Got an 'MDR' 24/7 monitoring quote for 2k/mo — what is it, and does a 10-person company really need it?

In finance, regulatory requirements and client NDAs run the show. If your clients are institutional funds or if you undergo annual compliance audits, you have to answer yes to having a 24/7 monitored SOC. The service isn't a luxury, it's a necessity, but that price is totally inflated; switch to a per-endpoint pricing model.

To understand the difference, consider this scenario: Saturday at 2:00 AM, an employee's laptop gets compromised via a phishing email. If the antivirus doesn't flag the payload, your entire environment will be encrypted by Monday morning. With MDR, the analyst on duty remotely isolates that laptop from the network at 2:05 AM and kills the malicious process on the spot.

If your database is already hosted in cloud software for a 10-person company, what critical data is actually stored locally on those laptops? If everything runs through the browser, tightening cloud identity management and enforcing strict session policies is way cheaper and far more effective than dropping that kind of cash per machine.

That quote is insanely overpriced. We're in California paying $22 per endpoint per month for 18 devices; our total bill isn't even $400. That includes weekend monitoring and suspicious email analysis too. Don't even bother negotiating with that firm, just look for an MSP that caters to small businesses.

So if we get MDR do we have to uninstall our existing antivirus, or do they run together on the same machine? Also, will it slow down the laptops and annoy the staff?

note: I wrote this based on my own experience, it might not apply to everyone.

Two years ago we turned down a similar quote thinking who would ever bother targeting us. Over Thanksgiving weekend, a partner's email got hijacked through his laptop and the attackers sent fake wire instructions to our clients. What we spent on incident response and client compensation burned through two years' worth of MDR fees in a single week.

edit: fixed a few typos.

Tell that vendor straight up: we won't accept a monthly minimum spend, what's your per-device pay-as-you-go rate? If they don't offer SMB tiers, move on; the market is packed with solid providers delivering this to small businesses for $25-30 a month.

There is something to watch out for. Everything goes well for the first three months; problems arise in the fourth.

If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection. If you have questions, write them; I'll answer as best I can.

My perspective changed after experiencing that. Taking notes for two weeks yields better results than a six-month estimate.

Payment information changes are never verified through the channel they came from.

Here's how it went for us. People defend habits, not processes. Resistance comes from there.

Most time waste accumulates in tasks waiting for approval. Correct me if I'm wrong.

We need to make a distinction here. The biggest time-waster for us was not knowing who had the final say.

If you scold false alarms, nobody will report again. If you have questions, write them; I'll answer as best I can.

If I understood correctly, you're saying: Taking notes for two weeks yields better results than a six-month estimate.

Correct me if I'm wrong.

I didnt know that.

I can't fully agree with this. Hasty decisions become decisions you have to fix six months later.

This is my opinion, I'm not claiming it's absolute truth.

Thanks, that was the answer I was looking for.

I'd appreciate it if you shared the outcome.

I completely agree. When making a decision, first look at what data you have on hand.

If I were you, I'd go this route.

I've been dealing with this for a long time. anyway if the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection.

Of course, it varies if your situation is different.