The decision to select a Managed Detection & Response (MDR) partner is one that should be approached with care. Not only does it affect your security posture and ability to detect threats, but it also impacts the level of service you provide to clients. After all, if you don’t find out about a breach until after it’s already happened, what good are you doing anyone? We’ve put together this guide because while there are many options available when choosing an MDR partner, not all companies have the same capabilities and experience. We’ll walk through some key factors we recommend taking into account when selecting an MDR provider so that you can find the right partner for your organization’s needs.

Know your needs.

The first step in selecting a MDR partner is to know what you want to achieve, and how much time, money and resources you’re willing to allocate toward that goal. Do you need detection and response services for just one or two incidents per year? Or do you anticipate facing hundreds of threats each month?

The next step is determining your budget–how much can be spent on building out an MDR program? What level of support do they need from their partners (e.g., technology integration) in order for it all work seamlessly together? And finally: Who will be responsible for implementation and maintenance going forward?

Selecting an MDR partner is a critical decision and should be approached with care.

When selecting an MDR partner, you should consider the following:

• Know your needs. Before beginning the selection process, it’s important to understand what you’re looking for in an MDR partner. This includes understanding your organization’s current state and goals, as well as how your industry sector has evolved over time. It also requires gaining insight into what types of services are available from other organizations within your industry sector and geography that may be relevant when comparing providers’ offerings against one another later on down the line (for example: if one company offers forensic analysis but another does not).
• Avoid companies that rely on hardware/software sales to drive revenue. While some companies may offer both managed detection & response services and hardware/software products or services under one roof (which can be helpful), others have been known to focus exclusively on selling their wares without providing any other value-added services whatsoever–and these latter types should be avoided by all means possible! The reason being? They’re simply trying too hard…and not doing their homework first!

Understand the company’s capabilities.

In order to determine whether a particular MDR partner is right for you, it’s important to understand their capabilities. The first step in this process is understanding how much time and effort the MDR partner will spend on your organization. Are they going to be actively involved in managing your incident response plan? How often will they provide updates on threat intelligence, new threats and best practices? If they’re not going to be actively involved in managing your IRP, then what value do they bring as an MDR solution provider?

Another thing worth considering is what services are provided by each vendor within their suite of offerings (e.g., monitoring services vs behavioral analysis). Some vendors offer more than others–and some provide less than others–so it’s important for organizations looking for an MDR solution that includes behavioral analysis capabilities (e.g., threat hunting) make sure these features are included before committing resources elsewhere

Look for experience in your organization’s industry sector and geography.

When selecting an MDR partner, it’s important to look for experience in your organization’s industry sector and geography. A partner that is familiar with your industry sector will be better equipped to handle any threats that may arise. Additionally, if a threat arises in one geographic region but not another (for example, if ransomware attacks are more common in Europe than they are in North America), then having an MDR partner who understands how these threats work can help ensure that they’re quickly detected and contained before they can spread throughout the rest of your business.

Avoid companies that rely on hardware/software sales to drive revenue.

Avoid companies that rely on hardware/software sales to drive revenue.

They may be more interested in selling you something than helping you solve your problem. And they may not have the expertise to offer a good solution. In fact, some MDRs have been known to use scare tactics to sell their services and products by telling customers they are at risk of being hacked or breached when they are not actually at risk at all!

Find out if the vendor will work with other industry partners and service providers to provide additional services if needed.

Find out if the vendor will work with other industry partners and service providers to provide additional services if needed. This includes, but is not limited to:

• A cloud-based data center for storing your information
• A managed security team for 24/7 monitoring of your network
• An incident response service provider that provides assistance in the event of a breach or other cyber incident

Evaluate the type of support provided by the MDR provider. Is it a one-time service or an ongoing relationship? Will there be someone who can answer questions at any time? Are you able to reach the same person each time you call in? Does it offer 24x7x365 support? Will you need support for only a few months or longer? Do they provide training, so you can use your new tools effectively? Are there other services available like risk assessments or vulnerability assessments we should consider during our transition process? How long have they been in business and how many customers do they serve.

Conclusion

In the end, selecting an MDR partner is a critical decision and should be approached with care. The best way to start is by understanding your needs, doing research on the market and finding out which company can best meet those needs. You should also consider any additional services that may be needed during your transition period such as risk assessments or vulnerability assessments before making a final decision on which provider will work best for your organization