Tools
Managed detection and response, or build your own SOC
The honest cost comparison, including the part vendors leave out: what a 24 hour rota actually costs once you account for people leaving.
Microsoft
Huntress
The question is coverage, not capability
Most organisations asking this question can already detect things. They have Defender, they may have Sentinel, and alerts are arriving. What they do not have is somebody looking at those alerts at two in the morning on a Sunday.
That makes this a staffing question wearing a technology costume. The tooling comparison is the easy part and rarely the deciding factor.
What a genuine 24 hour rota costs
Covering every hour of every week needs, at minimum, four to five analysts once you account for leave, sickness, training and the fact that people resign. Three people cannot cover 168 hours a week sustainably, and attempting it is how you lose the three.
That headcount is the number to compare an MDR contract against. Comparing a contract against one analyst's salary is the mistake that makes building look cheap.
| In-house | MDR | |
|---|---|---|
| 24 hour coverage | Needs 4 to 5 analysts | Included |
| Context on your environment | ||
| Response authority | Depends on contract | |
| Cost predictability | ||
| Knowledge retained when someone leaves | ||
| Time to be operational | 6 to 12 months | Weeks |
Response authority is the clause to read carefully. A provider who can only advise you at 3am has not solved the problem you bought them for.
Providers worth pricing
Links above go to the vendor. Where a link is marked as an affiliate link, a purchase may earn this site a commission at no cost to you, and it played no part in the ranking.
The verdict
MDR for almost anyone under about 1,000 seats
The rota maths does not work below that scale. Buying coverage is cheaper and faster than building it, and you get it this quarter rather than next year.
Hybrid
In-house during business hours where the environment knowledge lives, MDR overnight and at weekends. More common than either pure model and usually the honest answer at larger scale.
Skip MDR if nobody internally will act on what they escalate. A provider that raises an incident to an inbox nobody reads has changed who is awake, not whether you are protected.
Disclosure. Some links on this site are affiliate links. Scoring weights are published before any programme is joined, and commission is never a ranking input. Full policy, and the method behind this guide.