What Is MDR (Managed Detection and Response)?

What does MDR actually do?

MDR pairs detection technology with a human team that hunts, triages and responds to threats around the clock. Where antivirus blocks known malware and EDR flags suspicious behaviour, MDR puts trained analysts behind the alerts — investigating, containing compromised devices and guiding remediation so an incident never becomes a breach.

For most UK SMEs the gap is not tooling, it is people. You can buy a detection product, but you cannot buy the 3am analyst who isolates a ransomware host before it spreads. That is what MDR provides, and it is why it sits at the centre of managed cybersecurity for businesses without an in-house security team.

• Detection — telemetry from endpoints, identity and email is continuously analysed.
• Investigation — analysts confirm whether an alert is a real threat or noise.
• Response — confirmed threats are contained: devices isolated, processes killed, accounts locked.
• Recovery guidance — root-cause analysis and steps to stop it recurring.

Why do UK businesses need MDR now?

Attack volume and impact are both rising, and signature-based tools no longer keep pace. The UK government's Cyber Security Breaches Survey 2025 found that 21% of businesses that experienced a breach reported a negative outcome such as loss of money or data, and 7% reported temporary loss of access to files or networks — up from 4% in 2024.

Ransomware is the sharpest edge of this. An estimated 19,000 UK businesses were hit by ransomware in 2025 (Sophos), and the average cost of the most disruptive breach is £3,550 (DSIT 2025). Detection alone does not stop these incidents — response does. The National Cyber Security Centre is explicit that organisations should plan for active incident response, not just prevention (NCSC guidance).

The figures come from the Cyber Security Breaches Survey 2025, the UK's authoritative annual measure of business cyber risk.

What is included in an MDR service?

A well-built MDR service combines detection technology with a staffed security operations centre. The exact mix varies by provider, but these components define a genuine MDR offering rather than a relabelled antivirus subscription.

Endpoint detection and response (EDR)

A lightweight agent on every device captures process activity, network connections and file changes, then streams that telemetry to a managed platform for analysis. EDR is the sensor layer; on its own it still needs someone to act on what it sees — see our breakdown of endpoint detection and response.

24/7 threat monitoring

Analysts review and triage alerts around the clock, escalating by severity. Attackers deliberately strike out of hours, so continuous 24/7 security monitoring is the difference between a contained event and a Monday-morning disaster.

Threat hunting

Proactive searching for indicators of compromise that automated rules miss. Analysts look for attacker behaviour — lateral movement, credential abuse, unusual privilege escalation — rather than waiting for a signature to fire.

Incident containment

When a threat is confirmed, analysts isolate affected devices, terminate malicious processes and lock compromised accounts, cutting dwell time and blast radius. This is the response in "detection and response".

Forensic investigation and reporting

After an incident, the team reconstructs what happened, identifies root cause and recommends fixes. Regular reporting gives you an audit trail for compliance, cyber insurance and board review.

Antivirus vs EDR vs MDR: what's the difference?

The three tiers of endpoint security differ in what they detect, who responds, and what they cost. Antivirus catches known malware. EDR adds behavioural detection but still needs a human. MDR wraps both in a 24/7 analyst team that investigates and contains threats for you.

MDR is not a replacement for endpoint hygiene, patching and MFA — it is the detection-and-response layer that sits on top of them.

How does AMVIA deliver MDR?

AMVIA delivers MDR using Microsoft Defender for Endpoint, monitored by our in-house 24/7 SOC. There is no third-party detection vendor in the chain: one accountable provider, Microsoft-certified engineers, security-first. That keeps your telemetry, identity and email signals in one Microsoft tenancy your team already owns.

Defender for Endpoint is enterprise-grade detection built into the Microsoft stack (Microsoft Defender for Endpoint docs), and our analysts operate it as a managed service rather than handing you a console and walking away. For businesses already on Microsoft 365, pairing MDR with Microsoft Defender for Business consolidates detection and licensing in one place.

If you want the full picture of how detection, a managed SOC and managed detection and response fit together, those service pages go deeper on coverage and scope.