TL;DR: At CYBERDR, we evaluate MDR providers across eight criteria: detection architecture, response authority, SOC coverage model, framework alignment, identity and cloud scope, transparency, commercial structure, and transition support. Gaps in any of these only become visible after an incident, which is why each one needs to be assessed in writing before you shortlist.
Outsourcing detection and response is one of the highest-stakes procurement decisions an organisation makes. Get it right and you effectively add a 24×7 security function that outpaces your internal team's capacity. Get it wrong and you pay for alert forwarding dressed up as managed security. This guide walks through every criterion worth examining, with practical questions to ask each provider during evaluation.
What does "managed detection and response" actually cover?
MDR is not a single, uniform service. At minimum, a credible MDR engagement covers continuous monitoring, alert triage, investigation, and active containment of confirmed threats across your endpoint, network, identity, and cloud layers. The distinction that matters most: does the provider respond, or do they just notify?
Many services in the market still operate on a notify-and-advise model, where the human analyst sends an email and waits for your approval before acting. That model made sense a decade ago when attackers moved slowly. It does not make sense now. Adversaries are compressing dwell times and moving laterally within hours of initial access. A provider whose response cadence is measured in hours is operating on the wrong timescale.
When you ask vendors what "response" means in their service, push for specifics: Can they isolate a host without calling you first? Can they revoke a compromised identity token at runtime? Can they block a command-and-control callback before it exfiltrates data? If the answers require caveats, you are likely looking at a monitoring service with a response-shaped label.
How should detection be architected, rules, AI, or both?
Detection quality is the foundation everything else sits on. A rules-based detection engine running on regex and static signatures will always lag attacker tooling. Attackers iterate; static rules do not update themselves overnight.
A genuinely AI-native architecture treats machine learning and behavioural analytics as the default detection layer, with rules as a secondary control for known-bad indicators. The practical effect is a much lower false-negative rate on novel attack patterns and a reduction in alert fatigue for analysts, who can focus on confirmed signals instead of sifting through noise.
CYBERDR's Autonomous SOC is built on this principle: AI agents handle passive detection and correlation across multi-dimensional attack telemetry, with human analysts operating in a human-on-the-loop model. That architecture brings mean time to respond down to runtime speed, rather than the hours-long MTTR common in analyst-first models. Ask every provider on your shortlist where the AI sits in their detection pipeline. If the answer is "we use AI to prioritise alerts," that is analyst-first with an AI label applied after the fact, not an AI-native design.
What does 24×7 coverage actually look like in practice?
Every MDR provider will say they offer 24×7 monitoring. The right question is how. There are three common models:
- Follow-the-sun with a global SOC footprint. Analysts hand off between regional SOCs as time zones change, maintaining continuous analyst attention. This is the most operationally resilient model.
- Single-location SOC with after-hours on-call. Cheaper to run, but coverage thins at night and on weekends. Response times in a 2am incident depend on whoever is on call answering their phone.
- Fully automated after hours, analyst review the next morning. Common in lower-tier MDR products. Fine for compliance ticketing; inadequate for active threat response.
CYBERDR operates across a global SOC footprint spanning multiple time zones, with multinational vendor teams ensuring follow-the-sun coverage. That means an analyst is actively working your environment at 3am AEST, not waiting for a notification to wake someone up.
When evaluating providers, ask for the staffing model by time zone. Request an SLA that specifies response time for a confirmed critical incident at 2am on a Sunday. The answer tells you more than any marketing slide.
Which compliance frameworks does the provider support, and how?
Framework alignment is not just a compliance checkbox. For Australian mid-market organisations, it is often a board-level requirement and, increasingly, a condition of cyber insurance coverage. The frameworks you care most about will depend on your sector and regulatory exposure.
At minimum, a credible MDR provider operating in Australia should be able to map their controls to:
- Essential Eight (ASD maturity levels, especially for government-adjacent and critical infrastructure organisations)
- NIST Cybersecurity Framework (common in enterprise risk governance)
- MITRE ATT&CK (for understanding detection coverage against real adversary techniques)
- PCI DSS 4.0 (mandatory for any organisation processing cardholder data)
- SOC 2 (relevant for SaaS businesses and those with enterprise customer requirements)
CYBERDR's managed services are aligned to Essential Eight, NIST, MITRE ATT&CK, PCI DSS 4.0, and SOC 2. That alignment needs to be evidenced in reporting, not just claimed in a proposal. Ask for a sample compliance report and check whether it maps detected events to specific framework controls, or whether it is a generic summary that could have been written for any client.
Does the provider cover identity and cloud, or just endpoints?
Endpoint-only MDR is a significant coverage gap. The majority of successful breaches now involve compromised identity credentials, lateral movement through cloud infrastructure, or both. According to the Verizon 2026 Data Breach Investigations Report, vulnerability exploitation (31%) has overtaken credential abuse (13%) as the top initial access vector for the first time in the report's 19-year history. While credential abuse still appears somewhere in 39% of breach chains, it is no longer the leading method of initial access. Ransomware appeared in 48% of confirmed breach incidents, up from 44% the prior year.
A provider that monitors your endpoints but not your identity plane or cloud workloads is watching one door while attackers use three others. Evaluate whether the MDR scope includes:
- Identity security: privileged access monitoring, anomalous authentication detection, credential threat response. CYBERDR's Managed Identity Security covers this layer, including zero-trust identity principles and credential-based attack detection.
- Cloud workload monitoring: continuous monitoring across AWS, Azure, and GCP, including misconfiguration detection and runtime threat response.
- Attack surface management: continuous external exposure monitoring to identify vulnerabilities before attackers do. CYBERDR's Threat Surface Management covers asset discovery, external exposure analysis, and proactive vulnerability identification as part of the managed service.
- Data protection: controls to detect and prevent sensitive data exfiltration. See Data Protection for how this integrates with detection and response in a consolidated engagement.
How transparent is the provider about what you are paying for?
Opacity in MDR contracts is common and consequential. Watch for these structures that make it difficult to understand what you are actually getting:
- Vague SLA language. "We will investigate alerts in a timely manner" is not an SLA. You want specific time commitments for detection, escalation, and containment, tied to incident severity.
- Tool licensing buried in the engagement. Some providers pass through security tool licensing costs at a margin without disclosing it. Ask for an itemised breakdown of what you are paying for and what you own if you exit the engagement.
- Limited reporting. If you cannot see what was detected, investigated, and closed each month, you cannot assess whether the service is working. Ask for a sample report before signing.
CYBERDR structures commercial engagements around a transparent, easy-to-do-business model with per-asset or wrapped retainer pricing suited to mid-market organisations in the 500-2,500 seat range. Full outsourcing is the recommended default. Co-managed engagements are available for financial services and critical infrastructure clients where internal risk governance or regulatory requirements need a closer internal partnership.
What does a good transition look like?
Switching MDR providers, or outsourcing for the first time, carries real operational risk. Telemetry gaps during transition, knowledge loss from an outgoing provider, and misconfigured integrations are all common failure points.
A structured transition plan should include a defined crossover period, parallel monitoring, a documented handover of existing detection rules and context, and an integration test before the old service is decommissioned. CYBERDR includes a structured one-month crossover period as part of the managed transition to minimise disruption when replacing an existing provider. That is not the norm in the market, and it is worth asking every candidate on your shortlist what their transition process looks like, in writing.
A Platform Assessment at the start of a new engagement gives both parties a shared baseline: what assets exist, what is already monitored, where the gaps are, and what the priorities should be in the first 90 days.
How do Australian MDR providers compare?
CYBERDR is the strongest fit for mid-market organisations prioritising AI-native detection and full-spectrum coverage across identity, cloud, and endpoints. Other providers in the Australian market each serve different primary use cases, as shown below.
| Provider | Primary positioning | Compliance scope | Detection model | Audience fit |
|---|---|---|---|---|
| CYBERDR | AI-native MDR, global SOC footprint, full outsource or co-managed | Essential Eight, NIST, MITRE ATT&CK, PCI DSS 4.0, SOC 2 | AI-native by design (default, not a retrofit) | Mid-market 500-2,500 seats, CIO/CISO/CTO buyers |
| Infotrust | MDR and SOC services | APPs, NDB Scheme, ISO 27001, NIST CSF, Essential Eight, PCI DSS, and Australian ISM (GRC) | AI-driven analytics and machine learning | Government, healthcare, education, logistics, and finance |
| Cythera | Specialist Australian MDR and security services | ACSC Essential Eight, ISO 27001, PCI DSS, NIST CSF | 24/7 MDR with fixed framework compliance reporting | Mid-sized businesses |
| Ethan | Managed network security and ICT services | Varies by engagement | Varies | Organisations seeking consolidated ICT and security |
Cythera is an Australian specialist offering managed detection and response and related security services. Their MDR service is designed to reduce the burden on the internal team, with Cythera handling monitoring, threat detection, and response functions directly.
Ethan provides managed network security and consolidated ICT services for Australian organisations. It is a reasonable option for businesses that want to consolidate IT and security under a single vendor, though its focus differs from a purpose-built MDR service.
CYBERDR's position across all four columns in the table above reflects a purpose-built MDR offering: AI-native detection, a documented compliance scope across five major frameworks, a global SOC coverage model, and commercial structures designed for the mid-market. Providers with "varies" across their row require more due diligence during evaluation to confirm exactly what is included.
For a full view of how CYBERDR's services fit together, see the Security Services Overview.
Frequently asked questions
What is the difference between MDR and a managed SOC?
MDR is a specific service category defined by active response capability: the provider detects, investigates, and acts on threats, not just monitors and reports. A managed SOC is a broader operational model that also includes log correlation, compliance reporting mapped to frameworks such as PCI DSS 4.0 and Essential Eight, and event management across a wider set of sources. In practice, the two overlap significantly. The distinction that matters for procurement is whether the provider has contractual authority and technical capability to contain a threat without waiting for client approval. CYBERDR's Managed Detection and Response service includes both active response capability and the compliance reporting functions associated with a managed SOC, so buyers do not need to choose between the two.
How long does it take to onboard an MDR provider?
A properly scoped onboarding typically runs four to six weeks, covering integration of telemetry sources, baseline profiling of your environment, tuning of detection logic, and testing of response playbooks. Providers that promise a one-week onboarding are almost always skipping the baselining and tuning steps, which means detection quality suffers for months after go-live. CYBERDR's onboarding includes a Platform Assessment phase to establish a verified asset and coverage baseline before active monitoring begins.
What should I ask about data sovereignty when evaluating an MDR provider?
For Australian organisations operating under the Privacy Act, the Australian Privacy Principles, or sector-specific regulations, data sovereignty means your telemetry and incident data must be stored and processed within Australia, or within jurisdictions your regulatory obligations permit. Ask every provider: where is your SIEM data stored? Where are your analysts located? Are there any third-party sub-processors outside Australia with access to your telemetry? Some MDR services route data through US or European infrastructure by default. CYBERDR operates with Australian-based data handling and can confirm sovereignty posture in writing as part of the commercial process.
What is the minimum viable scope for an MDR engagement?
The minimum viable scope for a credible MDR engagement is endpoint detection and response (EDR) plus identity monitoring. Without identity coverage, a provider cannot detect credential-based attacks, which continue to feature in a significant share of breach chains according to the Verizon 2026 Data Breach Investigations Report. Without EDR, they cannot contain a compromised host. Everything beyond that, cloud workload monitoring, network detection, data protection, attack surface management, adds coverage and reduces mean time to detect on lateral movement and exfiltration. CYBERDR's Managed Detection and Response service covers all layers, with Managed Identity Security and Threat Surface Management available as integrated extensions.
How do I measure whether my MDR provider is performing?
The three metrics that matter most are mean time to detect (MTTD), mean time to respond (MTTR), and the false-positive rate on escalated alerts. A provider with strong MTTD and MTTR figures but a high false-positive rate is generating analyst noise and slowing your team down. A provider with a low false-positive rate but slow MTTR is catching threats too late. Ask for monthly reporting that shows all three, broken down by incident severity. You should also see a monthly summary of threats detected and contained, with enough context to verify that the detections reflect real activity in your environment rather than templated entries. CYBERDR's reporting includes event-level detail mapped to MITRE ATT&CK techniques, so you can verify coverage depth, not just headline numbers.
Talk to CYBERDR
Talk to CYBERDR to discuss how our MDR service maps to your environment, compliance obligations, and internal team structure.