Managed detection and response (MDR)

What it is

Security tools such as Microsoft Defender for Business produce alerts. MDR is the service that makes sure a qualified person looks at them. It combines tooling, which collects signals from your devices, accounts and email, with people who triage alerts, investigate incidents, hunt for threats the tools missed and act when they find an attack.

Microsoft’s own MDR service, Defender Experts MDR, is a useful reference for what the term means. Microsoft describes its analysts managing the incident queue around the clock, triaging and investigating incidents, and either taking action or guiding the customer’s team through the response. Independent providers offer similar services, often sized for smaller businesses.

Providers differ on response. Some will isolate a laptop or disable an account themselves. Others will phone you and tell you what to do. Check which you are buying.

Why it matters for a UK small business

Attacks don’t keep office hours, and a small business rarely has someone watching the Defender portal at 2am on a Sunday. MDR buys that cover without hiring a security team.

What it usually doesn’t cover

MDR is built to detect and respond to attacks. Most services don’t check whether your security settings are still what you agreed. If a Conditional Access policy is switched to report-only, or MFA is turned off for one user, that isn’t an attack and won’t raise an incident. That gap is configuration drift, and it needs its own monitoring.

Questions worth asking a provider:

1. Which Microsoft 365 policies do you check, and how often?
2. When a setting changes, who notices and who puts it right?
3. Do you take action yourselves, or tell us what to do?
4. What hours does monitoring and incident response cover?

How &DEV helps: our Managed Plus service, part of the cyber assurance uplift, combines round-the-clock monitoring and incident response with continuous checks that your Microsoft 365 configuration still matches what we agreed.