The service usually combines technology with human analysts, defined operating procedures, and ongoing communication with the customer.
MDR is an operating model and outcome, not a single product category. Coverage may include endpoints, identities, cloud services, email, or networks, but the actual scope varies by provider and contract. No standards body defines MDR, so the term describes a market category rather than a fixed scope; the contract, not the label, determines what is actually delivered. Good MDR arrangements make response authority explicit before an incident — for example, whether the provider may isolate a device immediately or must first request approval.
Key points
Core serviceDetection, triage, investigation, threat hunting, and guided or authorized response.
What to defineData sources, monitored assets, service hours, escalation paths, response actions, retention, and measurable service levels.
Shared responsibilityThe provider supplies operational capability; the customer still owns business risk, asset decisions, recovery, and governance.
Important limitationAn MDR label does not guarantee broad visibility, expert-led response, or permission to contain an attack.