A managed SOC (security operations centre) is an outsourced team that monitors your systems around the clock and responds to threats. EDR is the software on your devices that detects suspicious behaviour. MDR combines EDR with people who watch and respond 24/7. Most small and medium businesses start with MDR.
How do SOC, MDR and EDR differ?
| EDR | MDR | Managed SOC | |
|---|---|---|---|
| What it is | Software on laptops and servers | EDR plus a 24/7 team that investigates and responds | An outsourced security team watching many sources |
| What it watches | Devices | Mainly devices, often email and identity | Devices, cloud, email, identity, network and logs |
| Who responds | Your own team | The provider's analysts | The provider's analysts |
| Out-of-hours cover | Only if you provide it | Yes, 24/7 | Yes, 24/7 |
| Best for | Businesses with their own security staff | Most small and medium businesses | Larger or regulated organisations |
Why not build an in-house SOC?
Round-the-clock monitoring needs several trained analysts working shifts, plus tools and processes. For most small and medium businesses, a managed service provides the same cover for a predictable monthly cost.
What should a managed service include?
- 24/7 monitoring and alert investigation by analysts.
- Agreed containment actions, such as isolating an infected device.
- Clear escalation to named contacts.
- Regular reports in plain English.
Frequently asked questions
Security operations centre: a team that monitors an organisation's systems for threats and responds to them.
Usually, yes. Modern EDR, which MDR is built on, replaces traditional antivirus and adds detection and response.
Typically a monthly fee per device or per user, depending on which data sources are monitored and the level of response.