The Situation

You've shortlisted three MDR (managed detection and response) providers. All three decks say "24/7/365," "minutes to respond" and "AI-powered." The pricing is close. The demos look alike. On paper, there's no way to tell them apart.

There is, but the differences don't show up in the deck. They show up in what happens at 2 a.m., and in the contract. Here's where to look.

1. What Are They Actually Allowed to Do?

This is the single biggest difference between providers, and the one buyers ask about least.

Some providers notify: they investigate, then call or email you and wait for your team to act. Others respond: they isolate the device, kill the process or disable the account themselves, then tell you what they did.

Ask:

  • Which response actions do you take without our approval? Device isolation? Account disable? Blocking an IP?
  • Can we pre-approve actions by device type, for example "isolate any workstation, call us before touching a server"?
  • What happens if you can't reach our contact?

A provider that only notifies is closer to an alerting service. That may be fine if you have an on-call team, but you should know which one you're buying.

2. Measured Response Times, Not Targets

"Mean time to respond: 15 minutes" can mean very different things. Time from alert to a human looking at it? Time to the first email? Time until the threat is contained?

Ask for:

  • Their measured median and 90th-percentile times for the last two quarters, from detection to containment.
  • How those times change on nights, weekends and holidays.
  • Whether the contract includes response-time commitments, and what you get if they're missed.

The 90th-percentile number matters more than the average, because the attack that hurts you is the slow one.

3. What They Watch, and What They Don't

Most MDR started with endpoints. Attacks now move through identity, email and cloud too.

Area Questions to ask
Endpoints Do you require your own EDR, or can you work with the one we have?
Identity Do you watch Microsoft Entra ID or Okta sign-ins? Can you disable accounts?
Email and Microsoft 365 Do you see mailbox rule changes and suspicious logins?
Cloud Which of AWS, Azure and Google Cloud do you cover, and is it extra?
Network and firewall logs Included, or a separate SIEM add-on?

Coverage is often where the price changes. A low base price that leaves out identity and cloud can end up costing more.

4. Bring Your Own Tools, or Theirs?

Some providers require their own EDR agent. Others support several EDR products. Neither is wrong, but it changes your switching costs.

  • Their tool: often a simpler bundle and a single price. Leaving them later means replacing your EDR too.
  • Your tool: more flexibility, and you keep the agent if you change providers. Make sure they've worked deeply with your product, not just "supported" it.

5. Onboarding and the People You'll Talk To

Ask how long onboarding takes and what they need from your team. A typical answer is a few weeks, covering agent deployment, a tuning period and documenting your critical systems and escalation contacts.

Then ask who you'll actually work with. A named contact, regular reviews of what they found, and the ability to reach a senior analyst during an incident are worth more than another feature.

6. How the Pricing Works

MDR is usually priced per endpoint or per user, sometimes with separate charges for log volume, cloud accounts or incident response hours.

Watch for:

  • Device-count true-ups and how they're calculated.
  • Incident response limits. Is a real breach investigation included, or billed hourly from the first hour?
  • Add-ons for identity, cloud or extra log sources that weren't in the first quote.
  • Price protection on renewal. Ask for a cap on increases in year two and beyond.

7. The Contract Terms to Negotiate

Before you sign, read these sections closely:

  1. Scope of service. The exact list of what's monitored and which actions they take.
  2. Service levels. Response-time commitments and remedies such as service credits.
  3. Liability. What they're responsible for if they miss an attack they should have caught.
  4. Data handling. Where your security data is stored, how long, and who can access it.
  5. Term and renewal. Auto-renewal notice periods and any multi-year price commitments.
  6. Exit. How you get your data and detection history back, and how long they'll support a transition.

What to Do Next

Build a one-page scorecard with these seven areas and score each finalist side by side. Then ask each one for two customer references your size, ideally customers who've had a real incident with them.

Buying or renewing soon? Stackcurve advisors help IT leaders compare vendors, benchmark pricing and negotiate contracts at no cost to you. Talk to an advisor → or get your free Cyber-Ready Score →

← Back to Blog

Stackcurve is independent. No vendor pays for placement or editorial influence on this blog.