The Situation
You need 24/7 coverage and you've decided not to build a SOC. You ask around and get a list of ten MDR (managed detection and response) names. Some are EDR vendors. Some are pure service firms. One was just bought by a company you know for something else. One your MSP already resells.
They aren't ten versions of the same thing. They fall into four models, and the model shapes your contract, your switching costs and the people who'll work your incidents. Sort by model first. Compare brands second.
Model 1: EDR Vendor-Run MDR
How it works: The company that makes your EDR also runs the service. Analysts work in the same console you'd use, on the product they know best.
Examples:
- CrowdStrike Falcon Complete (now marketed as Falcon Complete Next-Gen MDR)
- SentinelOne Wayfinder MDR, launched in November 2025 as part of SentinelOne's Wayfinder services
- Microsoft Defender Experts for XDR, which Microsoft now also offers in a Defender Experts Suite for customers on Microsoft 365 E5 or the Defender Suite
- Sophos MDR, which runs on Sophos's own platform but also accepts telemetry from third-party security tools
Good at: Deep product knowledge, fast response actions inside the tool, and one vendor to call.
Watch for: Lock-in. Leaving the service often means leaving the EDR too. Coverage outside the vendor's own products can be thinner, so ask exactly which third-party logs they act on, not just ingest.
Model 2: Vendor-Agnostic MDR
How it works: The provider doesn't sell an EDR, or doesn't require theirs. It connects to the tools you already own and runs detection and response on top.
Examples:
- Expel, which works across a range of EDR, cloud and identity tools
- eSentire, which integrates with several EDR products, including Microsoft Defender for Endpoint
- Red Canary, which Zscaler completed acquiring on August 1, 2025, according to Zscaler's announcement. Zscaler said it would initially run Red Canary as a separate business unit.
- Arctic Wolf sits close to this model. It brings its own platform and, since acquiring Cylance from BlackBerry, its own endpoint product too.
Good at: Flexibility. You keep your EDR if you change providers. Good fit for companies with a mixed stack.
Watch for: "Supported" can mean anything from a full integration to a basic alert feed. Ask which response actions they can take in your EDR. For providers that changed owners, ask how the roadmap and tool support will change over the next two years.
Model 3: MSSP-Heritage Providers
How it works: These firms grew up managing firewalls, SIEMs and compliance monitoring, then added MDR. They often bundle MDR with log management, managed firewall, incident response and consulting.
Examples:
- Secureworks, whose Taegis platform became part of Sophos when Sophos completed the acquisition in February 2025
- LevelBlue, which completed its acquisition of Trustwave in August 2025 and has since added Cybereason and Fortra's Alert Logic managed services business
Good at: Broad scope in one contract. Useful if you need managed firewall, compliance reporting or a large log footprint covered too.
Watch for: Integration debt after a run of acquisitions. Ask which platform your data will live on in 12 months, and whether your service team or tooling is changing.
Model 4: SMB- and MSP-Focused MDR
How it works: Built for smaller IT teams and often sold through managed service providers. Simple deployment, packaged pricing and a narrower scope.
Examples:
- Huntress, sold mainly through MSPs, with managed EDR and managed identity threat detection (ITDR). It also integrates with Microsoft Defender for Business.
- Sophos MDR and Arctic Wolf both sell heavily through partners as well.
Good at: Fast rollout, predictable cost and plain-English reporting.
Watch for: Response authority. If your MSP sits between you and the MDR team, confirm who isolates a device at 2 a.m. and who calls you.
The Four Models Side by Side
| Model | Best fit | Switching cost | Key question |
|---|---|---|---|
| EDR vendor-run | Standardized on one EDR, wants one vendor accountable | High: service and EDR leave together | How well do you act on non-native logs? |
| Vendor-agnostic | Mixed stack, wants to keep tool choice | Lower: your EDR stays | Which response actions work in our EDR? |
| MSSP-heritage | Wants MDR plus firewall, SIEM and compliance in one deal | Medium to high | What platform will we be on next year? |
| SMB/MSP-focused | Small IT team, often via an MSP | Low to medium | Who takes action, the MDR team or the MSP? |
Where Teams Go Wrong
- Choosing the EDR and MDR separately. If you pick the EDR first, you've often picked the MDR model too. Decide them together.
- Ignoring ownership changes. The MDR market has seen a lot of deals since 2024. A change of owner doesn't make a provider worse, but it changes roadmaps. Ask directly.
- Mixing models on a shortlist without noticing. Comparing a vendor-run service with a vendor-agnostic one on price alone hides the switching cost.
What to Do Next
- Write down your current EDR, your identity platform and your cloud providers. That list tells you which model fits.
- Pick one or two providers from your best-fit model and one from another, so you can see the trade-off clearly.
- Use the scorecard from our MDR buyer's guide to compare response authority and contract terms side by side.
Buying or renewing soon? Stackcurve advisors help IT leaders compare vendors, benchmark pricing and negotiate contracts at no cost to you. Talk to an advisor → or get your free Cyber-Ready Score →
Stackcurve is independent. No vendor pays for placement or editorial influence on this blog.