MDR Value and Outcomes: What Good Actually Looks Like

Almost every MDR provider’s marketing sounds the same: 24/7 monitoring, expert analysts, peace of mind. None of that tells you anything you could verify or compare between providers. It’s not that these claims are false, it’s that they’re unfalsifiable, there’s no number behind them you could check against what actually happens when something real occurs.

The way to cut through this isn’t to distrust every MDR provider’s marketing, it’s to ask for the specific, measurable version of the same claim.

Related:   

• Navigating Australian Cyber Security & Privacy Compliance
• What Is Your MDR Actually Costing You?

How quickly does a human actually look at a genuine alert, not how quickly an automated system generates one. This is the first real signal of whether a service is properly staffed for the volume it’s watching.

Detection without fast containment just means you find out about a problem faster, it doesn’t mean the problem gets stopped faster. Ask specifically about the gap between detection and actual containment action, not just detection alone.

A monthly PDF that restates “no critical incidents” isn’t a report, it’s a formality. Good reporting should tell you something you didn’t already know: what was investigated, what turned out to be nothing, and what changed as a result.

This is the distinction covered in more depth in KMTech’s guide to MDR vs EDR: does the service just tell you something happened, or does it actually act? “Good” MDR contains a threat, not just describes one after the fact.

For the full definition of MDR and how it differs from EDR, see the complete guide.

For what your current arrangement might actually be costing you, including the parts that don’t show up on an invoice, see What Is Your MDR Actually Costing You?..

What questions should I ask an MDR provider about their outcomes?

Ask specifically about time to acknowledge an alert, time to actually contain a confirmed threat (not just detect it), and what their standard reporting actually includes beyond a summary that nothing happened.

Why won’t KMTech publish its own MDR response time figures here?

Because we don’t yet have a confirmed, current figure for our standard offering that we’re comfortable standing behind publicly. We’d rather say that plainly than publish an estimate. This article will be updated once that figure is confirmed.

Is “24/7 monitoring” on its own a meaningful claim?

Not by itself. Monitoring describes what’s watched, not what happens when something real is found. The more useful question is what happens in the time between an alert firing and a person actually acting on it.

How is this different from just comparing price between providers?

Price comparison tells you what you’re paying. Outcome comparison tells you what you’re actually getting for it, and the two don’t always track together, a cheaper service with a slow containment process can cost more in the long run than a pricier one that actually stops things quickly.

Reviewed by Bradley Kaine, CEO and Co-Founder, KMTech.