EDR is a technology and MDR is a service. Endpoint detection and response (EDR) is software on endpoints that records activity, detects threats and lets an operator isolate a device or quarantine a file; managed detection and response (MDR) is a provider’s analysts monitoring, investigating and responding for you around the clock, often on an EDR or XDR platform. Extended detection and response (XDR) is technology that correlates detection and response across several telemetry sources. As of October 2026, NIST’s CSRC glossary lists all three only as abbreviations, so the definitions below come from US federal guidance, the UK NCSC and Gartner.
Enterprise Techie’s other security analyses are listed in the topic index.
In this guide
Key facts
| EDR | XDR | MDR | |
|---|---|---|---|
| What it is | Technology on endpoints | Technology across several telemetry sources | A service delivered by a provider’s analysts |
| Who operates it | Your team or a provider | Your team or a provider | The provider, alongside your team |
| Working definition | OMB M-22-01; NCSC; CISA | Gartner | Gartner; NIST SP 800-61r3 describes the role |
EDR, XDR and MDR defined
EDR
OMB memo M-22-01 (October 2021) says EDR “combines real-time continuous monitoring and collection of endpoint data” from devices such as workstations, mobile phones and servers “with rules-based automated response and analysis capabilities.” The NCSC’s Cyber Incident Response standard (April 2023) expects EDR suites used by assured incident responders to collect process creation, network activity and system changes in near real time, collect files and memory, and search for files matching known signatures; response actions “to block or remove attacker activity” are something EDR products “can support.” CISA’s CDM product requirements cite isolating an endpoint or quarantining executables, and note that a policy “could be to implement no automatic response actions.”
XDR
None of the government sources reviewed defines XDR. Gartner’s market definition says it “delivers security incident detection and automated response capabilities for security infrastructure” by correlating telemetry from multiple sources, and “must include native sensors”: at least two, one of them endpoint, plus log ingestion. The page marks that review market “Retired as of Aug-04-2026.” Vendors use the term two ways. Microsoft Defender XDR correlates Microsoft’s own products, and only those “that you have licensed and provisioned access to”; Arctic Wolf describes an “open XDR architecture to plug into your current telemetry.” The SIEM vs XDR guide covers the overlap with SIEM.
MDR
Gartner defines MDR services as “remotely delivered security operations center (SOC) functions” for “rapid detection, analysis, investigation and response through threat disruption and containment.” Its mandatory features (updated November 2025) are 24/7 staffing, a provider-operated technology stack, and remote containment “such as quarantining hosts,” carried out by the provider’s staff and “preapproved by end users.” NIST’s SP 800-61r3 (April 2025) doesn’t use the term MDR; it describes “an MSSP performing incident detection, response, and recovery activities” under contract as “a shared responsibility model.”
What each does and doesn’t do
EDR detects and offers response actions only where its agent runs. Beyond its automated rules, someone still has to triage, investigate and decide. CISA’s #StopRansomware Guide recommends application allowlisting and/or EDR “on all assets.” XDR widens the view to whatever sources it integrates, and still needs operators.
MDR supplies the analysts and the hours; the NCSC’s SOC operating model guidance observes that “most SOCs will outsource some of their operations.” It doesn’t supply business context or accountability. An NCSC blog (2023) warns that external SOC analysts “can lack the knowledge of (for example) a project’s architecture, and may not be able to respond to alerts as promptly as an internal SOC.” Recovery may sit outside scope too; a joint advisory from CISA, the UK NCSC and five partner agencies asks managed service providers to explain “services the customer is not purchasing, and all contingencies for incident response and recovery.”
Response authority: what an MDR provider may do on your systems
NIST SP 800-61r3 says responsibilities shared with a provider “should be clearly defined in a contract,” including “authority to act on behalf of the organization” and restrictions on “making and implementing operational decisions (e.g., immediately deactivating certain services to contain an incident).” Leadership, it notes, may keep authority over high-impact actions “such as shutting down or rebuilding critical services.”
Providers expose that authority as settings. Microsoft’s Defender Experts MDR defaults to investigating incidents and guiding your response (Security Reader access); acting directly requires Security Operator access, and device and user groups can be excluded from remediation. Sophos MDR offers three modes: Notify Only, where the team “can’t take action to contain or neutralize threats”; Collaborate, where “no response actions will be taken without your consent or active involvement”; and Authorize, where it “will proactively manage all containment actions” and reports afterward.
Authority means access. The joint advisory notes that providers usually need “trusted network connectivity and privileged access,” and asks customers to require MFA on provider accounts, restrict those accounts to the systems the provider manages, and get visibility of the “provider’s presence, activities, and connections.” NIST adds that “the risk of malicious insiders or the service provider being compromised should be considered.”
Put a response matrix in the contract: each action (isolate a host, quarantine a file, disable an account, block an indicator), the asset groups it covers, whether it is pre-approved, who approves the rest, and what happens when nobody answers. The same gates apply when AI agents act; the AI SOC platforms comparison sets autonomy limits by blast radius.
Telemetry coverage and 24×7 operations
An MDR service investigates only what it can see. Gartner says MDR stacks “commonly” cover endpoints, networks, logs and cloud. CrowdStrike says Falcon Complete analysts correlate Falcon platform telemetry “across endpoints, identities, AI agents, cloud, SaaS, and third-party data,” while Zscaler MDR contains threats through other controls: “isolate endpoints via EDR, suspend users via your IDP.” Coverage is whatever is integrated and named in the contract. The joint advisory also recommends keeping the most important logs “for at least six months.”
Gartner lists 24/7 staffing as a mandatory MDR feature, but the rest of IT doesn’t follow automatically. The NCSC warns that a 24/7 SOC’s effectiveness “would be greatly reduced if other IT functions are only covered 9-5 with no on-call arrangements.” Your contacts and decision-makers need matching hours; rehearse the escalation path in a ransomware tabletop exercise.
How EDR, XDR and MDR fit together
The three stack. Gartner lets an MDR stack be the provider’s own technology or “an integrated set of commercial technologies,” so three arrangements are common: MDR from the platform vendor (Microsoft’s service triages Microsoft Defender incidents; CrowdStrike’s works from Falcon platform telemetry), MDR that plugs into existing tools (Arctic Wolf, Zscaler), and co-managed setups where your team runs EDR or XDR and the provider adds coverage.
MITRE’s ATT&CK Evaluations are moving products and services into one framework. According to its FAQ, Enterprise 2026, which the evaluations site lists as starting soon, tags results (P) when a platform generates alerts autonomously, (S/H) when “human MDR analysts” validate and escalate findings, and (S/AI) when AI performs analyst-equivalent investigation. MITRE says (P) and (S/H) scores “should not be compared directly,” states there are “no rankings and no declared winners,” and delivers participant-specific results privately while publishing aggregated findings.
How vendors package MDR
Vendors’ own descriptions as of October 2026, alphabetical, not ranked.
| Provider | Offering | Vendor’s description |
|---|---|---|
| Arctic Wolf | Aurora Managed Detection and Response | Open XDR platform; AI investigates while “humans remain in the loop for decisions that require judgment and context” |
| CrowdStrike | Falcon Complete | 24/7 MDR on Falcon platform telemetry; “full-cycle remediation on your behalf” |
| Microsoft | Defender Experts MDR | Triages Microsoft Defender incidents; acts directly only with Security Operator access |
| Sophos | Sophos MDR | Notify Only, Collaborate or Authorize response modes |
| Zscaler | Zscaler MDR | Acts through EDR and the identity provider; sends alerts to “your SIEM, SOAR, or ITSM platform” |
Questions to ask an MDR provider
- Coverage: which telemetry sources and operating systems are in scope, and which are excluded.
- Response actions: which are pre-approved, on which asset groups, who approves the rest, and the rule when nobody answers.
- Who acts: analysts, AI agents or automation, and how agent identities are governed; see the AI agent identity governance guide.
- Access: how provider accounts are scoped, protected with MFA and logged where you can review them.
- SLAs: how and when you’re notified (contracts “should detail how and when,” per the joint advisory), time targets, and remedies, all written into the contract.
- Onboarding: what must be deployed or integrated, by whom, and when coverage starts.
- Reporting: investigation summaries, periodic reports and access to raw telemetry.
- Incident response: whether eradication and recovery are included; check against your ransomware recovery plan.
- Exit: who owns agents, licenses, detection content and stored telemetry, how history is exported, and how provider accounts are removed, since disabling them “can be overlooked when a contract terminates.” The Zscaler and Red Canary analysis covers portability terms.
MDR vs EDR vs XDR comparison table
| EDR | XDR | MDR | |
|---|---|---|---|
| Main job | Endpoint visibility, detection, response actions | Correlated detection and response across sources | Monitoring, investigation and response by analysts |
| Telemetry | Endpoints running the agent | Native sensors plus integrated sources | Provider’s stack or yours, as scoped |
| Response | Isolate, quarantine, block, per your policy | Automated across integrated tools | Per contract: advise, act on approval, or act and report |
| Hours | Your staffing | Your staffing | 24/7 under Gartner’s definition |
| Leaves to you | Triage, investigation, unmanaged devices | Operating it; sources not integrated | Business context, accountability, recovery unless contracted |
| Typical MITRE 2026 tag | (P) | (P) | (S/H), (S/AI) or Mixed |
Who should buy which
- In-house 24×7 SOC: run EDR or XDR directly. MITRE’s FAQ notes that even a lower-scoring pure platform “may be the right fit for an organization with a strong internal SOC.”
- Business-hours SOC: keep EDR or XDR in-house and add MDR for nights and weekends, with collaborate-style authority.
- No SOC: buy MDR with pre-approved containment for clear-cut cases, on EDR deployed to all assets.
- One vendor’s platform throughout: compare that vendor’s MDR with one that plugs into existing tools; the second stays portable if tools change.
- Regulated or safety-critical systems: narrow pre-approvals, exclusion groups, and leadership sign-off for high-impact actions.
Frequently asked questions
What is MDR?
Managed detection and response is a service in which a provider’s analysts monitor, investigate and respond to threats for you. Gartner defines it as remotely delivered SOC functions with 24/7 staffing and remote containment preapproved by the customer.
Do I need MDR if I have EDR?
It depends on who works the alerts. EDR supplies telemetry, detections and response actions, but someone still has to triage, investigate and decide, at any hour. If an in-house SOC already does that around the clock, MDR is optional; if not, MDR supplies the analysts and, where the contract allows, the authority to contain threats.
EDR vs XDR vs MDR: what is the difference?
EDR detects and responds on endpoints. XDR correlates detection and response across several sources, such as endpoint, identity, email and cloud. MDR is a managed service that operates tools like these for you.
Can an MDR provider use existing EDR tools?
Often. Gartner allows the provider’s stack to be “an integrated set of commercial technologies,” and Arctic Wolf and Zscaler describe working through customer tools. Others build the service around their own platform, so confirm supported products before signing.
Sources
- NIST glossary: EDR, XDR, MDR
- NIST SP 800-61r3
- OMB M-22-01
- CISA CDM APL submission instructions
- #StopRansomware Guide
- Joint advisory on managed service providers
- NCSC: CIR technical standard, Building a SOC, To SOC or not to SOC?
- MITRE ATT&CK Evaluations FAQ
- Gartner Peer Insights: MDR, XDR
- Vendors: Microsoft Defender XDR, Defender Experts MDR, Sophos, CrowdStrike, Arctic Wolf, Zscaler
Last checked: October 2026. Guidance and product features change; check each source before you rely on it.
Buying? Start from RFPhub’s free MDR RFP template.