Managed Detection and Response: The Missing Layer

Most small businesses have antivirus and a firewall, and assume that is enough. It is not. The attacks that cause real damage are the ones that slip past those tools and sit quietly inside a network for weeks.

That gap, between a threat getting in and someone noticing, is where businesses lose money. Closing it is exactly what Managed Detection and Response does.

This guide explains what MDR is, how it works, what it typically costs, and how to tell whether your business actually needs it.

What Is Managed Detection and Response?

Managed Detection and Response is a service that watches your systems 24 hours a day, spots suspicious activity, and acts to stop it. It pairs detection technology with a team of human analysts who investigate alerts and respond on your behalf.

The key word is response. Plenty of tools can raise an alert. The value of MDR is that someone is on the other end, around the clock, deciding what the alert means and doing something about it.

This is the layer that sits beyond antivirus and firewalls. Where endpoint security protects individual devices, MDR watches the whole environment for the signs of an attack in progress.

How is MDR different from antivirus?

Antivirus blocks known threats by matching them against a list of signatures. Managed Detection and Response looks for behaviour, the unusual activity that signals an attacker is already inside, even when no known malware is involved.

Antivirus is passive and automated. MDR is active and human-led. The two work together, but one cannot replace the other.

Think of antivirus as a lock on the door. It stops the obvious intruders, but it does nothing once someone is already inside using stolen keys. MDR is the security guard who notices that the person walking the corridor at 2am does not belong there.

What does the response part actually involve?

Response means containing a threat once it is found, rather than simply raising an alert and leaving you to act. That can include isolating an infected device, blocking a malicious account, and stopping an attack from spreading across the network while the cause is investigated.

A good provider will take agreed actions immediately, then work with you on the cleanup. Speed matters here, because the longer an attacker has access, the more damage they can do.

How Does Managed Detection and Response Work?

Managed Detection and Response works in three continuous stages: detect, investigate, and respond. Monitoring tools gather signals from across your systems, analysts review anything suspicious, and the team acts to contain genuine threats.

Stage one: detection

Detection is the constant collection and analysis of activity across your devices, network, and cloud services. Sensors feed data to a detection platform that flags anything outside normal patterns, such as a login from an unexpected country or a file encrypting at speed.

Modern detection leans on behavioural analysis rather than signatures alone, which is how it catches threats that have never been seen before.

Stage two: investigation

Investigation is where human analysts separate real threats from false alarms. A security operations centre, often called a SOC, reviews each alert, gathers context, and decides whether it represents a genuine attack.

This step is the reason Managed Detection and Response is worth paying for. Detection tools generate a flood of alerts, and most are noise. Skilled analysts cut through it so your business only hears about what matters.

Stage three: response

Response is the action taken to contain and remove a confirmed threat. Depending on the agreement, the team isolates affected systems, removes the attacker’s access, and guides recovery, all within minutes rather than days.

Fast response keeps the damage small. It works hand in hand with a tested disaster recovery plan, so that if an incident does cause disruption, the business can return to normal quickly.

Why Do Small Businesses Need Managed Detection and Response?

Small businesses need Managed Detection and Response because they are targeted constantly and rarely have the staff to watch for threats themselves. Attackers favour smaller organisations precisely because their defences are usually thinner.

Are small businesses really a target?

Yes. Attackers automate their attacks and scan for any weakness, regardless of company size. A small Christchurch or Dunedin business is just as likely to be hit as a large enterprise, and is often less prepared to recover.

Many breaches are not personal. They are opportunistic, hitting whatever system happens to be exposed. That makes constant monitoring valuable for a business of any size.

What happens without round-the-clock monitoring?

Without monitoring, an attacker can operate undetected for weeks. The average time to identify a breach is measured in months, and every day of access gives the attacker more data, more control, and more leverage.

Most attacks begin outside business hours, when no one is watching. Managed Detection and Response covers exactly those gaps, including nights, weekends, and public holidays.

Can a small team do this in-house?

Running detection and response in-house means hiring specialists, buying tools, and staffing cover around the clock. For most small businesses that is neither affordable nor practical, which is why the service model exists.

A single experienced security analyst commands a substantial salary, and round-the-clock cover needs several of them. Add the cost of the detection platform and the ongoing tuning, and an in-house capability quickly runs past what most small businesses can justify.

MDR delivers enterprise-grade protection as a managed service, in the same way that managed IT services give a business a full IT department without the headcount.

What Does Managed Detection and Response Include?

Managed Detection and Response usually includes continuous monitoring, threat detection, expert investigation, incident response, and regular reporting. The exact mix varies by provider, so it pays to confirm what is covered before you sign.

What should be in the service?

A complete Managed Detection and Response service should cover the essentials below as standard. If a provider leaves several of these out, it is not true MDR.

• Round-the-clock monitoring across devices, network, and cloud
• Behavioural threat detection, not just signature matching
• Human analysts in a security operations centre
• Defined response actions to contain confirmed threats
• Regular reporting on threats detected and actions taken

What is the difference between MDR and EDR?

EDR, or endpoint detection and response, is a technology that watches individual devices. Managed Detection and Response is a service that includes EDR but adds the human analysts, the monitoring of the wider environment, and the response that turns alerts into action.

Put simply, EDR is a tool and MDR is a managed service built around tools like it. Buying the tool without the team leaves you with alerts that no one is watching.

What Kinds of Threats Does MDR Catch?

MDR catches the threats that get past traditional defences, including stolen credentials, ransomware in its early stages, and attackers moving quietly through a network. These are the incidents that antivirus and firewalls routinely miss.

The common thread is that each of these involves activity inside the network rather than an obvious file to block. That is exactly what behavioural monitoring is built to see.

Stolen login credentials

When an attacker logs in with a valid username and password, no alarm sounds, because the credentials are real. MDR notices the warning signs around that login instead: an unusual location, an odd hour, or access to systems the account never normally touches.

Stolen credentials are one of the most common ways businesses are breached, often through phishing scams that trick staff into handing over their details. Monitoring for misuse is how the damage gets caught.

Ransomware in its early stages

Ransomware gives itself away before it locks everything down, usually through a burst of rapid file encryption. MDR is built to spot that pattern and isolate the affected device within minutes, stopping the spread before it reaches the whole network.

That early containment is the difference between one cleaned machine and a business-wide outage that takes days to recover from.

Attackers moving through the network

Once inside, a skilled attacker moves sideways, hunting for valuable data and higher privileges. This lateral movement is slow and deliberate, designed to avoid notice. Behavioural monitoring tracks these small, connected steps and raises the alarm before the attacker reaches what they came for.

How Does MDR Compare to Other Security Options?

MDR sits between basic do-it-yourself security and a fully staffed in-house security team. It gives a small business enterprise-grade detection and response without the cost of building that capability alone.

MDR versus building it in-house

Building detection and response in-house means recruiting scarce security specialists, buying and tuning the tools, and rostering staff to cover every hour of every day. For most small and medium businesses, the salary cost alone makes that impractical.

MDR spreads the cost of the technology and the analyst team across many clients, so each business pays a fraction of what it would cost to run alone. That shared model is the reason round-the-clock protection is affordable for a smaller business.

Pricing is usually a predictable monthly fee based on the number of users or devices monitored, which makes it easy to budget for and simple to scale as the business grows. The right starting point is a conversation about what your business actually needs, rather than paying for cover you will never use.

MDR versus a managed firewall alone

A managed firewall and network security controls are important, but they mostly guard the perimeter. They do little once a threat is inside. MDR assumes that some attacks will get through and focuses on catching them quickly, which is why the two approaches belong together.

Where MDR fits in a layered approach

MDR is one layer in a complete security programme rather than a replacement for the others. It works alongside endpoint protection, email filtering, staff training, and tested backups, adding the around-the-clock detection and response that ties the whole programme together.

How Do You Choose a Managed Detection and Response Provider?

Choose a Managed Detection and Response provider on the strength of its response promises, its analysts, and its transparency. The headline technology matters far less than what the provider actually does when a threat is found.

What questions should you ask?

A few direct questions will reveal how serious a provider is. Ask each candidate the following before committing.

• What response actions will you take on my behalf, and how fast?
• Is your security operations centre staffed 24/7, and where is it based?
• How do you keep alert noise down so we only hear what matters?
• What reporting will we receive, and how often?

Does local support matter for MDR?

A local provider understands your business and can coordinate response alongside your wider IT support. When security and day-to-day support work from the same playbook, incidents are handled faster and with less confusion.

It also means a real relationship rather than a faceless overseas service. When an incident happens, you want people who know your environment already, not a stranger reading from a script in a different time zone.

What Should You Expect When You Start with MDR?

When you start with Managed Detection and Response, expect a short setup period followed by quiet, continuous protection in the background. A good provider makes the transition simple and keeps you informed without burying you in technical detail.

How does onboarding work?

Onboarding usually begins with a review of your systems so the provider understands what normal looks like for your business. Monitoring sensors are then deployed across your devices, network, and cloud services, and the detection platform spends a short time learning your typical patterns of activity.

This learning period matters, because it is how the service tells the difference between a genuine threat and an ordinary day at your business. Once it is complete, monitoring runs continuously with very little for your team to do.

What will you actually see day to day?

Day to day, you should see almost nothing, which is the point. The service works quietly in the background, and you only hear from the provider when something genuinely needs your attention or when a regular report is due.

Clear reporting is part of the value. A good provider shows you what was detected, what was dealt with automatically, and what, if anything, needs a decision from you. That visibility turns security from a black box into something you can actually understand.

Add the Missing Security Layer to Your Business

Exodesk provides Managed Detection and Response for South Island businesses, backed by local Christchurch and Dunedin teams who have supported organisations since 1989. If quiet, around-the-clock protection is the gap in your defences, we can help you close it.

Contact us today to discuss how we can help your business or connect with us on LinkedIn to stay updated with more insights.

Frequently Asked Questions

What is Managed Detection and Response?

Managed Detection and Response, or MDR, is a security service that monitors a business around the clock, detects threats as they happen, and responds to contain them. It combines detection technology with human security analysts who investigate alerts and take action on the business’s behalf.

How is Managed Detection and Response different from antivirus?

Antivirus blocks known threats by matching them to a list of signatures, while Managed Detection and Response looks for suspicious behaviour that signals an attacker is already inside. Antivirus is passive and automated, whereas MDR is active and led by human analysts. The two complement each other rather than replacing one another.

What is the difference between MDR and EDR?

EDR, or endpoint detection and response, is a technology that monitors individual devices. Managed Detection and Response is a full service that includes EDR but adds human analysts, monitoring of the wider environment, and the response that turns alerts into action. EDR is a tool; MDR is a managed service built around such tools.

Do small businesses really need Managed Detection and Response?

Yes, because small businesses are targeted constantly and rarely have staff to watch for threats around the clock. Attackers automate their attacks and scan for any weakness regardless of company size, so a small business is just as likely to be hit and is often less prepared to recover.

How much does Managed Detection and Response cost?

Managed Detection and Response is usually priced as a monthly fee based on the number of users or devices monitored. This subscription model makes enterprise-grade security affordable for small businesses, since the cost of the technology and the analyst team is shared across many clients rather than carried alone.

What does the response part of MDR include?

Response means containing a confirmed threat, not just flagging it. Depending on the agreement, the provider isolates affected devices, blocks malicious accounts, and stops an attack spreading while the cause is investigated. The aim is to act within minutes to limit the damage.

Does Managed Detection and Response run 24 hours a day?

Yes, genuine Managed Detection and Response provides monitoring 24 hours a day, every day of the year. This matters because most attacks begin outside business hours, on nights, weekends, and public holidays, when an in-house team would not be watching.

What is a SOC in the context of MDR?

A SOC, or security operations centre, is the team of analysts who monitor alerts and respond to threats as part of a Managed Detection and Response service. The SOC reviews each alert, separates real threats from false alarms, and decides what action to take, which is the human element that makes MDR effective.

Can Managed Detection and Response stop ransomware?

Managed Detection and Response can detect the early signs of ransomware, such as rapid file encryption, and respond before it spreads across a network. While no service can guarantee prevention, fast detection and containment dramatically reduce the impact, especially when paired with tested backups and a recovery plan.

How do I get started with Managed Detection and Response?

The best first step is a conversation with a provider about your current security and where the gaps are. A good provider will assess your environment, recommend the right level of monitoring, and explain exactly what response actions they will take, so you understand the protection before you commit.