We're being offered "MDR cybersecurity" for 400 €/mo — what is this, and does it replace a SOC?

The core difference between MDR and traditional endpoint protection is the human element. Standard software blocks known malware signatures; however, if a targeted attacker infiltrates your network using legitimate built-in administrative tools, conventional software might stay silent. An analyst in an MDR center spots that anomaly and cuts the device's network connection immediately.

What response time (SLA) does the contract specify? If suspicious activity kicks off at 2:00 AM, will it take them 15 minutes to spot it and act, or are they just promising to "investigate within 4 hours"? Also, is your corporate email environment covered under this MDR monitoring umbrella?

We rolled out a similar service for our 35-person office in Paris. We pay roughly 18 € per device each month, so 400 € for 20 machines is right around market average. Last month an employee opened a malicious payload inside a fake invoice attachment that slipped past the firewall, but the MDR analyst isolated the machine within 8 minutes and called us right away. Saved the day.

Is the IT company quoting 400 € actually doing the monitoring themselves, or are they just reselling a managed license from an enterprise security vendor and tacking on a markup? If they don't have dedicated engineers on duty 24/7 in-house, an alert triggered in the middle of the night won't get looked at until business hours start, which defeats the entire purpose of having MDR.

I'd say get your basic cyber hygiene in order before moving to MDR. Is 2FA enforced, are your backups air-gapped from the network, do employees have restricted local admin privileges? Without these, even an MDR service you pay 400 € a month for won't stop ransomware caused by a misconfigured admin account.

all we have is standard antivirus behind the modem. once this MDR is set up, do we need to uninstall the current antivirus or can both run side by side withoout bogging down the PCs?

Advanced MDR agents completely replace legacy antivirus; running both at the same time will cause system freezes. Your MDR provider runs its own protection engine in the background anyway and feeds suspicious logs directly to its SOC. You won't need to renew your old license.

There's a common mistake people make when doing this. Most time waste accumulates in tasks waiting for approval.

I'm also curious if anyone does it differently.

I'm curious too. Most incidents start with a leaked password, not a vulnerability.

I have an objection here. The answer varies greatly by industry; there is no one-size-fits-all rule.

If I were you, I'd go this route.

My questions are cleared up, thanks.

following but payment information changes are never verified through the channel they came from.

if you have questions, write them; I'll answer as best I can.

I think differently. Mistakes made on the mdr cybersecurity side are usually reversible but expensive.

That's all, sorry if I went on too long.

Saved.

My perspective changed after experiencing that. Security isn't absolute; it's about making attacks not worth the effort.

If I were you, I'd go this route.

Correct. Most incidents start with a leaked password, not a vulnerability.

I'm also curious if anyone does it differently.

i'll try it.

quick summary for newcomers: If you dont write this down from the start, it leads to arguments later.

forgotten test environments are more often the entry point than live systems and this is my opinion, Im not claiming its absollute truth.