MDR proposals tend to look alike. Every provider says 24/7, every provider mentions AI, every provider promises fast response. The differences show up in the details, usually at the worst possible moment. These questions surface them before you sign.
What Does the Provider Actually Monitor?
- Endpoints only, or also Microsoft 365, Entra ID, email, firewalls, cloud platforms and SaaS?
- Do they use your existing EDR, or require their own?
- Are servers and Macs covered, not just Windows laptops?
- How do they detect threats that never touch an endpoint, like a Microsoft 365 account takeover?
Can They Act, or Only Alert?
This is the most important question. At 3 a.m. on a Sunday, a notification email is not response.
- Which containment actions can they take without calling you first: isolate a device, disable an account, revoke sessions, block an IP?
- What is the approval model, and can you customize it?
- Who do they call, in what order, and what happens if nobody answers?
How Fast Do They Respond, and How Is That Measured?
- What are their MTTD and MTTR targets?
- When does the clock start: when the alert fires or when an analyst picks it up?
- Are response times in the contract, or just in the brochure?
- Can they show anonymized examples of real incident timelines?
Who Are the Analysts?
- Where are analysts located, and is the SOC staffed by people at all hours or on call?
- What are their qualifications and experience?
- How much is automated, and when does a human review an alert?
- Will you have a named contact who knows your environment?
Where Is Your Data Stored?
For Canadian businesses with privacy obligations under PIPEDA or Quebec Law 25, this matters. Ask where logs and telemetry are stored and processed, which subprocessors are involved, and how long data is retained.
Is Incident Response Included?
- If a real incident happens, is full investigation and recovery support included, capped by hours, or billed separately?
- Will they coordinate with your cyber insurer's panel firms?
- Do they help with evidence for breach reporting decisions?
How Do They Work with Your IT Provider?
Most SMBs have an MSP. Ask how escalations, remediation tasks and ticketing work between the two. See MSP vs MSSP.
What Will You See?
- A portal or dashboard, and is it useful to non-specialists?
- Monthly or quarterly reports with plain-language summaries?
- Evidence suitable for cyber insurance and compliance audits?
What Are the Contract Terms?
| Term | What to check |
|---|---|
| Length | Initial term and renewal |
| Exit | Notice period, data return, agent removal |
| Pricing | Per user, per device, overages, price increases |
| Scope changes | How adding devices or sources is priced |
| Liability | Limits and exclusions |
How Does Cyberphore Answer These?
We think buyers should hold every provider, including us, to these questions. Our model is human-led and AI-powered: AI correlates and triages signals at machine speed, and experienced analysts investigate every meaningful alert and make every response decision. Specific commitments, including response times and data residency, are stated in your contract. Client monitoring data is stored in Canadian data centres by default; other regions are used only if a client asks. Critical alerts are triaged and response begins within 15 minutes, 24/7/365. Analyst locations are set out in your service agreement. Learn more on our managed detection and response page or read What is MDR?.