Buying Guide: Choosing an MDR / SOC Provider

The right managed detection and response (MDR) provider is the one that will actually stop an attack at 2 a.m. on your systems, under rules you agreed in writing, and prove it to your insurer and your board. Coverage, the authority to act, and evidence matter more than the logo.

This guide is for CIOs and CISOs replacing an in-house security operations center (SOC), renewing an MDR contract, or adding round-the-clock coverage because the board or the cyber insurer asked for it.

First, the terms

Security services come with a lot of acronyms. Here's what the main options are, in plain English.

• SOC (security operations center). The team, and the tools, that watch your systems for attacks and respond. You can build your own, or rent one.
• MDR (managed detection and response). An outside team watches your systems 24/7, investigates alerts and takes action to stop an attack, such as cutting off an infected laptop or locking a stolen account. The key word is response: they act, not just warn you.
• MSSP (managed security services provider). An outside firm that runs security tools for you, such as firewalls, and often monitors them. Traditional MSSPs mostly alert you and leave the response to your team.
• SOC as a service. A rented SOC. Often used to mean the same thing as MDR; ask exactly what they do when they find something.
• MXDR (managed extended detection and response). MDR that covers more than computers: email, user accounts, cloud and apps too. Most good MDR services now do this.

How the options compare

Other terms in this guide

• EDR (endpoint detection and response): security software on laptops and servers that spots and blocks attacks. MDR providers usually run on top of it.
• SIEM (security information and event management): a system that collects logs from everything so analysts can search for signs of attack.
• IR (incident response): the work after an attack: investigation, cleanup and recovery. An IR retainer is a contract to have that team on call.
• Threat hunting: analysts searching for attackers who slipped past the alarms.
• vCISO (virtual chief information security officer): a part-time security leader you rent.
• GRC (governance, risk and compliance): the policies, audits and paperwork side of security.
• SLA (service level agreement): the response times the provider commits to in the contract.

Why this is on the board's agenda now

• Insurers want proof, not checkboxes. In 2026, carriers expect EDR on every server and workstation plus 24/7 monitoring through MDR, a SOC or an equivalent, and they increasingly ask for evidence rather than attestation. (Cyber Advisors)
• Alerts without response don't count. Underwriters look for 24/7 monitoring with active response and the ability to show alert-to-action timelines. (IRONSCALES)
• The market is consolidating. LevelBlue (the former AT&T Cybersecurity) completed its purchase of Trustwave in August 2025, after buying Aon's Stroz Friedberg, and later Cybereason. If your provider has changed owners, re-check the contract, the platform roadmap and who staffs your SOC. (SecurityInfoWatch)
• Exposure is joining detection. Gartner expects half of MDR findings to include threat-exposure detail by 2028, so buyers are asking for more than alerts. (Gartner)

When MDR is the right move

It is usually right when:

• You don't have, or can't keep, analysts on shift 24/7/365.
• Your EDR generates alerts nobody reads at night or on weekends.
• Your insurer, auditor or a customer contract requires documented round-the-clock monitoring and response.
• You need incident response on call without buying a separate retainer.

Look elsewhere, or add to it, when:

• You already run your own SOC and only need help in one area: buy co-managed monitoring, threat hunting or an incident response retainer instead.
• Your problem is compliance paperwork more than attacks: a part-time security leader (vCISO) or a compliance service may come first.
• You need a FedRAMP-authorized service for federal work: confirm the specific authorization before shortlisting.

The seven criteria that decide it

1. Response authority (pass/fail). Can the provider isolate a host, disable an account or block an IP on its own, at 2 a.m., without waiting for you? Get the actions, the approval rules and the timelines in writing.
2. Coverage beyond the endpoint. Endpoints alone aren't enough. Confirm identity (Entra ID, Okta), email, cloud (AWS, Azure) and SaaS such as Microsoft 365 are in scope, not add-ons.
3. Works with what you own. Bring-your-own EDR (CrowdStrike, SentinelOne, Microsoft Defender) or the provider's own agent? A forced rip-and-replace adds cost and risk.
4. Measured speed. Ask for median time to detect and time to contain from real customers, and a contractual SLA for both. "Fast" is not a number.
5. Evidence you can hand over. Monthly reports your insurer and board can read: coverage percentage, incidents, response times. This is what wins premium credits.
6. Incident response included or priced. Is full IR (forensics, recovery) in the subscription, capped by hours, or a separate retainer?
7. Who is watching. Where the SOCs are, who staffs them, and whether your data stays in the US.

Shortlist by situation

All providers below are in the IQ4hire portfolio. This is where to start, not a ranking; fit depends on your stack and size.

Questions to ask before you sign

1. What can you do on our systems without calling us first, and what needs our approval?
2. What were your median time to detect and time to contain last quarter, across customers like us?
3. Which of our tools do you support as they are, and what would we have to replace?
4. Are identity, email, cloud and SaaS included, or priced separately?
5. Is incident response included? How many hours, and what happens after they run out?
6. Show us the monthly report you'd give our insurer and our board.
7. Where are your SOCs, who staffs them, and where is our data stored?
8. What does it cost to leave, and do we keep our logs and detections?

What it costs and the traps

MDR is priced per endpoint or per user, usually on a one- to three-year term. Published ranges vary widely by scope: one 2026 pricing review puts MDR at roughly $9 to $75 per endpoint or user per month, against about $3 to $20 for the EDR tool alone. (Unio pricing index) The spread is mostly about what is included, not the logo.

Watch for:

• "MDR" that only alerts. Gartner warns that technology-first offerings called MDR often don't deliver human-led response. If they can't contain, it isn't MDR. (Gartner)
• Scope priced à la carte. A low per-endpoint rate that excludes identity, cloud or email ends up costing more.
• Incident response hours that run out in the middle of an incident.
• Forced EDR swaps that turn a service decision into a migration project.
• Log retention too short for your insurer or a forensic investigation.
• Change of ownership. Ask how the platform and staffing change after an acquisition.

Comparable pricing for your environment: ask us. We put quotes on the same scope so the numbers can actually be compared.

How IQ4hire helps

We match your environment (endpoints, identity, cloud, compliance, insurer requirements) to the MDR providers in our portfolio that fit, get quotes on the same scope, and negotiate response authority, SLAs and exit terms, with no RFP.

Schedule a diagnostic →

Sources

• Cyber Advisors, Cyber Insurance in 2026: The Controls Underwriters Expect
• IRONSCALES, Cyber Insurance in 2026: What to Prioritize
• SecurityInfoWatch, LevelBlue Completes Trustwave Acquisition
• Gartner, Market Guide for Managed Detection and Response and 2024 summary
• Unio, MDR and EDR pricing index