Managed detection and response (MDR) services are security platforms partially or completely managed by the vendor rather than customers’ internal security teams. The best MDR solutions in the industry typically offer features like threat hunting, alert management, and digital forensics. To help you select the best MDR for your organization, we’ve analyzed solutions from leading providers and narrowed the list down to a few key players.
Here are the six best managed detection and response solutions for businesses:
- Rapid7 Managed Threat Complete: Best overall MDR solution
- Sophos MDR: Most user-friendly MDR solution
- Alert Logic MDR: Best for advanced infrastructure monitoring needs
- Mandiant Managed Defense: Best for Google Cloud and Microsoft integrations
- SentinelOne Vigilance Respond: Best for dedicated digital forensics
- Cybereason Defense Platform: Best enterprise-grade MDR solution
Table of Contents
Top MDR Solutions Comparison
The following table gives a brief overview of our top six MDR solutions and availability of a few features, as well as free trials.
| Alert Triage | Root-Cause Analysis | Digital Forensics | MITRE Mapping | Free Trial | |
|---|---|---|---|---|---|
| Rapid7 | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
| Sophos | ❌ | ✔️ | ❌ | ✔️ | ✔️ |
| Alert Logic | ✔️ | ❌ | ❌ | ✔️ | ❌ |
| Mandiant | ✔️ | ✔️ | ✔️ | ✔️ | ❌ |
| SentinelOne | ✔️ | ✔️ | ✔️ | ❌ | ❌ |
| Cybereason | ✔️ | ✔️ | ➕ | ✔️ | ❌ |
✔️= yes; ❌=not available; ➕=add-on
Although different vendors scored highly in certain categories, I found that Rapid7 Managed Threat Complete is the best overall option for businesses looking for a full-featured MDR solution. Continue reading to learn how each scored in terms of pricing and features, or jump down to see how I evaluated the products.
Rapid7 Managed Threat Complete – Best Overall MDR Solution
Overall Rating: 4.1/5
- Core offerings: 4.8/5
- Usability features: 3.8/5
- Customer support: 4.5/5
- Additional features: 3.8/5
- Pricing: 3.2/5
Rapid7 is a well-known MDR provider offering incident response, vulnerability management, and extended detection and response on its Managed Threat Complete platform. Features include digital forensics and incident response, with guidance for eliminating threats from Rapid7’s expert team. Users receive access to the XDR and VM platform and can perform their own investigations. Consider Rapid7 if you want to combine multiple security solutions in one suite.
Pros
Cons
- Contact for quote: Custom pricing available
- Free trial: 30 days for InsightIDR, which has features included in the MDR solution
- Free demo: Contact to schedule
- Security posture assessments: Rapid7 assesses your organization’s current security posture after the Insight agent deploys to 80% of your endpoints.
- Access to platform: Customers can use the XDR and vulnerability management platform to do investigations on their own and see what Rapid7’s analysts are doing.
- Asset quarantine: Users can isolate assets until an investigation is resolved in InsightIDR (which has capabilities included in the MDR solution).
- Forensic investigations: Rapid7 gives customers incident reports with remediation suggestions so they know what’s going on and can fix issues as needed.
While Rapid7 is an incredibly strong solution, it may be too complex or expensive for some users. If you’re looking for a more straightforward, simpler MDR, consider Sophos.
Sophos MDR – Best User-Friendly MDR Solution for Businesses
Overall Rating: 4/5
- Core offerings: 4/5
- Usability features: 4.5/5
- Customer support: 5/5
- Additional features: 2/5
- Pricing: 4/5
Sophos is a popular MDR vendor focused on simplicity and usability. There’s a MDR option specifically for SMBs, but they can also choose to manage their own security on the Sophos Central platform. Users have access to phone, chat, and community forum support. Sophos is popular with small businesses or inexperienced teams but still a great choice for enterprises, with features like threat containment, root-cause analysis, and endpoint health checks.
Pros
Cons
- Contact for quote: Custom pricing available; pricing calculator available for estimates
- Free trial of XDR solution: 30 days
- Free demo: Contact to schedule
- Continuous monitoring: Sophos’ team monitors customer environments 24/7 and notifies them when they find a threat.
- Integrations with third parties: Supported categories include third-party endpoint, firewall, identity, email, and backup solutions.
- Health reports: Sophos’ team sends weekly and monthly reports to customers, both dashboard-style and executive-level.
- Microsoft Defender investigations: Sophos experts handle alerts from Microsoft Security solutions like Defender and Sentinel, responding to potential incidents.
While Sophos is a strong MDR product, it may not have all the features a larger enterprise wants. If you’re looking for advanced features, check out Rapid7.
Alert Logic MDR – Best for Advanced Infrastructure Monitoring Needs
Overall Rating: 3.8/5
- Core offerings: 4.2/5
- Usability features: 4.1/5
- Customer support: 4.5/5
- Additional features: 3.1/5
- Pricing: 2.6/5
Alert Logic offers an MDR solution that’s notable for its extensive monitoring capabilities. The Alert Logic platform performs network, file integrity, and log data monitoring and is capable of scanning for PCI noncompliance. It also uses hybrid asset discovery to find endpoints. Alert Logic MDR can be deployed on premises, in the cloud, or in a hybrid configuration. I recommend it for businesses that have hybrid IT environments and a variety of assets to scan.
Pros
Cons
- Contact for quote: Custom pricing available; some reseller pricing information
- Free demo: Contact to schedule
- Web log analytics: Alert Logic can detect web application attacks, like unauthorized vulnerability scans and web reconnaissance, using logs of network activity.
- Cloud change monitoring: Find unauthorized changes made to important business files, including file deletion.
- PCI scans: Alert Logic analyzes assets against PCI-DSS standards to determine whether your environment is compliant.
- CIS benchmarking: Assess whether certain cloud environments are compliant with Center for Internet Security guidelines.
Alert Logic is a helpful tool for teams that want detection and response to secure their whole network. However, it doesn’t offer incident quarantine features. If that’s an important capability for you, consider Cybereason instead.
Mandiant Managed Defense – Best for Google Cloud & Microsoft Integrations
Overall Rating: 3.8/5
- Core offerings: 4.2/5
- Usability features: 3.2/5
- Customer support: 5/5
- Additional features: 3.5/5
- Pricing: 2.6/5
Mandiant Managed Defense, owned by Google Cloud, is an MDR with plenty of useful features, including remote containment, threat hunting, and mapping to the MITRE ATT&CK framework. While it may lack the flashiness of some of its competitors, it’s a strong choice for integrations with Microsoft and Google products, including Google Cloud Platform, Active Directory, and Microsoft Defender. Consider Mandiant if you’re a Google Cloud or Azure organization.
Pros
Cons
- Contact for quote: Custom pricing available; some reseller pricing information
- Free demo: Contact to schedule
- Dashboards: You can watch Mandiant experts’ progress and view articles with specific threat intelligence information that they’ve linked in the dashboard.
- Threat hunting campaigns: Follow the threat hunters’ progress and view threats mapped to the MITRE framework.
- Partnerships: Mandiant offers Managed Defense for multiple other vendors, including CrowdStrike Falcon, SentinelOne, and Trellix.
- Transformational objectives: The MDR team works with you to plan security objectives and then successfully carry them out, providing triage and investigations.
Mandiant offers many core MDR features, but if you’re looking for widespread coverage across your entire IT infrastructure, I recommend checking out Alert Logic. It monitors network traffic from the network host’s interface and also detects changes to public cloud environments.
SentinelOne Vigilance Respond – Best for Dedicated Digital Forensics
Overall Rating: 3.7/5
- Core offerings: 4/5
- Usability features: 3.9/5
- Customer support: 4.8/5
- Additional features: 3/5
- Pricing: 2.2/5
SentinelOne Vigilance Respond and Vigilance Respond Pro are the security provider’s MDR services. They offer advanced incident response and integrations with WatchTower for businesses that want to dig deep into attacker behavior, with post-mortem consultations on security incidents and code extractions. I recommend Vigilance Respond for teams specifically focused on forensics, with features like malware reversal and root-cause analysis.
Pros
Cons
- Contact for quote: Custom pricing available; some reseller pricing information
- Free demo: Contact to schedule
- Forensics: SentinelOne provides access to digital forensics experts that help your team contain incidents.
- 24/7 prevention: Vigilance Respond has around-the-clock experts detecting threats in your business environment and responding to them.
- Quarterly health checks: Configuration health checks are part of Vigilance Respond Pro and are related to hardening, strong policies and configurations, and agent health.
- WatchTower add-on: If your business wants threat hunting for advanced persistent threats and crimes, you can pay extra to use SentinelOne WatchTower.
SentinelOne is a strong choice for teams that want dedicated digital forensics investigations. However, it doesn’t offer log management features. If you’re looking for those, consider Mandiant, which also supports forensic investigations.
Cybereason – Best Enterprise-Grade MDR Solution
Overall Rating: 3.6/5
- Core offerings: 4.2/5
- Usability features: 3.6/5
- Customer support: 4/5
- Additional features: 3/5
- Pricing: 2.6/5
Cybereason is an enterprise-grade MDR ideal for experienced security teams. Its interface can be challenging for less experienced users, but the strong security you get from Cybereason is the trade-off — it had near-perfect MITRE scores last year. I recommend Cybereason’s Defense Platform to already-developed programs that want to boost their security further with advanced features like guided remediation, malicious operations scores, and quarantining incidents.
Pros
Cons
- Contact for quote: Custom pricing available; some reseller pricing information
- Free demo: Contact to schedule
- Mobile app: Cybereason’s app is available for both iOS and Android and allows users to view MalOps and perform remediation actions.
- Reporting: Monthly MalOps reports give users insights into specific MalOps for that period of time.
- Guided remediation: Recommendations help users contain threats and suggest what other places may be compromised.
- MalOp scores: Based on a behavioral score, analytics from Cybereason experts, and the importance of assets, comprehensive severity scores help triage issues better.
Cybereason has many advanced detection and response features, but it’s not the easiest platform to use. If you’re looking for a more straightforward MDR solution, consider Sophos instead.
Top 5 Features of MDR Solutions
When you’re selecting a managed detection and response platform, look for features like alert triage, threat hunting, incident containment, continuous monitoring, and log management.
Alert Management
Alert triage and management reduces the manual workload for security teams that are already inundated with alerts. Sometimes security personnel receive hundreds of alerts a week, and it’s incredibly challenging to sort through them and determine which are first priority. MDR managed services handle alerts for you, identifying which are most important.
Threat Hunting
Threat hunters on MDR or SOC teams look for both existing or known threats and potential threats, like trails or traces left by attackers. Ideally, a threat hunting strategy includes both automation and humans; you need skilled analysts for threat hunting. It’s one of the most important features of an MDR platform since threat hunting is designed to unearth highly elusive or complex threats.
Incident Quarantine
Once the SOC team finds an incident, they should quarantine it if possible or if that makes sense for the threat in question. Some attacks or malicious software can spread through a system, and the sooner it’s contained, the less opportunity it has to continue infecting the network or endpoint. Not all MDR vendors mention quarantining in data sheets, so check with potential providers before assuming they offer it.
24/7 Monitoring
One of the top benefits of MDR is that analysts work around the clock so you don’t have to. This is particularly beneficial for smaller businesses and limited security teams. When your team is gone on nights, weekends, and vacations, you don’t have to worry about no one being present when threat actors launch attacks. MDR analysts monitor systems 24/7 all year.
Log Collection & Storage
Collecting data from log files is a key capability of MDR solutions since logs hold significant amounts of information with potentially valuable insights. Logs are also helpful for identifying strange patterns or threat trends over time. MDR solutions store logs for different amounts of time; 12 months is a common period.
How I Evaluated the Best MDR Solutions
To evaluate managed detection and response providers and their products, I created a scoring rubric with five key categories that buyers should look for in MDR products. Each main category had a specific weight based on importance and included multiple subcriteria that I also weighted. I scored multiple platforms, chose the six top-scoring vendors, and identified a main use case for each based on their overall scores and additional product research.
Evaluation Criteria
I first looked at core features like alert management and threat hunting, which are significant for day-to-day MDR operations. Next, I evaluated features that contribute to ease of use, such as reporting capabilities, and customer support, including support team hours and phone calls with the vendor’s team. Lastly, I considered nice-to-have features, like penetration testing and guided response, and pricing, which included free trials and licensing transparency.
- Core offerings (30%): I evaluated the most important features of MDR platforms, such as 24/7 monitoring and threat intelligence.
- Criterion winner: Rapid7
- Usability features (20%): I looked at factors that improve ease of use, like product documentation, demos, and reporting.
- Criterion winner: Sophos
- Customer support (20%): I considered availability of support teams, as well as phone options, onboarding services, and customer service managers.
- Criterion winner: Multiple winners
- Additional features (15%): I included subcriteria like mapping to the MITRE ATT&CK framework, penetration testing, and vulnerability scans.
- Criterion winner: Rapid7
- Pricing (15%): I scored vendors based on transparency of pricing information, as well as free trials, pricing calculators, and availability of billing options.
- Criterion winner: Sophos
Frequently Asked Questions (FAQs)
What’s the Difference Between MDR & SIEM?
A security information and event management (SIEM) solution helps businesses handle the barrage of alerts, or events, they receive and respond to. MDR solutions differ because they focus on immediate response and are managed by the vendor who sells the solution (or an outsourced security operations team). While SIEMs and MDRs perform many similar tasks, they have different approaches and focuses.
Which Is Better: MDR or XDR?
Whether you should have an MDR or an XDR solution depends on your business’s needs. If you’d prefer a vendor to manage most of the security operations, choose an MDR. But if you have an experienced security team that’s interested in configuring and running the solution over time, you may want to consider an XDR platform that isn’t fully managed.
Is MDR Worth It?
In short, yes, an MDR solution is worthwhile for teams that are feeling overwhelmed by the alerts they receive or can’t manage their security with the team they currently have. But on the flip side, some businesses may find less benefit in an MDR because they already have a built-out security team or want to customize a detection and response platform themselves. MDRs are a strong choice depending on your organization’s specific needs.
Bottom Line: Evaluate Your Needs Before Choosing MDR
While still a bit of a buzzword in the security industry, MDR is a beneficial technology for teams that want to outsource their security operations to always-available experts. Then business leaders know systems and endpoints will be monitored even when they can’t be available, like weekends, evenings, and holidays. Look for an MDR vendor who will be a true partner not only through the implementation process but years down the road as well.
If a managed approach to your detection and response strategy doesn’t sound like a fit, check out our list of the best endpoint detection and response (EDR) products instead. This guide covers product features, pros and cons, and ideal use cases based on your business needs.
