# You’re not buying software. You’re buying whether someone picks up the phone at 2am — and what they’re permitted to do.

*Managed Detection & Response — a TechBag decision guide. Last reviewed 2026-10-03.*

> An MDR is a team, a scope and an authority: who watches, what they watch (endpoint-only, the vendor’s platform, or your whole estate), and whether they may contain, remediate or only advise. The software underneath is someone’s EDR — theirs, or yours.

**The checkable fact:** Sophos MDR documents integrations for CrowdStrike, Microsoft and others — it can run on an EDR you already own. CrowdStrike Falcon Complete monitors the Falcon platform only. Same word, opposite contracts.

- Canonical: https://www.thetechbag.com/browse/security/managed-detection-response
- Category: [Security](https://www.thetechbag.com/browse/security)
- Products compared: 19

## What managed detection & response actually is

Someone else’s analysts, 24 hours a day, reading the alerts your detection tools raise, deciding which are real, investigating them and — up to a line written in the contract — acting: isolating a host, killing a process, resetting a credential, telling you what to rebuild. The software is the EDR or XDR underneath; the product is the **people, the scope and the authority**.

Three things vary more than the brochures admit. **Scope**: endpoint-only, the vendor’s own platform modules, or your whole estate including identity, email, cloud and network. **Whose telemetry**: most services require their own agent; a few run on the EDR you already have — which decides what happens at renewal. **Authority**: advise, contain with pre-approval, or full remediation and incident response. The [endpoint-protection guide](https://www.thetechbag.com/browse/security/endpoint-protection) chooses the agent; this page chooses who runs it.

**The most common mis-purchase.** Endpoint-only scope discovered **during an incident**: the attack came through email or a cloud identity, the MDR saw the endpoint, and the contract said endpoints. Scope is the first line of the SLA to read, not the last.

## MDR vs EDR you operate · MDR vs MSSP · MDR vs MXDR

Three pairs this buyer confuses, and nothing more. None of them is a quality ladder — each is a wider scope of people and telemetry, and wider costs more and needs more of your cooperation to run.

### MDR vs EDR you operate yourself

Same EDR; different operator. Self-run EDR means your analysts read the console every day — budget the people. MDR means the vendor's or a partner's analysts do, within a contract. The tool is identical; the difference is the 2am phone call and who is permitted to act.

### MDR vs MSSP

An MSSP manages security devices and monitors logs — firewalls, SIEM, tickets — and escalates to you. An MDR is built around detection and response on endpoints and telemetry, with analysts who investigate and act. MSSP breadth, MDR depth; many providers now sell both under one name — ask which you are being sold.

### MDR vs MXDR

MXDR is MDR over XDR telemetry: endpoint plus email, identity, cloud and network, correlated. Wider scope, more sources to onboard, more for the analysts to read — and only worth it when those sources exist and the service actually ingests them. Platform vendors use the X to mean 'our stack'; ask which sources, named.

**These are widening scopes, not tiers.** Self-run EDR → MDR → MXDR → MSSP-plus-MDR each adds people and telemetry, costs more, and needs more of your estate wired in. Buy the scope that matches where your incidents actually start — and read the authority line before the price.

## The decision variables

Six variables decide this purchase. The instrument tests the ones documentation can verify (telemetry, scope, channel, compliance); response authority, India hours, onboarding and exit are prose because the honest answer is in the SLA, not the datasheet.

**Scope of what's monitored.** Endpoint-only, the vendor's platform modules, or your whole estate including identity, email, cloud and network — the most common mis-purchase is discovering the first during an incident.

**Response authority.** Advise-only, pre-approved containment, or full remediation and incident response. The ceiling is written in the SLA; read it aloud.

**Whose telemetry.** Does the service require its own EDR agent, or run on the one you already have? It decides the price of switching and what you keep at renewal.

**India-hours coverage and language.** 24/7 global is not the same as an analyst in Indian hours and language; only Mitigata documents an India SOC.

**Onboarding time.** Days once a vendor agent is deployed; weeks per source for a BYO-telemetry estate.

**What happens when you leave.** Vendor-agent MDRs take the tuning and detections with them; BYO services leave your tools standing. Price the re-tooling before you sign, not after.

## The 19 products

Every product carries one stated limitation. Prices are USD with an indicative INR conversion, tier- and term-matched where the vendor publishes one.

### N-able Security (Adlumin) — N-able

- **Who it's for:** MSPs that want to sell managed security under their own brand without building a security operations centre — the 24/7 analyst rota alone is unreachable for most. SentinelOne-powered EDR plus the Adlumin platform acquired November 2024 for up to $266M: cloud-native XDR, MDR, ITDR, SIEM support, SOAR and pen testing, sitting beside an N-able RMM you may already run.
- **The honest limitation:** THE MODULE LIST IS NOT THE PRODUCT — the service commitment is, and when you resell under your own name your client holds YOU rather than Adlumin. Get response times, analyst coverage hours and escalation paths in writing and hold them against what you have promised your own clients; any gap is one you absorb on every incident. The EDR engine is licensed from SentinelOne, not owned. The Adlumin integration is only eighteen months old. Where the SOC analysts sit is a separate question from N-able's Bengaluru engineering centre — ask it explicitly.
- **Price:** Quote — Quote-only, and a separate product from N-able's RMM platforms. EDR is typically per endpoint; the managed services price by their own logic. Establish what incident response is included versus chargeable — that is where MDR contracts most often surprise people
- **Details:** https://www.thetechbag.com/n-able/n-able-security

### Rapid7 Managed Threat Complete — Rapid7

- **Who it's for:** Mid-market organisations that want a 24/7 SOC and vulnerability management from one vendor on one agent. The SLAs are contractual rather than marketing — 15 minutes to begin investigating a critical alert, a phone call within 30 minutes of identifying an incident — and they are identical across all three tiers. A Leader in the 2025 Frost Radar for MDR.
- **The honest limitation:** ACTIVE RESPONSE CONTAINS EXACTLY TWO THINGS: it quarantines endpoints and disables users. That is the complete list, and most buyers assume more. Incident response is remote-only with no on-site attendance, and the Rapid7 Agent is MANDATORY even where a third-party EDR does the containment — assets without it are excluded from threat hunts and investigations entirely. No India data region, so your logs sit offshore. Reviewers also report the SOC sometimes closes incidents without sufficient explanation.
- **Price:** Quote — Buyer-reported ~$15–22 per asset / month (midpoint near $17) with a 500-asset minimum commonly applied — quote-only, so treat those as directional. What is genuinely unusual is what the per-asset price INCLUDES: unlimited incident response with no retainer or hour cap, and unlimited InsightVM vulnerability scanning bundled in, which no pure-play MDR vendor offers
- **Details:** https://www.thetechbag.com/rapid7/rapid7-managed-threat-complete

### Sophos MDR (Essentials · Complete) — Sophos

- **Who it's for:** The largest pure-play MDR: 24/7 analysts on Sophos's agent or on the EDR, firewall and identity telemetry you already run, with full-scale incident response in the Complete tier.
- **The honest limitation:** No published list (reported ranges only); the Essentials tier stops at containment — full incident response is Complete; an India-located SOC is not documented.
- **Price:** ~$80–200+ (≈ ₹6,640) — per user / year reported (Essentials → Complete); AWS Marketplace lists $239.64 per endpoint / year; Mumbai data region
- **Details:** https://www.thetechbag.com/sophos/sophos-mdr

### Bitdefender MDR (Foundations · Premium · Enterprise) — Bitdefender

- **Who it's for:** GravityZone estates — and SMBs via Foundations — wanting 24×7 monitoring, pre-approved response and threat-intel hunting without building a SOC.
- **The honest limitation:** Runs on Bitdefender's agent only; incident response beyond containment and the tailored threat model arrive at Premium / Enterprise; India SOC not documented.
- **Price:** ~$6.99–10.49 (≈ ₹580) — per endpoint / month reported (MDR Core / Advanced SKUs); needs GravityZone
- **Details:** https://www.thetechbag.com/bitdefender/bitdefender-mdr

### Kaspersky MDR (Optimum · Expert) — Kaspersky

- **Who it's for:** Kaspersky Next estates wanting the vendor's analysts with response actions (isolate, kill, registry) run automatically or on your approval.
- **The honest limitation:** Kaspersky telemetry only; procurement-sensitive in some sectors and countries (check your regulator); incident response is a separate Kaspersky service; no published list.
- **Price:** Quote — per endpoint / year; Optimum (SMB, in Kaspersky Next MXDR Optimum) · Expert (enterprise, with KATA)
- **Details:** https://www.thetechbag.com/kaspersky/kaspersky-mdr

### CrowdStrike Falcon Complete — CrowdStrike

- **Who it's for:** Enterprises on the Falcon platform that want CrowdStrike's own team running it 24/7 with surgical remediation and a breach warranty.
- **The honest limitation:** Monitors the Falcon platform — third-party telemetry is Next-Gen SIEM, not Complete; enterprise-priced on quote; India in-country cloud announced, not yet documented live.
- **Price:** ~$25–45 (≈ ₹2,075) — per endpoint / month reported (enterprise deployments); quote-only; covers the Falcon modules you license
- **Details:** https://www.thetechbag.com/crowdstrike/crowdstrike-falcon-complete

### SentinelOne Wayfinder MDR Essentials / Elite — SentinelOne

- **Who it's for:** SentinelOne estates adding 24/7 triage, containment and — in MDR Elite — incident readiness and response on the agent they already run.
- **The honest limitation:** An add-on to SentinelOne only; priced per endpoint on top of the endpoint licence; an India-located SOC is not documented (data region is).
- **Price:** ~$15–50 (≈ ₹1,245) — per endpoint / year add-on reported for the former Vigilance tiers — confirm Wayfinder pricing; on top of a Singularity licence (Complete $179.99); Elite adds incident readiness and response; Mumbai region
- **Details:** https://www.thetechbag.com/sentinelone/sentinelone-singularity-mdr

### Trend Service One (Managed XDR) — Trend Micro

- **Who it's for:** Trend Vision One estates that want the vendor's analysts correlating endpoint, email, cloud and network from one console.
- **The honest limitation:** Needs Trend sensors across those surfaces to be worth it; credit billing is opaque until you run it; no published list.
- **Price:** Credits / quote — Vision One credits + service tier; covers endpoint, email, server, cloud workload and network sensors
- **Details:** https://www.thetechbag.com/trendmicro/trendmicro-service-one

### ESET MDR / MDR Ultimate — ESET

- **Who it's for:** ESET PROTECT estates that want 24/7 monitoring with response actions ESET runs automatically or only the ones you allow.
- **The honest limitation:** ESET endpoint telemetry only — no third-party EDR, no estate-wide ingestion; quote-only; the Elite tier is a prerequisite for XDR-grade detection.
- **Price:** Quote — per device / year on top of ESET PROTECT (Elite for Inspect XDR); Ultimate adds premium support and a named team
- **Details:** https://www.thetechbag.com/eset/eset-protect-mdr

### Xcitium MDR — Xcitium

- **Who it's for:** Xcitium estates — and Defender shops — that want analysts plus ZeroDwell containment so unknowns never run while the SOC looks.
- **The honest limitation:** Young at scale (unverified above 2,000 endpoints); response is containment-first rather than full incident response; India SOC not documented.
- **Price:** Modular — per endpoint / month modules on the Xcitium platform; Managed EDR for Microsoft Defender is a documented variant
- **Details:** https://www.thetechbag.com/xcitium/xcitium-mdr

### Barracuda Managed XDR — Barracuda

- **Who it's for:** Organisations served by an MSP that wants a 24/7 SOC over endpoints, email, identity and cloud without building one.
- **The honest limitation:** Sold and delivered through MSPs, not direct; response is containment and guidance through the MSP; which third-party EDRs it ingests is partner-documented, not listed publicly.
- **Price:** Quote — per endpoint / user through an MSP; ingests endpoint, server, identity, cloud, email and firewall telemetry
- **Details:** https://www.thetechbag.com/barracuda/barracuda-managed-xdr

### Coro Managed SOC — Coro

- **Who it's for:** SMBs that want one agent, one console and one bill — with Coro's SOC handling what its auto-remediation does not.
- **The honest limitation:** Coro modules only (endpoint, email, cloud apps) — nothing it does not itself monitor; SMB-positioned and unverified above 2,000 endpoints; price now quote-only.
- **Price:** ~$20 (≈ ₹1,660) — per user / month managed (historical; public list withdrawn in 2026) over Coro's endpoint, email and cloud-app modules
- **Details:** https://www.thetechbag.com/coro/coro-managed-soc

### Mitigata Managed SOC — Mitigata

- **Who it's for:** India-regulated organisations that want the SOC, the compliance programme (DPDP, ISO 27001, SOC 2, SEBI CSCRF) and the cyber-insurance broker from one provider, in Indian hours and language.
- **The honest limitation:** Founded 2023 — documented scale is young and the tooling is partner-delivered on your stack; quote-only; not a fit if you want a single global vendor's branded agent and SOC.
- **Price:** Quote (INR) — INR, per estate; 24×7 SOC from India on your tools, with incident response, forensics, VAPT and compliance audits and IRDAI-regulated cyber insurance under one roof
- **Details:** https://www.thetechbag.com/mitigata/mitigata-managed-soc

### Kaseya MDR (formerly RocketCyber) — Kaseya

- **Who it's for:** MSPs and small IT teams that want a 24/7 human-led SOC over the EDR they already run — Defender, SentinelOne, Datto EDR and more — plus firewall syslog, with tickets landing in their PSA.
- **The honest limitation:** Relaunched in April 2026 as a rebuild of RocketCyber, so its track record under the new name is short; Microsoft 365 coverage differs between Kaseya’s marketing and help pages — get it in writing; no India SOC.
- **Price:** Quote — per endpoint, standalone or inside Kaseya 365 Endpoint Pro (50-endpoint minimum); Kaseya publishes no price; 400-day log retention; SOCs in Florida and Ireland
- **Details:** https://www.thetechbag.com/kaseya/kaseya-mdr

### Heimdal Managed XDR — Heimdal

- **Who it's for:** Small IT teams and MSP clients already on Heimdal’s agent who want a 24/7 SOC without hiring one.
- **The honest limitation:** Monitors Heimdal modules only, not your existing EDR; no response-time SLA, retention period or SOC location is published, and there is no India data region.
- **Price:** Quote — quoted per device per year; Heimdal’s SOC watches and responds across the Heimdal modules around the clock, and can alert the reselling MSP; module licences may be separate lines on the quote
- **Details:** https://www.thetechbag.com/heimdal/heimdal-mxdr

### WatchGuard MDR (Core, Total, Open) — WatchGuard

- **Who it's for:** MSPs and their clients who want a 24/7 SOC over WatchGuard or Microsoft Defender endpoints, without hiring analysts.
- **The honest limitation:** No published price, SLA, retention period or SOC location, and no India SOC is documented.
- **Price:** Quote — quoted through partners; built on the ActZero acquisition (January 2025): Core covers WatchGuard Endpoint, Core for Microsoft runs on Defender, Total adds Firebox, NDR, AuthPoint and FireCloud, Open adds CrowdStrike and third-party firewalls
- **Details:** https://www.thetechbag.com/watchguard/watchguard-mdr

### Arctic Wolf Aurora MDR — Arctic Wolf

- **Who it's for:** Mid-market organisations without a SOC that want 24/7 detection across endpoint, network, identity and cloud on the tools they already run (CrowdStrike, Defender, SentinelOne and more), plus a Concierge team that reviews posture with them, not just a ticket queue.
- **The honest limitation:** Response is containment, not incident response: forensics, eradication and restoration sit in the separate Incident360 retainer ($325 an hour). Data is stored in the US, Canada, Germany, Australia, South America or Japan; there is no India region or India SOC, and no public price beyond the 100-user marketplace offer.
- **Price:** $44,000 / yr — AWS Marketplace public offer: MDR Basic, up to 100 users, $44,000 for 12 months (about $440 per user per year); larger estates on quote. Network sensors plus agents feed the Aurora platform; Cloud Detection and Response, log retention and Data Explorer come as add-ons or bundle tiers, with a Security Operations Warranty in the bundles
- **Details:** https://www.thetechbag.com/arcticwolf/arcticwolf-aurora-mdr

### Arctic Wolf Aurora Managed Endpoint Defense — Arctic Wolf

- **Who it's for:** Teams buying Arctic Wolf’s endpoint agent who want its SOC to triage and act on endpoint alerts around the clock, without buying full Aurora MDR.
- **The honest limitation:** Endpoint telemetry from Arctic Wolf’s own agent only: no third-party EDR, network or identity coverage (that is Aurora MDR). Endpoint data regions exclude India, and the only public price is a 100-device marketplace offer.
- **Price:** $182.40 (≈ ₹15,139) — per device / year: AWS Marketplace public offer of $18,240 for up to 100 devices, 12 months; runs on Aurora Endpoint Security (the former Cylance agent)
- **Details:** https://www.thetechbag.com/arcticwolf/arcticwolf-aurora-managed-endpoint-defense

### Darktrace Managed Detection & Response — Darktrace

- **Who it's for:** Darktrace customers without a 24/7 team who want Darktrace's own analysts watching the network, cloud, SaaS and OT alerts the platform already raises.
- **The honest limitation:** Watches Darktrace only — it does not run on CrowdStrike, Defender or SentinelOne telemetry. Response is extending Darktrace's containment; the customer keeps responsibility for follow-up analysis and remediation. No India SOC documented.
- **Price:** Quote — a service bundle on top of your Darktrace licence, quoted per scope (AWS Marketplace shows only a $1 custom-offer placeholder); 24/7 follow-the-sun SOC investigates Darktrace alerts and can extend Autonomous Response on eligible devices; Managed Threat Detection and Security Operations Support are lighter tiers
- **Details:** https://www.thetechbag.com/darktrace/darktrace-mdr

## Why each constraint rules out what it does

The full narrowing logic, as prose. Nothing here is hidden behind an interaction.

**Runs on the tools you already have.** Rules out Rapid7 Managed Threat Complete, Bitdefender MDR (Foundations · Premium · Enterprise), Kaspersky MDR (Optimum · Expert), CrowdStrike Falcon Complete, SentinelOne Wayfinder MDR Essentials / Elite, Trend Service One (Managed XDR), ESET MDR / MDR Ultimate, Coro Managed SOC, Heimdal Managed XDR, Arctic Wolf Aurora Managed Endpoint Defense and Darktrace Managed Detection & Response — requires the vendor's own agent; it does not run on third-party telemetry. That leaves N-able Security (Adlumin), Sophos MDR (Essentials · Complete), Xcitium MDR, Barracuda Managed XDR, Mitigata Managed SOC, Kaseya MDR (formerly RocketCyber), WatchGuard MDR (Core, Total, Open) and Arctic Wolf Aurora MDR.

**You run CrowdStrike.** Rules out Bitdefender MDR (Foundations · Premium · Enterprise), Kaspersky MDR (Optimum · Expert), SentinelOne Wayfinder MDR Essentials / Elite, Trend Service One (Managed XDR), ESET MDR / MDR Ultimate, Coro Managed SOC, Heimdal Managed XDR, Arctic Wolf Aurora Managed Endpoint Defense and Darktrace Managed Detection & Response — cannot run on CrowdStrike telemetry (its own agent only). That leaves N-able Security (Adlumin), Rapid7 Managed Threat Complete, Sophos MDR (Essentials · Complete), CrowdStrike Falcon Complete, Xcitium MDR, Barracuda Managed XDR, Mitigata Managed SOC, Kaseya MDR (formerly RocketCyber), WatchGuard MDR (Core, Total, Open) and Arctic Wolf Aurora MDR. It flags N-able Security (Adlumin) — Ingests third-party telemetry; CrowdStrike specifically not documented, Xcitium MDR — Ingests third-party telemetry; CrowdStrike specifically not documented, Barracuda Managed XDR — Ingests third-party telemetry; CrowdStrike specifically not documented and Kaseya MDR (formerly RocketCyber) — Ingests third-party telemetry; CrowdStrike specifically not documented — marked, not removed.

**You run Microsoft Defender.** Rules out Bitdefender MDR (Foundations · Premium · Enterprise), Kaspersky MDR (Optimum · Expert), CrowdStrike Falcon Complete, SentinelOne Wayfinder MDR Essentials / Elite, Trend Service One (Managed XDR), ESET MDR / MDR Ultimate, Coro Managed SOC, Heimdal Managed XDR, Arctic Wolf Aurora Managed Endpoint Defense and Darktrace Managed Detection & Response — cannot run on Defender telemetry (its own agent only). That leaves N-able Security (Adlumin), Rapid7 Managed Threat Complete, Sophos MDR (Essentials · Complete), Xcitium MDR, Barracuda Managed XDR, Mitigata Managed SOC, Kaseya MDR (formerly RocketCyber), WatchGuard MDR (Core, Total, Open) and Arctic Wolf Aurora MDR.

**You run SentinelOne.** Rules out Bitdefender MDR (Foundations · Premium · Enterprise), Kaspersky MDR (Optimum · Expert), CrowdStrike Falcon Complete, Trend Service One (Managed XDR), ESET MDR / MDR Ultimate, Coro Managed SOC, Heimdal Managed XDR, Arctic Wolf Aurora Managed Endpoint Defense and Darktrace Managed Detection & Response — cannot run on SentinelOne telemetry (its own agent only). That leaves N-able Security (Adlumin), Rapid7 Managed Threat Complete, Sophos MDR (Essentials · Complete), SentinelOne Wayfinder MDR Essentials / Elite, Xcitium MDR, Barracuda Managed XDR, Mitigata Managed SOC, Kaseya MDR (formerly RocketCyber), WatchGuard MDR (Core, Total, Open) and Arctic Wolf Aurora MDR. It flags Sophos MDR (Essentials · Complete) — Ingests third-party telemetry; SentinelOne specifically not documented, Xcitium MDR — Ingests third-party telemetry; SentinelOne specifically not documented, Barracuda Managed XDR — Ingests third-party telemetry; SentinelOne specifically not documented and WatchGuard MDR (Core, Total, Open) — Ingests third-party telemetry; SentinelOne specifically not documented — marked, not removed.

**Whole-estate scope.** Rules out ESET MDR / MDR Ultimate and Arctic Wolf Aurora Managed Endpoint Defense — endpoint telemetry only. That leaves N-able Security (Adlumin), Rapid7 Managed Threat Complete, Sophos MDR (Essentials · Complete), Bitdefender MDR (Foundations · Premium · Enterprise), Kaspersky MDR (Optimum · Expert), CrowdStrike Falcon Complete, SentinelOne Wayfinder MDR Essentials / Elite, Trend Service One (Managed XDR), Xcitium MDR, Barracuda Managed XDR, Coro Managed SOC, Mitigata Managed SOC, Kaseya MDR (formerly RocketCyber), Heimdal Managed XDR, WatchGuard MDR (Core, Total, Open), Arctic Wolf Aurora MDR and Darktrace Managed Detection & Response. It flags Bitdefender MDR (Foundations · Premium · Enterprise) — Covers the vendor's own platform modules, Kaspersky MDR (Optimum · Expert) — Covers the vendor's own platform modules, CrowdStrike Falcon Complete — Covers the vendor's own platform modules, SentinelOne Wayfinder MDR Essentials / Elite — Covers the vendor's own platform modules, Xcitium MDR — Covers the vendor's own platform modules, Coro Managed SOC — Covers the vendor's own platform modules, Heimdal Managed XDR — Covers the vendor's own platform modules and Darktrace Managed Detection & Response — Covers the vendor's own platform modules — marked, not removed.

**Buying direct.** Rules out N-able Security (Adlumin), Barracuda Managed XDR, Kaseya MDR (formerly RocketCyber), Heimdal Managed XDR and WatchGuard MDR (Core, Total, Open) — sold and delivered through MSPs. That leaves Rapid7 Managed Threat Complete, Sophos MDR (Essentials · Complete), Bitdefender MDR (Foundations · Premium · Enterprise), Kaspersky MDR (Optimum · Expert), CrowdStrike Falcon Complete, SentinelOne Wayfinder MDR Essentials / Elite, Trend Service One (Managed XDR), ESET MDR / MDR Ultimate, Xcitium MDR, Coro Managed SOC, Mitigata Managed SOC, Arctic Wolf Aurora MDR, Arctic Wolf Aurora Managed Endpoint Defense and Darktrace Managed Detection & Response.

**CERT-In audit and cyber insurance together.** Rules out N-able Security (Adlumin), Rapid7 Managed Threat Complete, Sophos MDR (Essentials · Complete), Bitdefender MDR (Foundations · Premium · Enterprise), Kaspersky MDR (Optimum · Expert), CrowdStrike Falcon Complete, SentinelOne Wayfinder MDR Essentials / Elite, Trend Service One (Managed XDR), ESET MDR / MDR Ultimate, Xcitium MDR, Barracuda Managed XDR, Coro Managed SOC, Kaseya MDR (formerly RocketCyber), Heimdal Managed XDR, WatchGuard MDR (Core, Total, Open), Arctic Wolf Aurora MDR, Arctic Wolf Aurora Managed Endpoint Defense and Darktrace Managed Detection & Response — a detection-and-response service only; audits and insurance are other vendors. That leaves Mitigata Managed SOC.

**Above 5,000 endpoints.** Rules nothing out on published terms. It flags N-able Security (Adlumin) — Unverified above 5,000 endpoints, Xcitium MDR — Unverified above 5,000 endpoints, Coro Managed SOC — Unverified above 5,000 endpoints, Mitigata Managed SOC — Unverified above 5,000 endpoints, Kaseya MDR (formerly RocketCyber) — Unverified above 5,000 endpoints, Heimdal Managed XDR — Unverified above 5,000 endpoints, WatchGuard MDR (Core, Total, Open) — Unverified above 5,000 endpoints, Arctic Wolf Aurora Managed Endpoint Defense — Unverified above 5,000 endpoints and Darktrace Managed Detection & Response — Unverified above 5,000 endpoints — marked, not removed.

**Response authority.** Not a chip because every service here documents containment; what differs is the ceiling. Sophos MDR Complete, CrowdStrike Falcon Complete, SentinelOne Respond Pro and Mitigata document full incident response (forensics, eradication, rebuild guidance); Bitdefender, Trend, Xcitium, Barracuda and Coro document pre-approved containment with guidance; Kaspersky and ESET let you set whether the analysts act automatically or on approval, and Kaspersky's incident response is a separate service. Read the authority line of the SLA — it is the product.

**India-hours coverage and language.** Documented India SOC: Mitigata. Every other service is 24/7 from global SOCs — which may well cover Indian business hours — but an India-located analyst team, Indian-language support and in-country data handling are not documented for them, so nothing is ruled out on it. Ask where the analyst who calls at 2am sits, and in what language.

**Onboarding time.** Vendor-agent services onboard in days once the agent is deployed (the agent rollout is the project); BYO-telemetry services (Sophos integrations, Barracuda, Mitigata) onboard per source — weeks for a multi-vendor estate. Your number is [TechBag to confirm].

**What happens when you leave.** Vendor-agent MDRs leave you with the agent licence and no analysts — the detections and the tuning were theirs; BYO services leave your tools and your telemetry in place. Exit is the hidden variable: price the re-tooling before you sign.

**Under 100 endpoints.** Rules nothing out on documentation: Bitdefender MDR Foundations, Coro, Xcitium and Sophos MDR are sold to small estates; CrowdStrike Falcon Complete is enterprise-positioned but publishes no floor. Which SLAs are a poor fit at that size is delivery-team judgement: [TechBag to confirm].

## Eight situations, eight shortlists — with the authority line answered

Each shortlist names who will be on the bridge at 2am and what they may do. If you already run an EDR, start from that row.

### 200–2,000 endpoints, no SOC, no EDR yet — buy the agent and the people together

**Shortlist:** Sophos MDR (Essentials · Complete), Bitdefender MDR (Foundations · Premium · Enterprise), ESET MDR / MDR Ultimate

**Why:** One contract: the vendor's agent plus 24/7 analysts, priced for mid-market. Sophos leads with MDR as the default product; Bitdefender Foundations and ESET MDR ride on published endpoint tiers.

**Trade-off:** You are choosing the EDR at the same time — and the exit path: when the MDR goes, the agent's tuning and detections go with it.

### You already run CrowdStrike

**Shortlist:** CrowdStrike Falcon Complete, Sophos MDR (Essentials · Complete), Mitigata Managed SOC

**Why:** Falcon Complete runs the platform you licensed with surgical remediation and a breach warranty; Sophos MDR and Mitigata are documented to ingest CrowdStrike telemetry if you want an independent SOC.

**Trade-off:** Falcon Complete is enterprise-priced and Falcon-only; an independent SOC adds integration work and a second party to the incident bridge.

### Microsoft 365 E5 — Defender for Endpoint P2 is already on the invoice

**Shortlist:** Sophos MDR (Essentials · Complete), Xcitium MDR, Barracuda Managed XDR

**Why:** Defender Experts for XDR is Microsoft's own managed tier (E5 prerequisite, quote); the documented third-party options that run on Defender telemetry are Sophos MDR, Xcitium's Managed EDR for Microsoft Defender and Barracuda's MXDR.

**Trade-off:** Running someone else's SOC on Defender telemetry keeps your agent; running Microsoft's keeps one vendor — price both, and read what 'response' means in each.

### You already run SentinelOne

**Shortlist:** SentinelOne Wayfinder MDR Essentials / Elite, Mitigata Managed SOC

**Why:** Wayfinder MDR (Essentials, or Elite with incident response; formerly Vigilance) is the add-on built for the agent; Mitigata runs on your tools with an India SOC.

**Trade-off:** Wayfinder is priced per endpoint on top of the endpoint licence; Sophos and Barracuda may ingest SentinelOne but do not document it — confirm before assuming.

### India-regulated — audits, insurance and a 24×7 SOC in Indian hours

**Shortlist:** Mitigata Managed SOC

**Why:** The only service here with a documented India SOC plus VAPT and compliance audits, DPDP / ISO 27001 / SOC 2 / SEBI CSCRF programmes and IRDAI-regulated cyber insurance under one roof — uncopyable by a global vendor.

**Trade-off:** Founded 2023: young scale, partner-delivered tooling on your stack, quote-only. One survivor is the honest answer here; pair it with a global agent if the board wants a brand.

### Whole estate — email, identity, cloud and network, not only endpoints

**Shortlist:** Trend Service One (Managed XDR), Sophos MDR (Essentials · Complete), Barracuda Managed XDR

**Why:** Trend correlates its sensors across email, endpoint, cloud and network; Sophos and Barracuda ingest third-party telemetry across the same surfaces.

**Trade-off:** Trend's breadth needs Trend sensors everywhere; Sophos and Barracuda need integration work per source — and scope creep is where 'endpoint-only discovered during an incident' is avoided or not.

### Your MSP runs IT and should run security too

**Shortlist:** Barracuda Managed XDR, Xcitium MDR, Coro Managed SOC

**Why:** Barracuda Managed XDR is built to be delivered through MSPs; Xcitium and Coro sell MSP programmes with the SOC attached.

**Trade-off:** You are one step removed from the analyst — make the MSP's escalation path and your direct access to the SOC part of the contract.

### SMB wanting one agent, one console, one bill

**Shortlist:** Coro Managed SOC, Xcitium MDR, Bitdefender MDR (Foundations · Premium · Enterprise)

**Why:** Coro's modules with its SOC, Xcitium's modular platform with MDR, Bitdefender MDR Foundations — all priced and positioned for small estates.

**Trade-off:** Scope is the stack: Coro watches Coro, Xcitium watches Xcitium; if the incident starts in a tool they do not see, you are on your own.

## At scale

An MDR scales by alert volume and by the number of sources it must ingest, not by endpoint count alone. The bill scales per endpoint; the value scales with scope.

### 250 endpoints — Scope is the constraint

- A vendor-agent MDR onboards in days and covers the endpoints; the incident that starts in email or identity is outside the contract unless you wired it in.
- Bitdefender Foundations, Coro, Xcitium and Sophos MDR Essentials are priced for this band; Falcon Complete is enterprise-positioned.
- The agent and the SOC are one decision here — and so is the exit.

**The test:** Run a tabletop: an email-borne credential theft. Ask the vendor which step they would have seen and which they would have acted on.

### 2,000 endpoints — Sources and authority are the constraint

- Identity, email and cloud telemetry must be ingested or the SOC is blind where attacks start; BYO-telemetry services earn their keep here.
- Authority must be pre-agreed per action — a containment that waits for approval at 2am is a notification.
- Tuning becomes a joint project: their detections, your exclusions, one owner on each side.

**The test:** Ask for the named list of ingested sources for your estate and a signed authority matrix before the PoC, not after.

### 10,000 endpoints — Exit and sovereignty are the constraint

- Multi-region, multi-business-unit scoping; data residency per source; the India SOC question becomes a board question.
- A mandated agent at this size is a multi-year lock — price the switch before the first renewal.
- Your own SOC-lite (SIEM + a few analysts) plus an MDR for night cover is the common honest shape.

**The test:** Price a full exit: agent replacement, detection rebuild, telemetry export. If the number is unbearable, you have learned the real contract.

Sophos, Bitdefender, Kaspersky, CrowdStrike, SentinelOne, Trend, ESET and Barracuda document estates well above 5,000 endpoints; Xcitium, Coro and Mitigata are flagged unverified at that size, not ruled out. Where a specific service strains for your estate: [TechBag to confirm].

## Leaving an MDR is the variable nobody priced

The analysts stop; the agent stays licensed or not; the detections and tuning were theirs. What you keep depends entirely on whose telemetry the service ran on.

**Vendor-agent MDR** — The agent licence continues (you can self-run or buy another MDR on it); the vendor's detection content, tuning and runbooks leave with the service. *(Re-tool the operations)*

**BYO-telemetry MDR** — Your EDR, SIEM and integrations stay; you lose the analysts and whatever detections lived in their platform. Onboarding the next service is per source again. *(Re-onboard sources)*

**Evidence and history** — Incident records, timelines and reports sit in the provider's portal. Export what audits and insurers may ask for before the contract ends. *(Export or lose)*

**The overlap** — MDR contracts run on their own calendar; the new service needs weeks to onboard. Overlap two or accept a gap — either is a cost line. *(Overlap or gap)*

**Exit plan and re-onboarding weeks for your estate:** [TechBag to confirm] — TechBag scopes it from your sources, agents and contract dates.

## Per endpoint per month, times who is on the bridge

What you may already hold, the services priced the same way at three estate sizes in USD and INR, and what the licence line leaves out — which, for an MDR, is most of the story.

### Do you already own one?

Four places a managed service may already be within reach.

- **Microsoft 365 E5 — Partly.** Defender Experts for XDR is Microsoft’s own managed tier over Defender P2 — E5 prerequisite, quoted separately. E5 gives you the telemetry, not the analysts.

- **Your EDR vendor — Often.** Sophos, SentinelOne, Bitdefender, ESET, Kaspersky, Trend, Xcitium and CrowdStrike all sell the people on top of the agent you run. Read scope and authority before assuming it is the obvious answer.

- **Your MSP — Sometimes.** Barracuda Managed XDR, Xcitium and Coro are built to be delivered by MSPs. Ask the MSP which SOC is behind it and what authority they hold.

- **Your cyber-insurer — No.** Insurers price your controls; they do not run them — except Mitigata, which is an IRDAI-regulated broker and a SOC at once.

If the people you need already sit behind a licence you hold, we say so — and then read the authority line with you.

### What the rest actually cost

Reported and reseller-listed prices (no MDR vendor here publishes a list), normalised to per endpoint per month, INR for scale, then worked at 250 / 1,000 / 5,000 endpoints. Where a service is quote-only the line says so rather than guessing.

### What isn't in the licence price

- **The authority you didn't buy.** A service that notifies at 2am while you approve is a notification, not a response. The price gap between Essentials and Complete tiers — reported $80 ≈ ₹6,640 to $200 ≈ ₹16,600 per user per year at Sophos — is the gap between those two nights.

- **Your own hours.** Every MDR needs a person on your side to answer the call, approve the action and own the tuning. Budget one named owner and an escalation rota; the vendor will ask for it in week one.

- **The exit.** Agent replacement, detection rebuild, telemetry re-onboarding — the switching-cost section above. With a mandated-agent service this is the largest number in the contract; with a BYO service it is the smallest. Your number is [TechBag to confirm].

## What goes wrong

Documented scope and authority lines, cross-checked against TechBag engagements before any becomes a named case. Each is cheaper to read here than to discover on the bridge.

- **Endpoint-only scope discovered during an incident.** The attack came through email or a cloud identity; the MDR saw the endpoint; the contract said endpoints. Scope is the first SLA line to read.

- **Vendor lock via the mandated agent.** The MDR required its EDR; three years later the EDR, the detections and the tuning are all theirs. Switching means re-tooling the estate — the real contract length.

- **'24/7' that means a ticket queue.** Round-the-clock monitoring is not round-the-clock response. Ask whether a human investigates at 2am or a ticket is created for 9am — in which time zone.

- **Response authority narrower than assumed.** Pre-approved containment stopped at isolating the host; credential resets and cloud actions were 'advise'. The authority matrix, signed, is the product.

- **No exit path without re-tooling.** Nobody priced leaving. With a mandated agent, the exit is an endpoint migration plus a detection rebuild; plan it before signing, not at renewal.

- **Two SOCs, one incident.** An MDR for endpoints and an MSSP for the firewall, neither owning the bridge. Name the incident commander in the contract.

- **Platform 'XDR' that means 'our stack'.** The X covered the vendor's email and cloud modules you do not run. Name the ingested sources for your estate, in writing.

- **India hours assumed, not documented.** Global SOC coverage is real; an analyst in Indian hours and language is documented once on this page. Ask where the caller sits.

## Questions this guide answers

### What is the difference between MDR, MSSP and MXDR?

MDR is a team of analysts running detection and response on endpoint (and often wider) telemetry, with authority to investigate and act within a contract. An MSSP manages security devices and monitors logs and escalates to you — breadth rather than response depth. MXDR is MDR over XDR telemetry: endpoint plus email, identity, cloud and network, correlated. They are widening scopes, not tiers of quality; wider costs more and needs more of your estate wired in.

### Can an MDR run on the EDR I already have?

Some can. Sophos MDR documents integrations for CrowdStrike, Microsoft and other telemetry; Xcitium documents Managed EDR for Microsoft Defender; Barracuda Managed XDR and Mitigata run on your tools. CrowdStrike Falcon Complete, SentinelOne Wayfinder, Bitdefender MDR, Kaspersky MDR, ESET MDR, Trend Service One and Coro require their own agent or platform — which also decides what you keep when you leave.

### Which MDR is India-specific?

Mitigata: a 24×7 SOC from India on your tools, with VAPT and compliance audits, DPDP / ISO 27001 / SOC 2 / SEBI CSCRF programmes and IRDAI-regulated cyber-insurance broking under one roof. SentinelOne and Sophos document Mumbai data regions for their platforms; an India-located analyst team is not documented for the global services.

---

*Vendor-neutral. Nothing gated. Figures marked [TechBag to confirm] are team-owned and deliberately not guessed.*
*TechBag — India-based software reseller and advisory. https://www.thetechbag.com/browse/security/managed-detection-response*