A security alert is only useful if someone can investigate it and act, including outside your organisation’s working hours. MDR services combine security technology with human-led monitoring and response, giving businesses access to specialist coverage without building every capability in-house.
For organisations spread across countries, the challenge is not simply collecting more logs. Teams need a clear route from detection to containment, with responsibilities agreed across locations, systems and time zones. Knowing what a provider will monitor, how it will respond and what the service costs makes it easier to choose well.
Key takeaways
- MDR combines security monitoring with investigation and response, but the precise scope varies by contract.
- SIEM is a technology platform; a SOC is an operating function; MDR is a managed service that may use both.
- Pricing and response times are difficult to compare unless providers define their units, exclusions and SLA clocks.
- Multi-country businesses should confirm coverage across their systems, locations, escalation contacts and compliance needs.
What MDR services include
Managed Detection and Response (MDR) uses security data and specialist analysts to identify suspicious activity, investigate alerts and respond to threats. Depending on the agreed scope, providers may monitor endpoint, identity, cloud and network signals around the clock.
The service can help organisations that lack the staff or expertise to operate a full security function themselves. However, “managed” doesn’t automatically mean every system is covered or that the provider can take any response action without approval. Those details belong in the service definition.
Monitoring, investigation and response
An MDR provider receives telemetry from supported tools, then reviews alerts to distinguish likely threats from routine activity. When an incident needs attention, analysts investigate the evidence, assess its scope and follow agreed procedures. These may include isolating an endpoint, disabling an account or escalating the incident to your internal team.
Check which actions the provider may take independently. A fast containment step can limit disruption, but only if it fits your business’s risk tolerance and authority model. Ask how the provider records decisions and shares updates during an incident.
The role of threat hunting
This proactive approach searches for suspicious behaviour that automated alerts may not identify. Analysts can investigate patterns linked to known attacker tactics, techniques and procedures (TTPs), then recommend changes to detection rules or controls.
Ask how often this takes place, which data sources it covers and how findings are reported. A provider should explain what it found and what action your team needs to take, rather than presenting it as an undefined feature.
MDR, SIEM and SOC: what’s the difference?
These terms describe related but distinct parts of security operations. Understanding the difference helps you identify what a proposal includes and what remains your responsibility.
Technology, service and operating model
A Security Information and Event Management (SIEM) platform collects and correlates security logs, then generates alerts. A Security Operations Centre (SOC) is a team or function that monitors security activity and handles investigations. MDR is a managed service that provides detection and response, often using tools such as SIEM and endpoint security software.
As a result, buying SIEM access alone does not necessarily provide analysts who will investigate every alert or contain a threat. An MDR contract should state who monitors the platform, what they investigate and how they support incident response.
Working with existing security tools
MDR may complement an existing SIEM rather than replace it. Before signing, list your key systems and confirm which data the provider can ingest, including endpoint, identity and cloud telemetry. If your business uses Microsoft Sentinel, CrowdStrike or another named platform, ask the provider to confirm support for your particular configuration. Do not assume that a product name guarantees full integration.
Zero Through’s Managed SIEM Services can be relevant when your priority is managed log monitoring and analysis. The right arrangement depends on your current tools, monitoring needs and response requirements.
MDR for businesses operating across countries
A central security service can coordinate threat response across offices and remote teams. It can also clarify responsibilities when local IT staff, central teams and external providers support the same environment.
MDR works alongside, rather than instead of, operational IT support. Operational IT support keeps users and services running; MDR focuses on detecting and responding to security threats. If teams across countries share responsibility, agree how incidents move between them and the security provider.
Set coverage around your actual footprint
List the locations, business hours, languages, systems and escalation contacts that matter. IT teams may cover offices in different time zones, but that doesn’t prove an MDR provider monitors every site or can contain an incident there.
Check whether the service covers remote staff, cloud workloads and regional infrastructure. This is especially important when several local teams or suppliers are involved. A written escalation path should identify who is contacted, how quickly and what happens if they can’t be reached.
Keep security responsibilities distinct
IT services may include network support, device management and user helpdesks, whilst MDR focuses on security monitoring and incident handling. Define the hand-off between them, including who can disable accounts, isolate devices and approve disruptive actions.
A shared incident process can reduce confusion across offices. Organisations should also consider local legal and data-handling requirements. Support across different locations doesn’t automatically provide consistent security controls. Document the standards each supplier must follow.
How MDR pricing works
Providers may charge by user, device, server, asset tier or service unit. These models count different things, so a lower headline price may not mean a lower total cost.
Public UK G-Cloud pricing schedules show how asset-tier fees can vary:
| Example asset tier | Annual price |
|---|---|
| 250 assets | £7,200 |
| 500 assets | £13,600 |
| 1,000 assets | £25,600 |
| 10,000 assets | £208,000 |
These are examples from a specific schedule, not market averages or a like-for-like comparison of providers.
Compare the full cost
Ask whether the quote includes onboarding, platform licences, hosting, forensic investigation and incident-response hours. One published pricing document, for example, lists onboarding on a time-and-materials basis and excludes platform licensing and application hosting. Contract term, VAT treatment and charges for bespoke requirements can also change the total.
Calculate the service against the assets actually in scope. Then ask how the provider handles growth, temporary devices, acquired businesses and assets that cannot send telemetry. A clear definition of a billable asset prevents surprises later.
What to check in an MDR SLA
An SLA should separate alert notification, initial response, investigation and containment. Those stages are not interchangeable. A provider may acknowledge an alert quickly but need longer to establish whether it is a real incident.
Check when the clock starts
Some published service descriptions set a P1 notification target of 30 minutes, followed by an update within an hour. Another listing specifies a P1 initial response within 15 minutes after triage. That wording matters: the clock may not start when an alert first appears.
Ask for targets by severity, including the point at which the response clock begins and what counts as an update. Confirm whether coverage applies 24/7/365, how the provider contacts your team and what happens if an incident occurs during a public holiday.
Agree escalation and authority
Write down who can approve containment and what the provider may do if no one responds. The SLA should also state how the provider handles false positives, major incidents, evidence preservation and post-incident reporting.
For multinational IT support teams, define how escalation works across time zones and local contacts. A response target has limited value if the provider cannot reach the person authorised to make a decision.
Compliance and provider assurance
Choose assurance checks that fit your organisation’s obligations and supply-chain risks. Ask for evidence rather than relying on a logo or a general claim of compliance. Relevant considerations may include ISO 27001, GDPR and, where applicable, the NIS Regulations.
Cyber Essentials is the UK Government’s minimum recommended cyber security standard. Its five technical control areas cover firewalls, secure configuration, security update management, user access control and malware protection. The NCSC’s Cyber Essentials technical requirements v3.3 took effect on 27 April 2026; v3.2 remains available for applications started before that date.
For an MDR provider, also ask how it controls privileged access, protects and retains your logs, manages subprocessors and handles data residency. Confirm what evidence it can provide about its own security practices, and how its reporting supports your audits. An IT Security Audit can help identify gaps in your current controls before you define a service scope.
Selecting and onboarding an MDR provider
Start with the incidents and systems that matter most to the business. Then ask each provider to map its service against those needs, rather than comparing feature lists in isolation.
Questions to ask before signing
Ask providers to show how they would handle a realistic alert in your environment. Request clear answers on:
- Which assets and data sources are included, and which are excluded?
- Who investigates alerts and what response actions can analysts take?
- How are incidents escalated across countries and time zones?
- What are the SLA targets, and when does each response clock start?
- Which charges sit outside the recurring fee?
For global technology support arrangements, include the IT service desk and local suppliers in these discussions. Security teams need a reliable route to the people who manage affected systems.
Prepare systems and people
Before onboarding, agree asset lists, data access, named contacts and escalation procedures. Test that priority systems send the required telemetry and that the provider can reach your incident contacts. Confirm how changes to your environment will be communicated, especially after an acquisition or major infrastructure update.
Your IT support services should also have a process for acting on provider recommendations. Otherwise, repeated findings may remain unresolved even when detection is working as intended. If you need help reviewing your arrangements, Get IT Support from Zero Through can connect your operational and security requirements.
Further blog topics for Zero Through
- Securing identity across international offices
- Incident response planning for distributed teams
- Managing cyber risk across regional suppliers
- Cloud log retention for regulated organisations
- Securing remote access for travelling staff
- Security monitoring for multi-cloud estates
- Cyber Essentials readiness for growing firms
- GDPR questions for outsourced security monitoring
- Preparing incident contacts across time zones
- Security risks after a cross-border acquisition
- Protecting Microsoft 365 across multiple tenants
- Vulnerability management for branch networks
- Testing backup recovery after ransomware
- Security controls for overseas contractors
- How to review a cyber incident report
- Choosing SIEM data sources for lean teams
- Account security for international finance teams
- Incident evidence handling for legal teams
- Network segmentation for manufacturing sites
- Security onboarding for new country offices
- Managing privileged access across subsidiaries
- Cyber risk reviews for charity supply chains
- Comparing incident response retainers in the UK
- Reviewing security responsibilities in IT contracts
MDR services FAQs
Does MDR replace an internal security team?
No. It can provide monitoring and analyst expertise, but your organisation still needs to make business decisions, manage systems and carry out agreed remediation. Smaller teams may use MDR to extend their coverage without staffing a full SOC.
Can MDR work with our existing SIEM?
Often, but confirm the provider’s support for your specific SIEM, configuration and data sources. Agree who owns alert rules, licensing, log retention and platform changes.
Does every MDR provider include proactive threat hunting?
No. Frequency, data coverage and reporting vary. Ask for the hunting scope in writing, including how analysts share findings and recommendations.
How should we compare quotes?
Compare the same asset definition and service scope. Include onboarding, licences, hosting, incident-response work and out-of-hours coverage, then check contract terms and SLA wording.
What should a business check first?
Start with systems in scope, response authority, escalation contacts and the SLA clock. Then check the provider’s assurance evidence against your own regulatory and contractual requirements.
Choose MDR around the response you need
An MDR service is only as useful as its coverage, escalation process and authority to act. Define which systems matter, how teams across locations will work together and what a meaningful response looks like before comparing prices.
Zero Through provides cybersecurity support for businesses that need practical monitoring and response. Protect Your Business with services shaped around your systems, or Book a Security Review to discuss your risks and priorities.
