We got quotes for 'Managed SIEM' and 'MDR' — what's the difference, and which fits a 12-person team?

From a technical standpoint, SIEM is data-centric, while MDR is process- and behavior-centric. SIEM feeds event logs from diverse sources through a correlation engine. MDR catches suspicious activities like memory injection or privilege escalation using sensors that hook deep into the OS kernel. If you have no regulatory mandate for log retention, MDR gets straight to the point.

We faced the exact same dilemma last year for our 18-person team. SIEM was quoted at 2,100 dollars a month plus log ingestion overage fees. For MDR, we settled on 1,100 dollars a month covering 22 endpoints. In the first six months, the vendor handled all 14 suspicious incidents without ever waking our team up.

Check your NDA or audit requirements with your client. Unless there's an explicit compliance clause stating 'All system logs must be retained in a SIEM for at least 1 year,' steer completely clear of SIEM. Go straight for an MDR contract and give yourself peace of mind.

Some companies selling MDR basically just stick two interns in front of an antivirus dashboard and have them email you whenever an alert pops up. Check the SLA wording in the proposal: what's the response time in minutes, and do they take the authority to isolate the machine from the network during a threat themselves, or do they wait for your approval?

if u get a siem your devs are gonna get sick of the alert fatigue after a couple weeks and just mute the notifications. btw then when the first real incident hits no one notices a thing. go with mdr, hand it off to the pros imo.

note: I wrote this based on my own experience, it might not apply to everyone.

Is your client demanding this monitoring for an audit based on SOC 2 or ISO 27001 standards? If so, have you checked in advance whether your MDR provider holds a SOC 2 Type 2 certification and requested the monthly incident response report formats to be presented to the auditor?

We advise including the response times stated in the service level commitment (MTTD and MTTR) as explicit contractual clauses. The gap between detection time and remediation time directly affects your legal liability during a crisis.

so if we go with MDR, do we still need to install traditional antivirus software on employees' laptops or do those agents handle both jobs on their own?

i'm in the same situation, that's why I'm asking.. but everyone rushing into managed SIEM and MDR gets stuck at the same point.

im also curious if anyoe does it differently.

I'll try it. If 2FA is on, a stolen password alone is useless.

Proven by experience.

We need to make a distinction here. Security isn't absolute; it's about making attacks not worth the effort.

I felt relieved reading this answer, so it's not just me. Don't hesitate to ask; those who don't ask always pay more.

I'm also curious if anyone does it differently.

Let's separate the concepts, they're getting mixed up. Everything goes well for the first three months; problems arise in the fourth.

Correct me if I'm wrong.

I'd say don't rush. Trying to do this alone is the most expensive way.

Don't hesitate to ask; those who don't ask always pay more. If you post the result here, it will help others too.

Just a heads-up. Don't hesitate to ask; those who don't ask always pay more.

Let me write how it's done in practice. Most incidents start with a leaked password, not a vulnerability.

Mistakes made on the managed SIEM and MDR side are usually reversible but expensive. I'm also curious if anyone does it differently.

Correct.

The most overlooked point about managed SIEM and MDR is this: Having backups accessible on the same network and with the same identity makes them part of the target.

Trying to do this alone is the most expensive way. Hope this helps.