Managed detection and response (MDR) is a service in which an outside company's analysts watch a customer's security alerts around the clock, investigate them, and stop real attacks on the customer's behalf. So the outside company runs a security operations centre (SOC) for the customer, from its own premises.
Most companies cannot run a SOC of their own. Watching alerts at every hour needs several analysts working in shifts, and good analysts are hard to hire. Say a pharmacy chain in Indore has 120 stores and an IT team of three. At 1 a.m. on a Sunday, the EDR software on a billing computer in one store sees a program trying to copy saved passwords. Nobody at the company is awake to read the alert.
With MDR, someone is awake. The MDR provider connects its systems to the customer's security tools: the endpoint detection and response (EDR) software on every laptop, the firewall and the cloud security tools. Alerts from all of them reach the provider's analysts. The analysts check each alert, often with help from an AI SOC analyst. When an alert is real, they act at once. For instance, they cut the store's billing computer off from the network, so the attacker cannot reach the other stores. Then they call the customer and explain what happened and what to do next.
The key question in any MDR contract is how far the provider may act without asking the customer first. Some customers allow the provider to isolate laptops, but not to disable accounts. The older kind of service only forwarded alerts and acted on none of them. MSSP vs MDR explains the difference.
A provider sees attacks across hundreds of customers, so it often spots a new kind of attack early. Some providers also run a customer's SIEM, for customers who own the log store but have nobody to read it. MDR is one example of a managed service. Indian IT services companies also run MDR for their clients.