01MDR, MSSP, SOC-as-a-Service: what sets the terms apart
Managed Detection & Response refers to remotely delivered, analyst-led SOC functions: continuous monitoring, investigation, and active containment of threats – this is also how analyst firms such as Gartner frame it in their Market Guides. Traditional Managed Security Service Providers (MSSPs), by contrast, primarily operate security infrastructure, monitor events, and forward alerts to the internal team; the actual response usually remains with the customer. "SOC-as-a-Service" is used inconsistently in the market and typically means a subscription-based external security operations center including platform and staff – in practice, this overlaps heavily with MDR. What matters is therefore not the label but the contractually guaranteed capability: who detects, who investigates – and who is allowed to intervene?
02Service components: monitoring, triage, response, threat hunting
At the core of every MDR service is 24/7 monitoring of telemetry from endpoints (EDR), identities, network, and cloud, often on a technology stack predefined by the provider. During triage, analysts – supported by automation – separate genuine incidents from false positives, prioritize by severity, and enrich alerts with context and threat intelligence. Active response is what distinguishes MDR from mere alerting: within the agreed scope, the provider can contain threats itself, for example by isolating compromised hosts, locking accounts, or terminating malicious processes. Threat hunting complements alert-based detection with hypothesis-driven searches for attacker activity that existing detection rules do not yet cover.
03MTTD, MTTR, and what the metrics really tell you
Mean Time to Detect (MTTD) measures the time span from the start of an attack activity to its detection, Mean Time to Respond (MTTR) the time to response or containment; Mean Time to Acknowledge (MTTA) and Mean Time to Contain (MTTC) are also in common use. The figures only become meaningful per severity class and over time – numbers averaged across all incidents mask outliers and differences in priority. Important for contracts: a guaranteed MTTD can hardly be promised credibly, because the starting point of an attack is by nature unknown; SLAs therefore usually define response and notification times from alert receipt onwards. Demand transparently defined metrics from your provider that make clear when the clock starts and when it stops.
04Onboarding: log source integration, use cases, runbooks
The quality of an MDR service is largely determined during onboarding. It starts with connecting the telemetry and log sources, prioritized by detection value – typically identity services, endpoints, network components, and cloud services; the BSI minimum standard for logging and detection of cyberattacks (version 2.1, 2024) is aimed at Germany's federal administration, but it also offers other organizations well-founded guidance on which events should be logged. Building on this, a use case catalog is defined, often structured along the tactics and techniques of MITRE ATT&CK, and adapted to the environment in a tuning phase. Finally, runbooks specify per scenario who may do what: which containment measures the provider executes independently, when escalation occurs, and who must be reachable on the customer side.
05SLA and selection criteria
Key SLA points are response and notification times per severity level, round-the-clock availability, defined escalation paths, and reporting with traceable metrics. Also examine where data is processed and how this is assessed under data protection law, compatibility with your existing technology stack, and the portability of detection content, log data, and case history on exit. For entities within the scope of NIS2, support with reporting obligations comes on top: Article 23 of Directive (EU) 2022/2555 requires an early warning within 24 hours and an incident notification within 72 hours of becoming aware of a significant security incident, as well as a final report no later than one month after the notification. The provider must prepare findings quickly and in a structured way so that these deadlines can be met – the reporting obligation itself remains with the affected entity.
06Make or buy: in-house SOC, MDR, or a co-managed model
Running your own 24/7 SOC requires continuous shift operations, ongoing detection engineering, and constant upskilling – efforts that, given the skills shortage, only some organizations can sustain over the long term. MDR, by contrast, delivers a rapid maturity leap at predictable cost, but reduces direct control over detection logic and prioritization. Co-managed models have become established as a middle path: the organization retains ownership of the SIEM or data platform while the provider supplies 24/7 analysis and response. Regardless of the model: NIST SP 800-61 Rev. 3 (2025) anchors incident response as part of overall cyber risk management – governance, crisis communication, and recovery remain internal responsibilities even with MDR.
