Managed Detection and Response (MDR)

In the MSSP model, the provider uses the tools a customer has to provide a service. The solution tends to be independent of what the provider preferences are and is very tailored to a customer’s existing tools and infrastructure. MSSPs are traditionally less hands-on when it comes to dealing with an incident. They monitor alerts and forward them to the customer's security team to resolve or are handled through a retainer.

Which option is right for me?

Companies or organizations with complex systems might need a customized MSSP service. If a company has a strong need to rely on its own tools and equipment but doesn't have the staff available, it might need an MSSP. 

In the MDR model, the customer sends its data to the provider's curated stack. The alerts the customer then receives are based on what the provider's stack delivers. There's less customization than with the MSSP model because customers will leverage the provider's stack.

MDR providers typically use a centrally managed, multitenant platform for service delivery. But there's also no need to "rip and replace" what customers have in-house because they're effectively outsourcing their threat detection and response to an external provider. MDR providers also perform a good portion of the incident response process to include deeper investigations and validation of an attack, as well as taking actions to disrupt or contain the threat.

Which option is right for me?

MDR is a more streamlined solution, and typically more cost-effective solution. Companies that are experiencing a shortage of cyber talent, have gaps or problems with existing tools, or are focused only on using a particular set of data versus another could benefit from the MDR model.