10-08

Updated 2026-10-11: references to MDR profiles.

What are you buying?

With MDR you buy people and process, not software you operate. A provider's analysts look at your alerts, investigate them and either respond or tell you what to do. Most services run around the clock, which is the main reason teams buy them: covering nights and weekends with your own staff takes several people for every seat.

The provider usually brings its own tooling, or connects to yours, or both. That choice matters later, because it decides what you keep if you leave.

Where does responsibility split?

Every MDR arrangement draws a line between what the provider does alone and what it hands back to you. Common splits:

  • The provider triages and investigates; your team approves any containment.
  • The provider contains within a pre-agreed list, such as isolating a laptop, and asks before anything else.
  • The provider advises; your team does all response.

None of these is wrong. The risk is not knowing which one you bought until an incident.

What should the contract say?

  1. Which response actions the provider may take without asking, listed by name.
  2. How fast the provider must escalate, and through which channel, at night.
  3. What an escalation contains: the evidence, the steps taken and the recommendation.
  4. Whether detection tuning is included, and who approves new detections.
  5. Which of your tools the provider needs access to, and at what permission level.
  6. What you keep on exit: case history, detections written for you and any automation.

How does MDR relate to AI SOC platforms?

Both aim at the same pain: alerts that nobody reads in time. MDR answers it with people; an AI SOC analyst platform answers it with software your team runs. Some vendors sit between the two. In our profiles, Prophet Security offers Watchtower, a 24x7x365 human-in-the-loop service alongside its AI SOC Analyst, and 7AI offers PLAID ELITE, in which its experts run the platform around the clock.

When does MDR strain?

MDR strains when your environment is unusual and the provider's standard process fits it poorly, when you need to see every step behind a verdict, or when you want your own team to learn the environment. If your aim is to build in-house knowledge, a service that keeps the knowledge on the provider's side works against it.

How do you compare two MDR offers?

Put the contract answers side by side, not the marketing. Two services that both say "24x7 response" can mean very different things: one isolates a laptop within minutes, the other sends an email and waits. Ask each provider to fill in the same response action catalog (lesson 7 in this primer) with what it does alone, what it asks about, and how long each step takes at night. The one that can answer every row in writing is easier to hold to account.

Words in this lesson: MDR, Escalation, AI SOC analyst, Verdict, Response action

Next lessonCopilot or agent: the difference between answering and working the queueA SIEM copilot answers when asked; an AI SOC agent works alerts on its own. Why that difference decides what happens to unread alerts and the night shift.

Read next

MDRA service in which a provider's analysts monitor your alerts, investigate them and respond or advise, usually around the clock.AI SOC analyst vs MDRThe two operating models side by side.Staffing and coverageEach SOC operating model needs a different kind of staffing. Who must be awake, who approves actions and who maintains the system, model by model.