# What is a managed SOC? SOC vs MDR vs EDR.

> What a managed SOC is, how it differs from MDR and EDR, and which a small or medium business actually needs, in one comparison table.

Canonical: https://cybersecuritylondon.com/what-is-a-managed-soc


By Cyber Security London, published 11 October 2026.

**In short:** A managed SOC (security operations centre) is an outsourced team that monitors your systems around the clock and responds to threats. EDR is the software on your devices that detects suspicious behaviour. MDR combines EDR with people who watch and respond 24/7. Most small and medium businesses start with MDR.

## How do SOC, MDR and EDR differ?

|  | EDR | MDR | Managed SOC |
| --- | --- | --- | --- |
| What it is | Software on laptops and servers | EDR plus a 24/7 team that investigates and responds | An outsourced security team watching many sources |
| What it watches | Devices | Mainly devices, often email and identity | Devices, cloud, email, identity, network and logs |
| Who responds | Your own team | The provider's analysts | The provider's analysts |
| Out-of-hours cover | Only if you provide it | Yes, 24/7 | Yes, 24/7 |
| Best for | Businesses with their own security staff | Most small and medium businesses | Larger or regulated organisations |

## Why not build an in-house SOC?

Round-the-clock monitoring needs several trained analysts working shifts, plus tools and processes. For most small and medium businesses, a managed service provides the same cover for a predictable monthly cost.

## What should a managed service include?

- 24/7 monitoring and alert investigation by analysts.
- Agreed containment actions, such as isolating an infected device.
- Clear escalation to named contacts.
- Regular reports in plain English.

## Frequently asked questions

### What does SOC stand for?

Security operations centre: a team that monitors an organisation's systems for threats and responds to them.

### Does MDR replace antivirus?

Usually, yes. Modern EDR, which MDR is built on, replaces traditional antivirus and adds detection and response.

### How is managed SOC priced?

Typically a monthly fee per device or per user, depending on which data sources are monitored and the level of response.

## Sources

- [Incident management, National Cyber Security Centre](https://www.ncsc.gov.uk/collection/incident-management)

## How we can help

- [24/7 Monitoring (SOC)](https://cybersecuritylondon.com/managed-soc-monitoring)
- [Incident Response](https://cybersecuritylondon.com/incident-response)

## Contact

Email enquiry@cybersecuritylondon.com or use the enquiry form at https://cybersecuritylondon.com/#contact. Cyber Security London, The Leather Market, London Bridge, London.