MDR emerged to solve a problem that buying tools could not. Organisations accumulated security products — EDR, SIEM, firewall, email security, cloud posture — and each generated its own alerts, but few had the people to monitor them around the clock, investigate meaningfully, or respond effectively. The result was alerts ignored after hours, detections that never became incidents because no one connected the dots, and breaches that the tools had detected but the team had not acted on. MDR provides the people, process, and expertise to make the tools actually work.
The distinction between MDR and adjacent services is worth being precise about, because the market uses the terms loosely. Managed EDR is the monitoring and tuning of a single EDR platform. A managed SOC or SOC-as-a-Service typically spans multiple data sources and operates a fuller set of security operations, often including the SIEM itself. MDR sits between: it spans multiple sources for detection and response, adds human threat hunting and detection engineering, but is delivered as a service rather than as the operation of an in-house SOC. In practice the lines blur, and a buyer should focus on the outcomes — what is monitored, who hunts, who responds, and how fast — rather than the label.
What separates a strong MDR from a weak one is the human layer. The platforms are broadly comparable; the detection engineering — tuning rules to reduce false positives, writing new detections for emerging threats, and maintaining detection coverage as the environment changes — is where quality diverges. Threat hunting, the proactive search for threats that the detections did not flag, is a further differentiator and one that many lower-cost services do not genuinely provide. Response capability — the authority and tooling to isolate a host, block an account, or take a system offline — is the third pillar and the one that determines whether an MDR actually contains incidents or merely reports them.
Service-level agreements make the human layer measurable. MTTD — mean time to detect — measures how quickly a real threat is identified. MTTR — mean time to respond — measures how quickly it is contained. A serious MDR publishes both and stands behind them. The SLA is not the whole story — coverage, the data sources ingested, and the quality of the detections all matter — but a published, contracted MTTD and MTTR is the single best indicator of whether a provider will actually deliver in an incident.
Passeca's MDR is delivered on top of the customer's existing tooling where possible, with Passeca's PassIRP SIEM and PassAI-Guard automation layer providing the detection and response backbone. CrowdStrike EDR, Passeca Deception, and Signals threat intelligence feed into the same workflow. The service is staffed 24/7, includes detection engineering and threat hunting, and publishes MTTD and MTTR SLAs — the metrics that distinguish a service that detects and responds from one that only alerts.