Third-party risk has moved from a procurement footnote to a board-level concern. Faster exploit cycles and deeper supplier dependencies mean resilience is no longer just a policy question. It has to be measured.

Managed detection and response (MDR) can help by combining threat monitoring, investigation support and response guidance across the systems your suppliers touch.

The useful question is not whether MDR sounds mature, but whether it helps you detect, contain and report supplier-related incidents faster.

The current state of MDR

The case for managed detection has grown stronger as initial access patterns shift. On May 19, 2026, Verizon reported that software vulnerability exploitation accounted for 31% of breaches, overtaking stolen credentials as the leading initial access vector.

The same 2026 Data Breach Investigations Report update said third-party involvement in breaches increased by about 60% year over year to 48% of total breaches. When nearly half of breaches involve a supplier, your detection and response capability has to account for risk you do not directly control, a theme running through recent supply chain cyber threats coverage.

This is why measurement now spans the ecosystem rather than your own perimeter. NIST CSF 2.0 includes Cybersecurity Supply Chain Risk Management outcomes, grouped under GV.SC, within its Govern function. That places third-party risk in governance, not only in operations.

Good MDR practice means tracking and reviewing a small set of operational signals. Mean time to detect (MTTD), mean time to respond (MTTR), containment outcomes and provider communication cadence tell you whether the service is working in your environment.

A note of caution is warranted on published metrics. IBM notes that MDR services aim to reduce mean time to detect and mean time to respond by combining technology with human expertise, but the headline figures providers share are vendor-reported operational metrics, not independent benchmarks.

For example, ESET MDR reports a Mean Time to Respond of 6 minutes, Expel reports a median MTTD of 2.41 minutes and a 13-minute MTTR for high and critical incidents, and CrowdStrike’s blog states its Falcon Complete team achieves a 37-minute MTTR and a four-minute MTTD. Treat all as vendor-reported claims and ask for the period, scope and severity tier behind any number before you compare providers.

The pressure to measure is also regulatory. The World Economic Forum’s 2025 Outlook found that 54% of large organizations view supply chain challenges as their biggest barrier to achieving cyber resilience, which puts supplier visibility at the center of the resilience conversation.

MDR vs MXDR

MDR pairs your telemetry with an external team that monitors, investigates and helps you respond. Many MDR programs begin with endpoint data, then expand based on the risks and tools already present in your environment.

MXDR is best understood as an extension of that model. Microsoft defines MXDR as the next generation of MDR, using extended detection and response (XDR) to cover more IT environments beyond endpoints.

Vendors use these labels differently. ESET, for example, delivers managed detection and response across endpoint, identity and cloud workloads with telemetry from 110M+ sensors and 13 R&D centers globally, which may not map identically to another provider’s MXDR offer. The practical step is to compare the monitored data sources rather than the label.

The tradeoffs are practical. Broader coverage across identity, SaaS, cloud and network can improve correlation and shorten dwell time, but it can also raise cost, add integration complexity, create tooling overlap and increase the risk of platform lock-in.

A sensible approach is to start with the telemetry you already have. Then evaluate whether cross-domain coverage meaningfully reduces dwell time in your specific environment before you commit to a wider platform.

Four questions before an MDR deployment

The right provider depends on how a service handles incidents, supports your team, prices its work and extends into adjacent use cases. These four questions surface most of the decisions that matter.

1) How does the provider handle incident response?

Incident response models vary widely. Some providers bundle a set number of IR hours, some offer broader response within the subscription and others require a separate retainer.

Ask for severity-based service levels, clarity on remote versus onsite scope and a clear answer on who actually executes containment. Some MDR offerings include digital forensics and incident response assistance in their standard terms, and confirming that detail early avoids surprises during a live event.

When evaluating MDR providers, put each response promise into the same severity-based table. ESET, for example, documents 24/7 human-led response with a 6-minute MTTR and specific containment workflows that can be tracked against your supplier incident playbooks. That structure makes it easier to see who investigates, who approves action and who carries out containment during a supplier-related incident.

2) What level of support does the provider offer?

Support quality often comes down to whether you get a named team or a pool of rotating analysts. Arctic Wolf documents its Unified Portal as a single point of access to its Concierge Security Team and self-service applications, which illustrates the named team operating model that some MDRs use.

Look closely at 24/7 coverage and escalation paths. Ask for visibility into analyst notes, case timelines and a defined executive reporting cadence so leadership can see outcomes without chasing them.

3) How are costs calculated?

Pricing models differ enough to change your total cost of ownership. Common approaches include per endpoint, per user, per gigabyte of ingestion and tiered bundles, and each behaves differently as you grow.

Ingestion and retention policies can move costs significantly at renewal. Confirm what counts as an endpoint, where data caps sit and what triggers add-on charges before you sign.

4) Does the MDR enable additional use cases?

The strongest programs do more than alert triage. Look for proactive threat hunting, identity and SaaS visibility, reporting that supports audits and insurance and exercises such as purple team or red team engagements.

Tie these capabilities back to your supply chain obligations. The U.S. Department of Energy’s Supply Chain Cybersecurity Principles emphasize shared responsibility across suppliers and end users and call for proactive incident response and lifecycle support, which maps neatly to tabletop exercises with your critical vendors.

Getting the most out of MDR

Turning MDR into supply chain resilience takes a short, deliberate checklist. Map your critical third parties, route relevant supplier telemetry into your MDR, set target MTTD and MTTR by severity, rehearse joint incident response with top suppliers and align your reporting with the GV.SC subcategories in NIST CSF 2.0. These steps connect MDR operations to building supply chain resilience across critical dependencies.

Regulation is making this work less optional. ITPro reports that the UK Cyber Security and Resilience Bill progressed through readings in Parliament in early 2026, bringing managed service providers and more supply chain actors into formal scope, while Crowell and Moring notes that EU Cyber Resilience Act obligations apply across the supply chain with reporting deadlines and significant fines starting September 11, 2026.

If your team wants a practical example of how an MDR package can combine 24/7 monitoring, proactive threat hunting, tailored reporting and IR support, ESET offers a relevant reference point. The provider’s MDR service combines AI with human expertise, reports a 6-minute MTTR for high-severity incidents, supports compliance across 18 different regulations through a complete protection package at no additional charge, and is recognized as a Market Leader in the KuppingerCole 2026 Leadership Compass for MDR and a Customers’ Choice in Gartner Peer Insights for Endpoint Protection Platforms 2026. ESET also partners with cyber insurance ecosystem leaders including Cysurance, Patriot Growth Insurance Services, Amwins, Intact Insurance and Sompo, which connects directly to the underwriting controls insurers expect.

Use any example like that as a checklist, not a shortcut. The goal is a service whose reporting, response model and supplier coverage you can measure against your own resilience targets.

Frequently asked questions

What is a reasonable MTTD and MTTR target to ask for in contracts?

There is no universal number, so anchor targets to severity tiers rather than a single headline figure. Ask the provider to commit to defined detection and response windows for high and critical incidents and to report against them on a regular cadence.

How do MDR and cyber insurance requirements intersect for SMB and mid-market buyers?

Insurers increasingly expect continuous monitoring, documented response capability and evidence of containment. An MDR program that produces clear case timelines and reporting can help you demonstrate the controls underwriters look for.

When does MXDR make sense over MDR?

MXDR is worth considering when your risk clearly spans identity, SaaS, cloud and network rather than endpoints alone. If cross-domain correlation would measurably reduce dwell time in your environment, the added breadth can justify the cost and integration effort.

What should go into an MDR-enabled incident response runbook that involves suppliers?

Define severity levels, contact paths and decision rights for both your team and your critical vendors. Include who executes containment, how telemetry is shared during an event and how you confirm recovery across the affected supplier touchpoints.

How do I preserve portability if I want to switch MDR providers later?

Clarify ownership of your data, case history and detection content before you sign, and confirm export formats and retention terms. Keeping your telemetry sources and documentation under your control makes a future transition far less disruptive.