If you’ve read our piece on why endpoint protection alone no longer protects a 100-person creative agency, you already know the software on your Macs won’t catch everything by itself. The next decision is how much human cover to put behind it, and that’s where managed detection and response (MDR) comes in.
Our answer for most SMBs: if nobody reads your endpoint alerts outside office hours, and nobody could contain a compromised Mac at 2 am without waking your one IT person, MDR is worth pricing. The three-question test at the end takes two minutes and will tell you which side of that line you’re on.
What does MDR add that endpoint protection can’t do on its own?
Endpoint protection is software. It blocks known malware, watches for suspicious behaviour on each device and raises an alert when something looks wrong. When it records behaviour in detail and lets you act on a device remotely, you’ll see it called EDR (endpoint detection and response).
What the software can’t do is decide whether an alert matters. Someone has to read it, look at what the device was doing, judge whether it’s a real attack or a designer running an odd plugin, and act. MDR is that work done for you by analysts around the clock: monitoring alerts, correlating events across devices and accounts, and containing affected devices or accounts when an alert turns out to be real.
The same alert at 2 am, two ways
Without MDR, an alert at 2 am sits in the console until someone opens it in the morning. If it was the start of something, the attacker has had six or seven hours with that laptop and whatever accounts were signed in on it.
With MDR, an analyst picks it up that night, checks what’s happening and, if it’s real, contains it. In the morning, you get a report of what happened and what was done about it.
MDR sits on top of endpoint protection
MDR needs endpoint protection underneath it, because the analysts work from what the endpoint software sees. At Dr Logic, MDR is an add-on that requires endpoint protection, and vulnerability and CVE detection needs both.
Above MDR sits the security operations centre. MDR watches your devices and the accounts on them. A SOC looks across the wider estate as well, pulling in network, cloud and log data and running longer investigations. If you’re weighing that step up, our pieces on 24/7 threat monitoring, SOC vs SIEM and the future of SOC cover it. For most of our clients, MDR is the right stopping point.
Who needs MDR, and who can manage without it?
You can manage without MDR if you have someone in-house with security skills who reads alerts out of hours, has the authority to isolate a device without asking permission, and isn’t the only person who can do it. All three need to be true, because a single person still sleeps, goes on holiday and leaves eventually.
That combination is rare at a lot of SMBs. The usual setup is one capable IT person covering everything from new starters to the Wi-Fi, with security alerts as one item on a long list. That person can’t also be on call every night, and it isn’t fair to expect it.
What does MDR actually do on a Mac fleet at two in the morning?
Most MDR marketing is written with Windows in mind, so it’s worth being specific about Macs.
When the endpoint agent on a Mac flags something, the analyst starts by looking at what the device was doing: which process started, what it touched and what it tried to connect to. If it’s a false alarm, it’s closed and noted. If it’s real, they move to containment.
Whatever the actions are, agree in advance which ones the analysts can take without calling you. If they have to wake someone for permission to isolate a laptop, a lot of the value of out-of-hours cover disappears.
The SOC takes over where an incident spreads beyond devices and accounts: into cloud services, the network or a longer investigation of how an attacker got in. That boundary is worth knowing before you need it, so you know who’s responsible for the next step.
The three-question test
Answer these honestly:
- Does anyone read your endpoint alerts outside office hours?
- If an insurer or client asked tomorrow for evidence of 24/7 monitoring or managed detection, could you provide it?
- Could someone isolate a compromised laptop at 2 am without waking the one person who knows how?
Two or more answers of no means MDR is worth pricing. Before you do, ask your current provider three things: who reads our alerts at 2 am, what are they allowed to do without calling us, and how do we find out what happened?
Related articles
- Endpoint protection alone no longer protects a 100-person creative agency
- Vulnerability and CVE detection: closing the Cyber Essentials Plus window
- Why your business needs 24/7 threat monitoring
FAQs
What's the difference between EDR and MDR?
EDR is software on each device that records behaviour, flags suspicious activity and lets someone act remotely. MDR is a service: analysts monitor those alerts around the clock, investigate them and contain affected devices or accounts. MDR needs endpoint protection underneath it, because the analysts work from what that software sees.
Do small businesses need MDR?
The deciding factor is coverage. If someone with security skills reads alerts out of hours and can isolate a device without permission, you may not. Most agencies of 70 to 150 people have one IT person covering everything, which is where MDR earns its place.
Is MDR the same as a SOC?
No. MDR focuses on your devices and the accounts on them, with analysts monitoring and responding around the clock. A security operations centre looks across the wider estate, including network, cloud and log data, and handles longer investigations. For most mid-sized agencies, MDR is the sensible level.
Does MDR work on Macs?
It can, but check what the service can actually do on macOS, since much MDR marketing assumes Windows. Ask your provider which response actions work on a Mac, such as isolating it from the network, and which of them analysts can take without calling you first.
