I've evaluated four managed detection and response (MDR) providers in eight months. Each opened with a MITRE ATT&CK coverage map and a breach warranty number, and none could answer the question that matters: what happens at 2am on a Saturday when ransomware precursor activity shows up, and what contract language governs it?
Every list ranks MDR providers. This one doesn't. Structural fit among your stack, your team, and the provider's operating model decides more than any quadrant position. MDR bundles technology, threat intelligence, and human analysts, and the archetype decides who can act when something breaks. So I've grouped the providers I'd shortlist by archetype, not rank.
In brief:
- Response authority is the most under-evaluated criterion in MDR selection: a provider's mean time to respond (MTTR) means nothing if their contract limits them to guided response while the attacker can still move faster than the approval chain.
- Breach warranties are exclusion clauses with a marketing layer on top: coverage amounts and terms vary significantly depending on the provider's warranty structure and contract details.
- AI SOC agents in security operations sit at 1-5% market adoption: Gartner placed AI SOC agents at the Innovation Trigger stage in 2025. Adjust expectations and vendor questions accordingly.
- The existing stack pre-decides the MDR model: platform-native, co-managed, agnostic, and AI-native aren't interchangeable options. They're structural consequences of what is already in place.
What actually decides the shortlist
Before you shortlist, three things decide fit more than any quadrant position:
- Response authority: what the SOC can do at 2am without calling you. NIST Special Publication 800-61 Revision 3 says it should be defined in the contract, so read the SoW rather than the sales deck and keep a current incident response plan to test it. The fastest quartile of intrusions hits exfiltration in 72 minutes, so "recommend"-only authority can lose the window.
- Automation depth: "our AI handles 90% of alerts" means nothing until you know whether that is enrichment, a closed verdict, or actual response. 73% of teams report successful triage automation, but only 9% are very confident in AI-generated alerts and 40% run those tools with no defined role.
- Breach warranty fine print: every warranty is an exclusion clause with a marketing number on top. It is not cyber insurance, it covers a narrow band of response costs, and the conditions that void it are where procurement gets burned, so weigh the per-provider notes below before the headline figure.
Platform-native MDR: deepest integration, highest exit cost
Platform-native MDR is inseparable from the vendor's own detection platform, so detection rules, telemetry normalization, and configuration all live inside it. You get the deepest integration available and the highest exit cost. Choose it if you're already standardized on the vendor's EDR; if you're not, the purchase is a platform migration wearing a managed-service label.
- CrowdStrike Falcon Complete. The canonical platform-native option, and it can't be bought without the Falcon sensor stack. Its warranty runs up to $2M but covers response costs only, is non-negotiable, and excludes business losses.
- SentinelOne Wayfinder MDR. The EDR-anchored choice if you run SentinelOne's Singularity platform rather than CrowdStrike's. Rebranded from Vigilance in November 2025, it's a separate line item on a Singularity license with a $1M breach warranty. Same tradeoff as Falcon Complete: deepest fit on the home stack, full migration from anywhere else.
- Sophos MDR. Endpoint-anchored with broad third-party log ingestion. Its $1M warranty carries a $1,000 per-device cap, a $5,000 minimum claim, an annual aggregate limit, and a service-description carve-out for industry-wide events, the exact scenario you'd most want it for.
Tool-agnostic MDR: your stack, their analysts
Tool-agnostic providers deliver detection and response as a service layer on top of whatever you already run, with no proprietary sensor required. The upside is no lock-in; the cost is integration tax, because detection quality is bounded by your telemetry quality and every tool boundary is a possible correlation gap.
- Expel. Bring-your-own-tech with unusually high transparency. Named a Leader with five-out-of-five scores in 15 of 21 criteria in the Forrester Wave MDR Q1 2025.
- eSentire Atlas. A tool-agnostic option built on the Atlas XDR platform, which correlates endpoint, network, log, cloud, and identity signals across 300+ integrations and runs on whatever EDR you already license (or eSentire's own). What sets it apart for this list is a contractual 15-minute mean time to contain with direct SOC analyst remediation, so response authority is written into the SLA rather than left advisory. The usual agnostic caveat still applies: detection quality tracks the telemetry quality you feed it.
- Red Canary. A long-standing agnostic leader, Red Canary is now owned by Z-scaler after a $675 million acquisition closed in August 2025. Test whether the agnostic model holds under Zscaler's Zero Trust platform ownership before you sign.
Concierge MDR: the relationship is the product
Concierge MDR differentiates on human engagement rather than architecture, assigning a named team to each customer for continuity alongside broad log ingestion.
- Arctic Wolf. The concierge archetype, with a named Concierge Security Team and a 2026 Gartner Peer Insights Customers' Choice designation. The tradeoff is that containment authority for many action types stays advisory rather than autonomous, and its headline Security Operations Warranty requires a qualifying bundle and a multi-year contract.
AI-native MDR: real capability, unfinished category
A newer group builds MDR on AI-native or agentic platforms, meeting the human-led bar through oversight of AI rather than human execution. People handle judgment calls instead of working alert queues. Gartner still puts AI SOC agents at the Innovation Trigger stage with 1-5% market adoption, so treat their numbers as vendor-reported until you see the evidence chain.
- Daylight. A services-first take: AI-native MDR delivered as a managed service, not a tool you run. It pulls organizational and historical context beyond telemetry, and exposes a glass-box evidence chain for every investigation rather than just a verdict.
- Exaforce. Built on a real-time knowledge graph and sold either as SaaS or as a managed MDR service. It raised a $125M Series B at a $725M valuation in May 2026.
- 7AI (PLAID). An agentic platform that closed a $130M Series A in December 2025, bringing total funding to $166M, with DXC Technology publicly citing large Tier-1 analyst time reductions. The available sources don't independently verify its AI-native characterization, so confirm it in a demo.
- Dropzone AI. Positioned as an AI SOC tool for autonomous Tier 1 alert investigation rather than a managed MDR service: it plugs into your existing SIEM and EDR to triage and investigate alerts, then hands findings to your analysts. Slot it as an augmentation layer, not a full MDR replacement.
How to actually choose
Start with what you own, what your team can actually operate, and what authority your threat model requires. Match a provider's structural model to those three and the shortlist narrows itself. The brand, the quadrant, and the warranty headline come after, not before. Everything else is a vendor slide.
Frequently asked questions about top MDR providers
MDR vs MSSP: what's the practical difference?
MDR goes beyond alerting to include response and containment, though definitions don't all require the provider to act on your behalf. Gartner's 2025 Market Guide treats immediate remote mitigation, investigation, and containment as baseline MDR features. A provider that mainly notifies you rather than taking an active response role is functioning more like an MSSP.
Is MDR worth it for a 500-person company with no SOC?
For a 500-person company with no internal SOC staff, platform-native MDR is the fastest path to 24/7 coverage. With one or two security staff and an existing EDR investment, tool-agnostic MDR preserves that investment while adding coverage. The caveat: even full MDR needs some internal coordination, so zero effort is unrealistic regardless of provider.
Do AI-native MDR providers actually replace analysts?
No. AI agents are often described as handling repetitive triage, enrichment, and reporting so humans can focus on judgment-intensive work. An arXiv survey of agentic AI in security operations found augmentation to be the dominant design pattern, with agentic AI increasing analyst capacity rather than reducing staffing needs.
How much should MDR cost for a 500-person company?
Pricing varies widely, and scope drives the variance. For 500 endpoints, endpoint-only MDR runs from tens of thousands to low six figures a year depending on service depth. Forrester's Q1 2025 Wave put 10,000-endpoint deployments at $400,000 to $1,000,000+, so check whether a quote covers cloud-native security and identity threat detection and response or endpoints only.
What should I ask an MDR provider before signing?
Three questions: what autonomous actions does the SOC take at 2am without calling me, beyond endpoint isolation? Are MTTD/MTTR commitments in the signed contract with penalties, or only in marketing? What happens to your data, detection logic, and investigation history if you don't renew? That's what a CISO needs answered before signing.