Contents:
Trying to decide if you should use a managed detection and response (MDR) service, or build your own security operations centre (SOC)? Our MDR vs SOC comparison will help you decide which is best for you.
It’s an age-old question. Should your business outsource a function to external experts, or should you build your own in-house team? Every department in every business has to grapple with this issue:
- Finance: Do you hire full time finance teams or outsource to an accountant?
- Marketing: Do you recruit a marketing department, or do you find an agency to run your campaigns?
- Human resources: Do you build your own HR team, or use an external company to do your payroll?
When it comes to cybersecurity, the questions are much the same. Is it better to use an external managed detection and response (MDR) provider to do much of your security monitoring for you? Or should you create your own internal security operations centre (SOC) by hiring a permanent team?
This guide will compare MDR vs SOC to clarify the differences in approach and help you decide which is best for you.
We’ll also look at a hybrid approach that combines both options.
To give you a sense of what different companies offer, you’ll also find examples of five MDR providers.
MDR vs SOC – what’s the difference?
MDR and SOC are not competing categories. Rather, they are two distinct approaches to how your business manages cybersecurity.
What is MDR?
Managed detection and response (MDR) is an outsourced cybersecurity service. The MDR provider will typically offer:
- 24/7 monitoring of your business’s IT environment.
- A team of skilled experts who will use their own tools, and potentially your existing security tools, to scan for threats on endpoints, in the cloud and across your network.
- Remediation – the provider will usually close down severe threats automatically and alert you to them. They will also provide you with alerts and recommendations to secure your environment.
- MDR may be provided by a cybersecurity software vendor, like Heimdal or Expel, or a managed service provider (MSP).
- The extent of the service depends on the SLA. Some MDRs only offer detection and response. Others may also be capable of other related security tasks.
Here’s a complete guide to MDR.
What is a SOC?
A SOC is an internal team at an organisation that monitors for and detects threats, as well as a range of other security tasks. The SOC will typically:
- Ensure the security of information systems, networks, infrastructure and digital assets.
- Use a variety of cybersecurity tools to monitor for threats and respond, as well as performing other active tasks such as threat hunting.
- Comprise of a team of professionals with different skillsets, including analysts, incident responders and forensic experts.
Here’s a complete guide to SOC.
MDR vs SOC: quick comparison
The table below highlights some of the key differences between the two approaches.
MDR vs SOC – how to choose between them?
Opting for an MDR or building out your own SOC can both be good options. The choice ultimately depends on your particular context.
When is an MDR the right option?
A managed detection and response service can be a very good option in the following scenarios.
You don’t have the people or capital to build out a SOC
Building out a SOC is expensive. For many small to medium sized businesses, hiring a 24/7 team of cybersecurity experts is unrealistic. There is a shortage of cybersecurity professionals worldwide. Those that exist tend to command high salaries and are liable to be poached. An MDR means you don’t have to recruit and retain these sought-after workers.
You need security now
An MDR can onboard your environment in just a few minutes. Complete monitoring and setup may take a few weeks, but your environment will be protected much faster than if you were to build out your own SOC.
You want security done by specialists
Employees at the MDR will be highly skilled and experienced. Since MDR providers will be serving dozens, or even hundreds, of customers, their teams will have well-developed and effective processes for containing threats.
It takes a lot of the day-to-day pressure off a very small team
– Jan-Ove Pedersen, IT Manager.
Read how MDR helped one Norwegian municipality with a small team manage threats, 24/7.
Limitations of MDR
There are situations where an MDR is less suitable, including:
- You are in a highly regulated industry which makes outsourcing the monitoring of sensitive data problematic
- You want a fully outsourced security solution – standard MDR doesn’t cover all cybersecurity issues
- You require your security provider to have a very deep knowledge of your business
- If the vendor or MSP has their systems breached, this exposes you to high risk supply chain attacks
When is a SOC the right option?
Building out your own SOC can have many advantages. Here are some of the reasons to choose this approach.
You’re a large enterprise with adequate budget
A SOC unit is a strong option for any organisation that can afford one. The team will be able to customise tools and processes to your business’s specific activities and threats. You can select the tools you prefer and stitch them together with a SIEM and a SOAR. Your business will retain complete control over cybersecurity.
You are in a regulated industry
Some sectors, particularly finance, healthcare and government, have strict rules about who, where and how customer data can be processed. This may mean that outsourcing to an MSP or MDR vendor contravenes regulations. Having an internal SOC might be the only option.
You don’t want to deal with third-party suppliers
Using an external vendor is not always a positive experience. If customer service and responsiveness is poor, then the investment in an MDR is undermined. Some organisations also prefer to keep accountability for big security decisions in-house.
You want all security activity in one place
Even with an MDR, organisations will still need to perform some cybersecurity tasks in-house. You may ultimately decide it’s more efficient to just do everything yourself, rather than outsourcing some tasks to a third party.
Limitations of SOC
There are several drawbacks to building your own SOC:
- It is very expensive in terms of staff salaries and tooling
- It can take months or years to fully build out a SOC
- Inefficient analyst usage – SOC staff spend most of their time dealing with ‘false positive’ alerts. It is arguably more efficient to outsource this
- SOC teams are usually fairly small. They may have less experience in dealing with the wide range of attacks that cyber criminals use today
A ‘middle way’ – the co-managed / hybrid model
Having a SOC or using an MDR are not mutually exclusive. Many organisations use a hybrid model. They outsource threat detection and response to an MDR, but retain control over some processes. For example, customers may wish to orchestrate the response themselves after the MDR has identified a threat.
In a hybrid model, the internal SOC will carry out some tasks internally. For example, they may outsource 24/7 monitoring to the MDR vendor, while the internal team focuses on things like compliance reporting, building playbooks or patching proprietary apps.
To implement this kind of co-managed model, you will typically need to work directly with a security vendor who offers a MDR service with their own tools. You can then integrate their MDR into your SOC’s dashboards. You will also need to clearly define responsibilities and expectations when negotiating with the vendor.
5 examples of MDR vendors
If it feels like the outsourced or hybrid MDR model is right for your organisation, it’s helpful to understand the vendor landscape. There are dozens of MDR vendors out there, but here are five with clear differentiators.
1. Heimdal MXDR
Cybersecurity vendor Heimdal has built a range of award-winning endpoint security, privileged access management, email, threat hunting and response tools.
Their MXDR services offer 24/7 protection in a cost-effective package.
The company will roll out a single lightweight agent across your network, then the experienced, global team monitors and manages it for you.
Best for flexibility
Heimdal’s MXDR is highly flexible. Their MDR team can offer a fully-outsourced managed service. But they can also work as an extension of your SOC, triaging alerts and handing off critical issues to you.
Their service is also able to work seamlessly with a wide range of third-party security tools. If you have already invested in monitoring and threat detection software, Heimdal can usually integrate data from these apps.
2. CrowdStrike Falcon Complete
CrowdStrike’s MDR is a powerful offering that promises rapid containment, 24/7 protection and a strong AI monitoring tool. While it is a relatively expensive supplier, CrowdStrike’s MDR is widely respected for its solid tools.
Best for platform-native firms at larger businesses
CrowdStrike Falcon Complete works best for organisations that are already invested into CrowdStrike’s solutions (EDR, XDR, SIEM etc.). The platform is less suitable if you prefer to keep using third-party apps.
3. SentinelOne Wayfinder MDR
Like CrowdStike, SentinelOne’s MDR is a platform-native MDR for firms that are already invested in SentinelOne’s Singularity platform. Again, it offers a 24/7, 100% in-house analyst team, and a strong AI detection tool. It is also well suited to government and regulated industries.
Best for platform-native small and medium sized businesses
With more affordable pricing than CrowdStrike, SentinelOne’s MDR is a good option for SMEs that are already using other SentinelOne tools.
4. Expel MDR
Expel MDR’s service offers a layer that sits on top of your existing technology stack. If you have already invested in multiple security tools, Expel’s service uses APIs to bring data in from those apps without you needing to rip and replace.
Best for firms that have their own tools
Expel’s MDR can be a good option if you already have a small SOC unit, but don’t have the time to manage all alerts. Expel’s solution can help with triage and response, lightening your load.
5. Microsoft Defender Experts MDR
With Microsoft’s MDR, you get 24/7 support from experts who triage and investigate incidents and help you respond. They also provide guidance on how to improve your security posture.
Best for Microsoft-centric businesses
If your organisation is fully invested in the Microsoft tech stack, then Microsoft’s own MDR can be a good option.
MDR vendor due diligence: what to ask
If you’re considering outsourcing some of your organisation’s security to a third party, you want to be sure you can trust them to keep you safe.
All MDR businesses – be they software vendors or a separate managed service provider – offer similar core services. Choosing between them can therefore be challenging.
We generally recommend all MDR buyers to request demos from a handful of vendors that appear to match their needs.
You can then ask specific questions to ensure they meet your exact requirements. Here are some starter questions to ask:
Coverage
Ask the vendor what endpoints, clouds, networks, SaaS apps and identity tools they monitor. You’ll also want to find out about third party integrations. Can they monitor data from your existing security stack?
Service level
Ask them for precise figures and facts about their services, based on real data from existing customers:
- Do they actively respond to threats, or just send you alerts?
- What is their false positives rate?
- What is their real-world mean time to detection (MTTD) and mean time to respond (MTTR)
- Can they provide audit trails?
- What response frameworks do they follow? (e.g. MITRE ATT&CK)
Analyst team
You’ll want to get a sense of who will be managing your account and how well they will ‘know’ you.
- Do you get assigned a single named contact or team?
- What qualifications does the team have?
- What is analyst turnover like?
- How often do analysts receive training?
Compliance
If your industry is regulated, you will need to verify that the MDR can provide logs and data to ensure you will comply with any audits you may undergo.
MDR or SOC or hybrid – Heimdal’s flexible alternative
Every organisation’s security needs are unique. That’s why we built our unified cybersecurity platform to be completely flexible.
If you’re building a SOC with best of breed tools, our modular platform lets you mix and match apps from our own stack as well as any existing solutions you’re already using.
If you need a fully managed service, then our MXDR offering gives you just that. Or if you need a hybrid option, then we can provide you with a custom option that meets your needs.
Contact us today for a demo, and see how our tools and services can help you build the right security posture for your needs.
FAQs about MDR vs SOC
Is MDR or SOC better?
MDR and SOC are two different approaches to cybersecurity. It’s not possible to say one is ‘better’ than the other – the choice depends on your organisation’s context and strategy.
Using an outsourced MDR service may be more appropriate for SMBs or firms that need coverage very quickly.
Building out your own SOC might be more appropriate if you have a larger budget and prefer to retain complete control over security operations.
Is it better to use an MSP, or go direct to the vendor for MDR?
Many cybersecurity software vendors, such as Heimdal, SentinelOne or Microsoft offer their own MDR services. At the same time, independent managed service providers (MSPs) may also use these companies’ tools to offer managed detection and response services of their own.
Deciding between these two options ultimately depends on your company’s specific needs. Working with a smaller MSP / MSSP can provide you with a more direct relationship.
The analysts at the MSP / MSSP are likely to be closer to your business and know your needs better than analysts at the cybersecurity software vendor (who will typically have thousands of clients worldwide).
On the flip side, going direct to the vendor can often be cheaper, since you don’t pay the MSP’s mark up fee.
Does a SOC basically do the same things as MDR?
While there is some crossover between the activities of a SOC and an MDR, there are also important differences.
An MDR is a service offered by an outside company. The service is limited to monitoring for threats in your environment and closing them down.
A SOC will also typically monitor and respond to threats. But it is also responsible for many other cybersecurity tasks, including things like patch and asset management, building out event playbooks, reporting, tool maintenance and more.
If you liked this article, follow us on LinkedIn, Reddit, X, Facebook, and Youtube.
