How should an SMB compare MDR (managed detection and response) providers promising similar coverage but at different price points?

Comparing Managed Detection and Response (MDR) providers that claim identical feature sets on paper—but come with drastically different price tags—is one of the trickiest purchasing decisions for a small-to-medium business (SMB). In cybersecurity, "similar coverage" rarely means equal execution.

To peel back the marketing veneer and find true value, evaluate the options across these critical criteria:

• Analyst-to-Customer Ratio & Tiers: Ask who is actually looking at your alerts. Low-cost providers often rely heavily on automated triage with junior tier-1 analysts offshore, escalating only when a threshold is met. Premium providers invest in experienced, senior threat hunters who can contextualize alerts to your specific business environment.
• Data Ingestion & Retention Costs: Many vendors look affordable upfront because they gate costs behind log volume (GB/day) or short data retention windows (e.g., 7 days vs. 1 year). Calculate your true total cost of ownership (TCO) by projecting data growth and compliance retention requirements.
• EDR Ecosystem & Flexibility: Check whether they mandate a specific EDR tool (like CrowdStrike or Microsoft Defender) or if they integrate with your existing tech stack. Forcing a rip-and-replace of tools you already own and have licensed dramatically drives up the hidden cost.
• Incident Response (IR) Retainers: Review what happens when an actual breach occurs. Does the low-cost provider charge extra hourly rates for remediation, or is hands-on incident response included in the subscription? A cheap retainer can turn catastrophic the moment an actual incident hits.
• Onboarding, Tuning, and False Positives: Poorly tuned MDRs flood your team with alert noise or miss subtle lateral movement. Ask how long onboarding takes, how they customize detection rules for your unique apps, and what their average false-positive rate is.
• SLA & Remediation Actions: Clarify the distinction between notification and remediation . Does the provider just email you at 3:00 AM saying "you're compromised," or do they possess the authority and capability to actively isolate hosts and block threats on your behalf?

To help narrow this down, could you share:

• What EDR or cloud tools your SMB is currently running?
• Roughly how many endpoints you need to cover?

I can help you build a custom scorecard to evaluate these vendors.

For an SMB, the biggest mistake is comparing MDR providers on “coverage” and annual price alone. Two providers can both say “24/7 endpoint, identity, cloud and email monitoring” while delivering very different amounts of telemetry, human investigation, response authority, and customer support.

A good approach is to compare cost per unit of actual protection, not cost per endpoint.

1. Normalize what “coverage” actually means

Make every provider complete the same matrix:

Don't accept a checkbox saying "supported." Ask which telemetry is collected, what detections operate on it, and what happens when an alert fires.

This matters because detection starts with the quality and breadth of underlying data, not merely the number of products a provider says it supports.

2. Separate technology from the humans operating it

This is often where the price difference becomes meaningful.

Ask each provider:

• How many alerts does a human analyst investigate versus automated rules?
• Is there a dedicated analyst/team assigned to us?
• Is threat hunting included?
• Who investigates after-hours incidents?
• What happens during shift changes?
• How are incidents handed between analysts?
• Can we speak directly to an analyst during an incident?
• What percentage of response is automated?
• Are analysts employees, contractors, or offshore partners?

SANS specifically highlights people and process—not just technology—as critical to successful MDR relationships, including continuity across shifts and clear division of responsibilities.

A $20/endpoint/month service and a $60/endpoint/month service may both use a recognizable EDR platform, but the expensive one may be selling substantially more human investigation and response capacity.

3. Compare response, not alerting

This is probably the most important distinction.

Ask the provider to demonstrate what happens when you give them this scenario:

“An employee's Microsoft 365 account is compromised, MFA is bypassed, the attacker creates an inbox rule, downloads sensitive files, and then compromises another endpoint.” Have them show:

1. What telemetry detects it?
2. What alerts are generated?
3. What gets correlated?
4. Who investigates?
5. How quickly?
6. What actions can the MDR take automatically?
7. What requires your approval?
8. How do they determine the full scope?
9. How do they eradicate persistence?
10. What report do you receive afterward?

Mature MDR should extend beyond generating an alert into investigation, containment, eradication and understanding how the incident happened. SANS describes these as important components of effective MDR.

4. Put SLAs under a microscope

“24/7 monitoring” doesn't necessarily mean “24/7 response.”

Get contractual answers for:

• Maximum time to acknowledge a critical alert
• Maximum time to begin investigation
• Maximum time to contact you
• Maximum time to execute an authorized containment action
• Escalation procedures
• Critical-incident phone support
• Service availability
• SLA credits/penalties
• Customer responsibilities that can invalidate the SLA

Also distinguish MTTD from MTTR. A provider that detects an attack in two minutes but needs 45 minutes to reach someone authorized to contain it isn't equivalent to one that can isolate the endpoint immediately.

SANS's recent detection/response research illustrates why this matters: organizations vary considerably in their ability to respond quickly, and manual intervention remains common.

5. Identify the “cheap plan” exclusions

This is where apparently similar prices often diverge.

Look for:

• Data ingestion limits
• Number of endpoints/users
• Server surcharges
• Cloud log surcharges
• SIEM storage limits
• Retention period
• Threat-hunting limits
• Incident-response hours
• Forensics fees
• After-hours fees
• Premium support tiers
• Additional connectors
• Professional-services charges
• Minimum contract size
• Annual price increases
• Minimum volume commitments

Ask:

“If we have a major breach tomorrow, what could we be charged for that isn't included in this price?” That question is surprisingly revealing.

6. Score value rather than creating a giant feature checklist

For an SMB, I'd use something like:

Notice that price is only 5% in this example.

That's deliberate. If Provider A costs $100k and Provider B $60k, but B leaves you responsible for investigation and containment, B isn't necessarily cheaper—it may simply be selling less MDR.

You can then calculate:

Effective MDR cost = annual subscription + required technology + expected professional services + expected incident-response costs + internal staff time

7. Make vendors prove their claims

Don't rely exclusively on sales presentations.

Ask finalists for a short proof-of-value using your actual environment or a representative test environment. Give each vendor the same scenarios and scoring sheet. A structured RFP plus a hands-on POC is a good way to distinguish marketing claims from operational capability.

I'd test at least these three scenarios:

• Credential compromise: stolen identity → MFA abuse → mailbox/data access
• Ransomware: malicious execution → lateral movement → encryption attempt
• Living-off-the-land attack: PowerShell/remote tools → credential theft → persistence

Then score them on what they detected, how much context they provided, how quickly they acted, and what they actually contained.

8. Don't overvalue certifications

SOC 2, ISO 27001, etc. are useful, but don't treat them as evidence that the MDR itself is excellent.

For example, when reviewing a SOC 2 report, you need to examine whether the actual service you're buying is within the report's scope rather than simply accepting “SOC 2 certified” as a blanket assurance.

Also ask for:

• Recent customer references similar to your company
• Sample incident reports
• Sample monthly security reports
• Escalation documentation
• Service-level agreement
• Responsibility matrix
• Data-retention policy
• Data residency
• Subprocessor list

A practical SMB rule of thumb

I'd boil the decision down to five questions:

1. What can they see? Telemetry and integrations.

2. What can they understand? Correlation, investigation, threat hunting and analyst expertise.

3. What can they do? Actual containment and remediation authority.

4. How fast can they do it? Contractual SLAs, not marketing claims.

5. What will it really cost us? All-in TCO, including exclusions and incident-response charges.

If a cheaper MDR provider performs equally well on those five dimensions, buy the cheaper one. But if its lower price comes from narrower telemetry, automated-only investigation, weaker response authority, slower escalation, or substantial exclusions, the apparent savings may be false economy.

For an SMB in particular, I'd favor a provider with strong human investigation + decisive containment + transparent pricing over one advertising a huge list of integrations at a lower per-endpoint price. SANS research also points to skilled personnel and budget constraints as persistent challenges in detection and response, which is precisely the gap a good MDR should be helping an SMB close.

sans.org is a useful independent starting point for building an evaluation checklist.

An SMB should compare Managed Detection and Response (MDR) providers by evaluating the operational depth behind their pricing models, the exact scope of active response capabilities included, and the hidden costs of data ingestion or remediation rather than relying on identical high-level feature checkboxes.

When two vendors promise similar coverage at different price points, lower-priced providers often rely heavily on automated alerting and customer-led remediation, whereas higher-priced options provide active human triage, hands-on containment, and customized threat hunting.

Key Comparison Dimensions for SMBs

Step-by-Step Evaluation Framework

1. Audit the Real Definition of "Response"
   • Ask the provider: "When a critical alert triggers at 3:00 AM on a Sunday, do your analysts actively isolate the infected endpoint, or do they send an email notification for our internal team to handle?"
   • Budget providers often sell notification services, while premium services sell actual containment. If your SMB lacks a 24/7 internal IT staff, a cheaper alert-only service still leaves your business unprotected during off-hours.
2. Uncover Hidden Pricing Mechanics
   • Check how the vendor scales costs. Is pricing based strictly on per-endpoint numbers, or does it factor in data volume (GB/day ingested), user identities, or cloud environments?
   • Low initial per-endpoint costs can balloon if log ingestion from Microsoft 365, AWS, or firewalls incurs separate metering fees.
3. Verify Telemetry and Integration Limits
   • Ensure the "similar coverage" includes the tools you actually run. A low-cost provider might cover standard Windows endpoints well but charge extra or lack depth for your identity provider (like Okta or Azure AD ) or cloud infrastructure . True visibility requires correlating data across multiple layers of your tech stack.
4. Assess the Onboarding and Tuning Burden
   • Inquire about the initial configuration process. Ineffective MDR providers dump generic rules onto your environment, generating alert fatigue for your internal team. Higher-priced providers spend weeks properly baselining your normal user behavior to reduce false positives and noise.
5. Examine Reporting and Compliance Value
   • Look at sample reports. For SMBs subject to cyber insurance, HIPAA, or PCI-DSS requirements, you need a provider that maps reports directly to regulatory frameworks and audit readiness, rather than a generic monthly summary of blocked malware.

If you'd like, let me know:

• What security tools or EDR (e.g., CrowdStrike, Microsoft Defender, SentinelOne) your SMB currently runs
• Whether you have internal IT staff available to handle out-of-hours security alerts

I can help you narrow down which provider tiers or specific vendors fit your operations.

The key is to compare outcomes and operating scope, not the vendor’s “coverage” checklist. Two MDRs can both say “24/7 monitoring, EDR, identity, cloud, ransomware response” while delivering very different levels of service.

A practical SMB MDR scorecard

The biggest pricing trap

Don't compare:

Provider A: $X/endpoint/month Provider B: $1.7X/endpoint/month Instead calculate fully loaded annual cost for the same security outcome.

For each provider, add:

MDR subscription + required security licenses + SIEM/data charges + onboarding + incident-response retainers + premium integrations + expected overages + internal staff time

A cheap MDR that requires you to buy an expensive SIEM, maintain integrations yourself, and manually handle containment may be substantially more expensive than a higher-priced service.

Make vendors prove the "same coverage"

Give every finalist the same environment profile and the same test scenarios. For example:

• 150 Windows endpoints
• 20 Macs
• Microsoft 365
• Entra ID
• 10 servers
• firewall/VPN
• one cloud workload
• remote workforce
• no dedicated SOC staff

Then ask each provider to demonstrate what happens during:

1. Credential theft → suspicious login → privilege escalation.
2. Endpoint compromise → lateral movement → ransomware.
3. Malicious OAuth application in Microsoft 365.
4. Compromised administrator account.
5. Suspicious PowerShell/command-line activity.
6. Data exfiltration from a cloud service.

For each scenario, require them to show:

Telemetry → detection → analyst investigation → customer notification → containment → remediation guidance → post-incident report.

This exposes differences that a feature matrix hides.

MITRE's ATT&CK evaluations are useful as an independent reference because they test providers against adversary behaviors rather than simply accepting vendor claims. The evaluations specifically examine things such as behavioral detection, correlation of multiple events, detection quality and false-positive handling.

Weight the things that actually matter

For an SMB, I'd use something like:

• 25% — Detection & telemetry coverage
• 25% — Response capability and speed
• 15% — Analyst quality / investigation
• 10% — Incident-response capability
• 10% — Platform/integration fit
• 10% — Total cost
• 5% — Contract, SLA and exit terms

Notice that price is only 10%.

That's intentional. If Provider A is 30% cheaper but leaves you with materially weaker containment, the apparent savings can disappear during the first serious incident.

Ask for these five numbers

I'd make every finalist put these in writing:

1. Critical incident notification SLA: e.g., ≤15 minutes.
2. Critical incident containment SLA: e.g., ≤30 minutes when the MDR has authorization to act.
3. Percentage of critical alerts reviewed by human analysts.
4. All-in annual cost at your projected endpoint/user/data volume.
5. Additional charges that can arise during an incident.

The fifth is particularly important. An SMB doesn't want to discover during a ransomware event that "24/7 MDR" covers detection but forensic investigation and emergency response are separately billable.

A useful final test

Ask each provider:

"Assume we have a confirmed ransomware incident at 2:00 AM Saturday. Walk us through exactly what your team does from the first detection through Monday morning, including every action you can take without our approval, every action requiring our approval, who calls us, what SLA applies, and what additional charges we incur." Then compare the answers side-by-side.

That question often tells you more about the difference between a $X MDR and a $2X MDR than 50 pages of feature matrices.

Bottom line: the right SMB MDR isn't necessarily the provider with the most detections or the lowest price. It's the one that gives you the best verified reduction in response burden and incident risk per fully loaded dollar, with clear authority and SLAs for actually containing an attack.

MITRE's ATT&CK evaluations are useful as an independent reference because they test providers against adversary behaviors rather than simply accepting vendor claims. The evaluations specifically examine things such as behavioral detection, correlation of multiple events, detection quality and false-positive handling.

Weight the things that actually matter

For an SMB, I'd use something like:

Comparing Managed Detection and Response (MDR) providers that claim identical coverage on paper—but come with drastically different price tags—is one of the trickiest parts of buying cybersecurity services for a small-to-medium business (SMB). Two vendors might both check the "24/7 monitoring, EDR integration, and threat hunting" boxes, but the reality in the trenches can be night and day.

Here is a practical framework to cut through the marketing noise and figure out where the hidden costs, capability gaps, and value differences actually lie.

1. Deconstruct the "Coverage" Definition

Vendors use broad terms like "complete visibility" or "full coverage," but the scope varies wildly.

• Telemetry Sources: Does "coverage" mean just your endpoints (EDR), or does it include identity providers (like Entra ID/Okta), your cloud environment (AWS/Microsoft 365), and firewall logs? A cheaper provider might charge extra per gigabyte of log data or exclude cloud telemetry entirely.
• OS and Device Support: Verify if their agents support your specific stack—especially legacy systems, specialized line-of-business applications, or non-Windows environments if you use them.

2. Understand the Operational Model & Response Rights

Not all "remediation" or "response" is created equal. Ask specifically:

• Alert Triage vs. Active Remediation: Are they just emailing you at 3:00 AM with an alert that says "Hey, something looks bad, you should isolate this machine," or are they actually logging into your console and taking the machine off the network for you? (The former is just managed alerting; the latter is true MDR).
• Action Playbooks: What actions are they pre-authorized to take on your behalf without waking you up? If a cheap provider requires client approval for every single containment step, your dwell time during an active attack skyrockets.

3. Scrutinize the People and the Platform

The price difference often reflects whether you are paying for automated software with a junior-heavy triage pool or senior security analysts.

• Analyst Tiering: Who is actually looking at your alerts? Ask about the experience level of the tier-1 analysts and how quickly escalations reach senior threat hunters.
• The S/O Ratio (Security-to-Client Ratio): How many clients does a single analyst or response team handle? If an ultra-low-cost provider over-subscribes their team, alert fatigue sets in and high-severity signals can get missed or delayed.
• Platform Access: Do you get full access to the underlying SIEM/EDR platform, or are you locked into a proprietary "black box" portal where you can’t run your own queries or pull your own reports?

4. Uncover the Hidden Costs and Contractual Traps

Low upfront pricing can quickly balloon once you factor in fine print.

• Onboarding & Implementation Fees: Some providers bake setup into a high monthly fee; others quote a low monthly price but slap you with a massive, mandatory professional services fee just to get integrated.
• Data Ingestion and Retention Caps: Check how long log data is retained (e.g., 30 days vs. 1 year) and whether exceeding data volume limits triggers overage fees.
• Exit and Scaling Terms: What happens if you shrink or grow? Are you locked into a 3-year co-terminous contract that is painful to break if their service quality dips?

5. Evaluate the Quality of Reporting and Metrics

An SMB doesn't just need security; they often need proof of security for cyber insurance or compliance.

• Actionable Reporting: Do they provide cookie-cutter, automated monthly PDF scans, or do they offer proactive threat briefings and post-incident reviews that help you fix root-cause vulnerabilities (e.g., pointing out a recurring misconfiguration in your identity management)?
• Insurance Alignment: Does their coverage level and reporting satisfy the stringent requirements of modern Cyber Insurance Policies?

If you'd like to narrow this down further, tell me:

• What EDR or core security tools (e.g., CrowdStrike, Microsoft Defender, SentinelOne) do you currently use?
• Roughly how many endpoints and cloud users do you have?
• Are you trying to meet a specific compliance requirement (like SOC 2, HIPAA, or cyber insurance)?

I can help you prioritize which specific questions to ask these vendors during your next demo call.

The biggest mistake is comparing MDR providers on “coverage” as a feature checklist. If two vendors both say “24/7 monitoring, endpoint + identity + cloud coverage,” the cheaper one may be delivering substantially less actual security work.

A good SMB comparison is to normalize each proposal around what happens when something bad occurs, not how many tools or detections the provider advertises. SANS similarly emphasizes evaluating MDR across technology, people, process, investigation, containment, and response—not detection alone.

A practical MDR scorecard

The telemetry point is particularly important: you cannot have meaningful detection coverage without the right underlying visibility. SANS's current detection-coverage guidance explicitly separates data-source quality, telemetry visibility, and detection coverage.

Then investigate the price difference

Suppose Provider A costs $30k/year and Provider B costs $60k. Don't ask, “Why is B twice as expensive?”

Ask:

“What security capability am I buying for the additional $30k?” You may discover that the premium buys:

• 24/7 human investigation rather than automated alerting.
• More telemetry sources.
• Identity and SaaS monitoring.
• Actual containment authority.
• Threat hunting.
• DFIR expertise.
• Faster escalation.
• Better detection engineering.
• More experienced analysts.
• Higher ingestion limits.
• Better reporting and compliance evidence.

Conversely, you may discover that the difference is largely brand, sales overhead, or bundled tooling.

SANS notes that strong MDR services extend through investigation and containment and may include digital forensics and incident response—not merely alert generation.

Make vendors prove their claims

For an SMB, I'd make this the centerpiece of the evaluation.

Give each finalist the same three scenarios, such as:

1. A compromised Microsoft 365 identity with suspicious MFA activity.
2. Ransomware beginning to execute on an endpoint.
3. An attacker using legitimate credentials to move laterally.

Ask each provider to walk through, step by step:

Detection → triage → investigation → customer notification → containment → eradication guidance → recovery → post-incident report.

Then ask:

“Which steps are automated, which are performed by an analyst, and which require our staff?” That question often exposes enormous differences between supposedly equivalent MDR services.

Also ask them to demonstrate a real—or sanitized—incident report. You want to see whether you're getting meaningful analysis or essentially:

“Malicious activity detected. Please investigate.”

Score the vendors by outcomes, not features

I'd weight an SMB scorecard roughly like this:

• 25% — Detection quality & telemetry
• 25% — Investigation & response capability
• 15% — Analyst expertise / 24×7 operations
• 10% — Response speed & SLAs
• 10% — Integration/deployment effort
• 5% — Reporting & transparency
• 10% — Total cost

Then calculate three-year total cost, including onboarding, agents, log/ingestion charges, additional data sources, incident-response fees, and price escalators.

Don't let a low headline price win if it creates substantial work for your own IT team. An MDR service that generates 20 noisy escalations a week can be much more expensive than one that costs 30% more but resolves the majority itself. False positives remain a major detection-and-response problem according to SANS research.

Put the important promises in the contract

Anything important enough to influence the buying decision should become an SLA or explicit contractual obligation, rather than remaining a salesperson's statement.

In particular, specify:

• monitored environments and telemetry sources;
• monitoring hours;
• severity definitions;
• notification time;
• response-time targets;
• what containment actions the MDR may perform autonomously;
• customer escalation procedures;
• support availability;
• service availability;
• incident-report requirements;
• data retention;
• data ownership and portability;
• breach notification;
• subcontractors;
• security requirements for the provider itself;
• termination/offboarding assistance.

CISA's guidance for organizations buying managed services similarly recommends a master requirements list, explicit SLAs, clearly defined incident-management responsibilities, outage compensation/support provisions, and clear handling of logs and records.

The simplest rule

Don't compare “coverage.” Compare “work performed per dollar when an attack happens.”

If two MDRs genuinely provide equivalent telemetry, analyst involvement, detection depth, response authority, SLAs, and incident handling, then price becomes a straightforward decision.

If they don't, the cheaper provider isn't necessarily cheaper—it may simply be selling a smaller MDR service under the same label.

The biggest mistake is comparing MDR providers on “coverage” and price alone. If two vendors both say “24/7 monitoring, XDR, threat hunting, and response,” the real question is: what happens when something bad actually happens, and what does the contract obligate them to do?

CISA recommends formalizing requirements and responsibilities in a master requirements list and SLA, including incident-management responsibilities and remediation expectations.

A practical SMB scorecard

I’d weight the evaluation roughly like this:

The exact weights should change based on your risk profile.

1. Turn “coverage” into a testable matrix

Don't accept:

“We cover endpoints, identity, cloud and email.” Ask the provider to complete a matrix like:

This exposes the difference between “we integrate with it” and “we actively monitor and respond to threats in it.”

Also distinguish telemetry coverage from detection coverage. A provider may ingest logs from something without having meaningful detections for it.

2. Compare the response, not the alert

This is probably the most important discriminator.

Ask each vendor:

“At 2:00 AM, you determine that an employee's credentials are being used by an attacker. Walk me through exactly what happens during the next 30 minutes.” Then ask:

• Who investigates?
• How quickly must they contact us?
• Can they disable the compromised account?
• Can they isolate the endpoint?
• Can they block malicious IPs/domains?
• Can they revoke sessions/tokens?
• Can they execute those actions without waiting for us?
• Which actions require our approval?
• Is containment included in the base price?
• What happens if nobody at our company answers the phone?

There's a huge difference between MTTD, time to notify, and time to contain. A cheap MDR that identifies ransomware quickly but waits two hours for your IT person to approve isolation may be less valuable than a more expensive provider that can contain it immediately.

MITRE's current evaluation methodology itself distinguishes detection quality, precision, speed and protection/response outcomes rather than treating “detected” as a binary measure.

3. Make the SLA painfully specific

Don't accept “24/7 SOC” as an SLA.

Get contractual definitions for something like:

• Critical: human investigation within X minutes
• High: within X minutes
• Medium: within X hours
• Notification vs. investigation vs. containment
• Escalation procedure
• Maximum time to contact your designated person
• Availability/uptime commitments
• Service credits or other remedies for SLA failure

CISA specifically recommends detailed performance SLAs and incident-management responsibilities rather than vague service descriptions.

And ask whether the provider's claimed response time is mean/average or a guaranteed maximum. “Average response time of 15 minutes” isn't remotely equivalent to “95% of critical incidents investigated within 15 minutes.”

4. Normalize the price

Don't compare $X/endpoint/month directly.

Calculate:

3-year TCO = subscription + required licenses + onboarding + integrations + data/ingestion fees + overages + IR/forensics + premium support + minimum commitments

Ask:

“What is the maximum we could pay in a month if we had a serious incident?” That's especially revealing because some apparently inexpensive MDR contracts charge separately for incident response, forensics, or exceeding data/endpoint thresholds.

Also model growth: 250 → 400 endpoints, more cloud workloads, another office, acquisitions, etc.

5. Look for what's being commoditized

A lower price isn't necessarily suspicious. It may reflect:

• Highly automated triage
• Provider-owned security stack
• Large customer scale
• Offshore/follow-the-sun analysts
• Narrower telemetry
• Less human threat hunting
• Fewer included response actions
• Less expensive IR model

Those can all be legitimate tradeoffs.

The red flag is when the vendor can't explain why they're cheaper.

Conversely, a premium price isn't evidence of better security. Ask the expensive provider to identify the specific capabilities you're buying that the cheaper provider doesn't provide.

6. Run a small proof-of-value

For an SMB, I'd put more weight on a 2–4 week controlled trial than another six-hour sales presentation.

Use a handful of representative systems and test several scenarios:

• Credential theft
• PowerShell/script abuse
• Suspicious remote access
• Malware execution
• Impossible-travel/identity anomaly
• Ransomware-like behavior
• A legitimate admin activity designed to trigger a false positive

Measure:

time to detect → time to human validation → time to contact you → time to containment → quality of investigation → amount of work required from your staff

MITRE's evaluations explicitly consider detection precision and false-positive behavior, which is a useful reminder that generating lots of alerts isn't the same as providing good detection.

7. Ask for the “bad day” contract

Before signing, get written answers to:

• What exactly is included during a ransomware incident?
• How many IR/forensics hours are included?
• Are containment actions unlimited?
• Who owns the investigation?
• Who talks to our cyber insurer?
• Can you provide evidence for legal/regulatory purposes?
• What happens if your SOC is unavailable?
• Where is our telemetry stored?
• How long is it retained?
• Can we export it if we leave?
• What happens to our data after termination?

CISA/NSA guidance also emphasizes understanding the provider's incident responsibilities, visibility into provider actions, and recovery contingencies.

The simple SMB decision rule

If Provider A costs $8/endpoint/month and Provider B costs $15, don't ask:

“Is B twice as good?” Ask:

“What additional risk does B remove, and what would that risk cost us if we experienced a serious incident?” Then quantify the difference.

For example:

• A: alerts you, but your IT team must investigate and contain.
• B: investigates, isolates affected machines, disables compromised identities, and coordinates incident response.

Those aren't really the same service at different prices. They're different allocations of responsibility.

I'd ultimately select the provider with the best combination of contractually guaranteed response + appropriate telemetry + competent human investigation + predictable total cost, rather than the provider with the highest claimed ATT&CK percentage or lowest per-endpoint price.

A particularly useful final question for each finalist is:

“Show me exactly what your analysts would do, and exactly what I would have to do, if ransomware started encrypting 20 of our endpoints at 2 AM.” If the answers are materially different, you've found where the price difference is coming from.

There's a huge difference between MTTD, time to notify, and time to contain. A cheap MDR that identifies ransomware quickly but waits two hours for your IT person to approve isolation may be less valuable than a more expensive provider that can contain it immediately.

MITRE's current evaluation methodology itself distinguishes detection quality, precision, speed and protection/response outcomes rather than treating “detected” as a binary measure.

When evaluating Managed Detection and Response (MDR) providers that look identical on a feature checklist but show a major price gap, an SMB shouldn't just look at the sticker price . Lower costs often hide gaps in service delivery, while higher costs might charge for enterprise baggage you don't need.

Here is how an SMB can systematically compare them to find the true value:

• Data ingestion limits: Check whether pricing is tied to data volume (GB/day) or number of endpoints. A "cheaper" provider might ding you with overage fees the moment your logs spike.

• Telemetry depth: Do they pull telemetry strictly from EDR (Endpoint Detection and Response), or do they integrate with your Identity Provider (like Okta/Entra ID), cloud environments (AWS/Azure), and firewall? Make sure "similar coverage" actually means the same depth of log visibility.

• Analyst availability: Ask explicitly who is watching the console at 3:00 AM on a Sunday. Some budget providers staff a live tier-1 triage team globally, but escalate complex alerts only to a US-based tier-3 team that works standard hours.

• SLA for response time: What is their mean time to acknowledge (MTTA) and mean time to respond (MTTR)? A 15-minute SLA on paper means little if it only applies to critical alerts, while medium/low alerts sit for 12 hours.

• Active vs. passive defense: Can the provider actively isolate a compromised host or disable a compromised user account automatically or via human-in-the-loop? Some lower-cost providers will only notify you at 2:00 AM and leave the heavy lifting of clicking "isolate" to your internal (sleeping) team.

• Action authorization: Understand the guardrails. Do they require your sign-off before taking disruptive actions, and does their support desk have the operational maturity to make those calls quickly?

• Human-led threat hunting: True MDR includes proactive, hypothesis-driven threat hunting looking for indicators of compromise (IoCs) that automated tools miss. Budget providers often rely purely on automated SIEM/EDR rules without dedicated human hunting hours.

• Custom detection engineering: Will they write and tune detection rules specific to your stack and business logic, or do you just get the out-of-the-box vendor ruleset?

• Actionable reporting: Look at a sample of their monthly reports. Do they just hand you a PDF of raw alert counts, or do they explain what happened, why it happened, and how to fix the root cause?

• Compliance mapping: If your SMB requires frameworks like SOC 2, HIPAA, or Cyber Insurance compliance, check whether their reporting and log retention periods satisfy your auditor's requirements out of the box.

• Onboarding and deployment fees: Are there steep implementation costs, or is it a flat SaaS subscription?

• Data retention: How long do they store your logs? Standard is usually 30 to 90 days hot; cheaper tiers might drop older logs or charge heavily to search historical data.

• Exit strategy: If the partnership goes south, how difficult (and expensive) is it to extract your data and offboard?

If you want to narrow this down further, tell me:

• What EDR or security stack are you currently running?
• Do you have an internal IT/security person , or is this meant to be completely hands-off?

I can give you a targeted checklist of specific gotcha questions to ask their sales engineers.

When MDR providers claim roughly the same coverage but prices differ substantially, don’t compare feature lists—compare the amount of risk and operational work each provider actually removes.

SANS research is a useful sanity check: detection/response still involves substantial human intervention, and false positives remain a major challenge.

1. Normalize what “coverage” actually means

Put every vendor on the same matrix:

The key is to distinguish “we can ingest it” from “we continuously monitor it and will act on it.” Mature MDR offerings can span threat intelligence, hunting, malware analysis, integrations and automated response—but those capabilities aren't necessarily included at every price tier.

2. Focus heavily on response, not detection

Two providers may both say “24/7 detection,” but one might:

Alert you → wait for your team → provide recommendations while another:

Detect → investigate → validate → isolate endpoint → disable account → investigate scope → provide incident report. Those are radically different services.

Ask vendors to specify exactly which actions they are authorized to take without your approval, such as:

• Isolate an endpoint
• Kill a malicious process
• Quarantine a file
• Block an indicator
• Disable/reset a compromised identity
• Revoke sessions/tokens
• Block malicious email
• Modify firewall controls

Also ask what happens when they cannot reach you at 2 a.m.

SANS specifically emphasizes that the best MDR goes beyond alerts into investigation, containment, forensics and resilience.

3. Compare SLAs using measurable outcomes

Don't accept “24/7 SOC” as a differentiator.

Get contractual numbers for:

• Time to acknowledge an alert
• Time to triage
• Time to escalate
• Time to contain after confirmation
• Time to deliver an incident report
• Availability/uptime of the service
• Escalation procedures
• Customer notification requirements

A provider that promises a 15-minute response but has no meaningful definition of “response” may be less valuable than one promising 30 minutes with actual containment authority.

4. Test detection quality—not alert volume

Ask each vendor for results from a common scenario-based evaluation.

For example:

• Compromised Microsoft 365 identity
• Ransomware on a workstation
• PowerShell-based attack
• Credential theft followed by lateral movement
• Malicious OAuth application
• Data exfiltration
• Compromised admin account
• Cloud credential compromise

Then ask:

“Show us exactly what your SOC would see, what gets escalated, who gets contacted, and what you would do.”

This exposes the difference between marketing coverage and operational coverage. CISA's real-world testing guidance likewise emphasizes connecting attack techniques to expected detection points and defender reactions—not merely whether telemetry exists.

5. Make the pricing model transparent

A surprisingly cheap MDR can become expensive once you add:

• Per-endpoint fees
• Minimum endpoint commitments
• Log ingestion
• Data retention
• Cloud workloads
• Identity monitoring
• SIEM
• Threat hunting
• Incident response
• Forensics
• Premium support
• After-hours response
• Professional services
• Onboarding
• Deployment assistance
• Additional integrations

Calculate three-year total cost, not just the quoted annual MDR price.

I'd put this in a spreadsheet as:

3-year TCO = subscription + implementation + mandatory products + expected overages + incident-response costs + internal labor.

6. Put a value on your own staff time

This is particularly important for an SMB.

Suppose:

• Vendor A costs $40k/year but requires your IT person to investigate and contain incidents.
• Vendor B costs $65k/year and performs investigation and containment for you.

The $25k premium may be cheap if it eliminates hundreds of hours of internal security work.

SANS research shows that lack of skilled personnel remains a major obstacle to effective detection/response, which is one reason the human component of MDR deserves explicit valuation.

7. Ask for customer-specific tuning

A good MDR shouldn't treat your environment like everyone else's.

Ask:

• How do you learn our normal behavior?
• Who tunes detections?
• How quickly are false positives suppressed?
• Can we specify sensitive systems/users?
• Can we define business-critical assets?
• Can we create custom detections?
• How are exceptions documented?
• What happens when our environment changes?

False positives matter enormously because your team can end up becoming the MDR provider's unpaid triage department. SANS has highlighted false positives as a persistent detection/response problem.

8. Demand evidence during the POC

I'd run a 2–4 week proof of value using the same test cases for every finalist.

Score each from 1–5:

I'd deliberately give response/containment more weight than raw coverage.

9. Investigate why the cheaper provider is cheaper

A price difference isn't automatically a red flag. It could reflect:

• More automation
• A more efficient SOC
• Lower infrastructure costs
• Better scale
• Less expensive underlying technology
• A narrower—but still adequate—service

But it could also mean:

• More customer-to-analyst ratio
• Less experienced analysts
• Limited investigation
• Slower escalation
• Customer performs containment
• Important telemetry costs extra
• “24/7” means automated alerting rather than human response
• Threat hunting is mostly marketing
• Incident response is an add-on

The question isn't “Why is Vendor B cheaper?” It's “Which service obligation does Vendor B provide less of?”

A simple SMB decision rule

I'd reduce the final decision to four questions:

1. Will they detect the attacks that matter to us?
2. Will a human investigate them appropriately?
3. Will they actually contain the incident when we need them to?
4. What will we really spend over three years—including our own labor?

If two providers genuinely give you the same answers to all four, take the cheaper one.

If the cheaper provider merely offers the same coverage vocabulary but leaves investigation, containment, tuning, or incident response to your staff, the apparent price advantage may disappear very quickly.

For an SMB, I would generally favor the MDR that removes the most 2 a.m. decision-making from your internal IT team, rather than the one with the longest feature checklist.

• More customer-to-analyst ratio
• Less experienced analysts
• Limited investigation
• Slower escalation
• Customer performs containment
• Important telemetry costs extra
• “24/7” means automated alerting rather than human response
• Threat hunting is mostly marketing
• Incident response is an add-on

The question isn't “Why is Vendor B cheaper?” It's “Which service obligation does Vendor B provide less of?”

A simple SMB decision rule

I'd reduce the final decision to four questions:

1. Will they detect the attacks that matter to us?
2. Will a human investigate them appropriately?
3. Will they actually contain the incident when we need them to?
4. What will we really spend over three years—including our own labor?

If two providers genuinely give you the same answers to all four, take the cheaper one.

If the cheaper provider merely offers the same coverage vocabulary but leaves investigation, containment, tuning, or incident response to your staff, the apparent price advantage may disappear very quickly.

For an SMB, I would generally favor the MDR that removes the most 2 a.m. decision-making from your internal IT team, rather than the one with the longest feature checklist.

Comparing Managed Detection and Response (MDR) providers that pitch identical feature checklists at wildly different price points is one of the trickiest parts of SMB cybersecurity procurement. When the spec sheets look identical, the difference between a cheap vendor and an expensive one usually lies in hidden limitations, execution quality, and alignment with your actual risk.

Here is a structured framework for an SMB to cut through the marketing noise and evaluate where the true value (and hidden costs) lie:

1. Deconstruct the "Coverage" Definition

Vendors love to say they cover "endpoints, identity, and cloud," but how they cover them varies dramatically:

• True 24/7/365 Active Remediation vs. Alert Forwarding: Ask if their tier-one analysts are actively containing threats at 3:00 AM on a Sunday, or if they are just emailing you an alert and closing the ticket until business hours.
• Telemetry Scope: A low-cost provider might only ingest endpoint logs (EDR). A mature provider correlates endpoint data with identity providers (like Azure AD/Okta), firewalls, and cloud environments (Microsoft 365/AWS). More correlated telemetry means fewer false positives and better context during an attack.
• Proprietary vs. Open Tooling: Do they force you to use their proprietary agent/SIEM, or do they leverage your existing investments (e.g., Microsoft Defender for Business/Endpoint, CrowdStrike)? Licensing duplicate tools inflates the real cost.

2. Inspect the Human Element

MDR is ultimately a service, not just software. Probe deeply into who is actually looking at your data:

• Analyst-to-Customer Ratio: If a provider is super cheap, they are likely heavily automated or offshoring tier-1/tier-2 triage to junior analysts with high turnover. Ask about the experience level of the team assigned to your account.
• Dedicated vs. Pooled Incident Responders: When a critical alert fires, do you get a dedicated security engineer who knows your network topology, or a random person from a rotation who has to ask you "what an Active Directory is"?
• Threat Hunting vs. Alert Triage: Low-cost MDR is purely reactive (waiting for an alert to trigger). Premium MDR includes proactive, human-led threat hunting looking for anomalies that automated rules miss.

3. Expose Hidden Costs & Contractual Traps

The sticker price is rarely the total cost of ownership. Check for these variables:

• Data Ingestion/Retention Caps: Many budget providers charge extra if your log volume spikes or if you need logs stored longer than 30 days for compliance.
• Onboarding & Setup Fees: Some vendors quote a low monthly/annual rate but slam you with a massive, mandatory professional services fee for initial integration.
• Incident Response (IR) Retainers: What happens if a breach actually occurs? Does the MDR contract include full remediation and forensics, or do they charge an exorbitant hourly rate ($300+/hr) the moment containment requires heavy lifting?

4. Evaluate Remediation Autonomy and SLAs

Speed is everything in containment. Ask about their operational guardrails:

• Response Playbooks: Can they autonomously isolate a compromised endpoint without your manual approval, or do they have to wait for you to click "approve" on a dashboard alert? (If they require manual approval, ask what their average time-to-notify is during a critical event).
• Mean Time to Detect (MTTD) & Mean Time to Respond (MTTR): Don’t accept vague answers like "minutes." Ask for their audited or historical SLAs for critical severity alerts.

To help narrow this down, could you share:

• What security tools (EDR, cloud environment) does your SMB already own?
• What is your approximate employee/endpoint count?
• Are you bound by any specific compliance frameworks (HIPAA, SOC 2, CMMC)?

I can help tailor a specific list of precise questions to ask these vendors during your next sales call.