The MDR Evaluation Guide

Managed detection gets bought on trust and renewed on inertia. Renewal is your one moment of real negotiating room, and most teams spend it reading a report that measures the wrong thing: time to acknowledge standing in for time to conclude, suppression counted as investigation. A provider can close a high share of alerts and still hand your team most of the work.

This guide replaces the demo with a scoring exercise. Twenty questions across coverage, escalations, customization, and transparency, scored 0 to 2 depending on whether you saw it work on a real case. Forty points total.

Score your current provider first. Above 32, worth keeping. 24 to 31, get the gaps in writing before you renew. Below 24, you are staffing them yourself.