For a small business, endpoint detection and response (EDR) can detect and sometimes stop an attack while everyone sleeps; managed detection and response (MDR) adds people to investigate and act if the agreement gives them that authority. 24/7 cover is worth paying for when nobody on your side can handle an overnight incident—but a service that only forwards alerts may leave the same gap.
The distinction is visible in: incidents and escalations have separate tabs. A buyer needs to know which escalations the provider resolves and which will still be waiting for their staff.
The difference is who works the alert
EDR is a device-security product. It collects endpoint activity, raises alerts and can take automated actions according to its capabilities and settings, for example, includes EDR, automatic attack disruption and automated investigation. None of that means a human analyst is included to handle an unresolved alert overnight.
MDR is a service: analysts monitor agreed sources, investigate findings and respond within an agreed scope. Managed EDR sits between the labels in everyday buying conversations—it bundles an endpoint tool with a team that operates it is one such bundle. A broader MDR service may also cover accounts, email, network or cloud activity, but only when those sources and actions are included in the order.
Buying question | EDR software alone | Managed endpoint EDR | MDR with additional sources |
What is watched? | Devices running the configured product | Covered endpoints with working agents | The endpoints, identities, cloud services or other sources named in the agreement |
Who handles an overnight alert? | Automation first; your team or on-call provider handles anything unresolved | A provider SOC investigates covered endpoint alerts | A provider SOC investigates alerts from the contracted sources |
Who can contain a threat? | Your staff, plus configured automatic actions | The provider, only for actions it supports and is authorised to take | The provider or customer, depending on each integration and the response agreement |
What must the customer set up? | Licences, deployment, policies and alert routing | Asset inventory, deployment and escalation contacts; an MSP may provide rollout | Covered data sources, integrations, permissions, contacts and approved actions |
What work remains? | Investigation, follow-up and recovery | Uncovered systems, many follow-up tasks and recovery | Any investigation, administration or recovery excluded from the agreement |
This is a comparison of service models, not detection scores. Product names do not settle scope: the, dated September 17, 2026, specify Microsoft Defender for Endpoint Plan 2 as the supported data source at launch and leave response actions to the member unless separately agreed. That service is restricted to MS-ISAC members; its public terms are useful here as a contract example, not a general small-business buying recommendation.
An overnight SOC needs permission, not just a pager
After-hours risk is real, although old warnings should not be mistaken for a current attack-rate statistic. In an, the FBI and the U.S. Cybersecurity and Infrastructure Security Agency reported an observed increase in impactful ransomware attacks on holidays and weekends. The practical question is whether your organisation can respond when an automated block does not finish the job.
Three clocks matter: when the tool generates an alert, when an analyst begins investigating and when containment actually happens, updated September 8, 2026, sets a 30-minute acknowledgement target for high- or critical-priority alerts. It expressly defines that target as the time to begin investigation—not the time to isolate a device, stop an attack or restore operations. Its service targets are not guaranteed service levels.
Authority varies just as much. ArmorPoint’s published agreement allows it to isolate covered endpoints, terminate processes and quarantine files without seeking approval for each action. Disabling an account through an integration requires customer approval unless the parties agree otherwise in writing. By contrast, the say CIS will recommend actions but will not isolate devices or disable accounts without a separate signed agreement.
Even a provider that acts through its own agent may not act through yours says its analysts can isolate endpoints covered by the Blumira agent under an approved plan, but cannot currently execute actions inside third-party EDR consoles. If you intend to keep an existing EDR product, ask for a demonstration of the exact overnight action the provider can take through that integration.
Giving broad containment authority carries a different risk: isolating a business-critical server can interrupt operations. The calls for contracts to define the provider’s authority and restrictions, not merely its availability.
A useful overnight agreement says what happens if nobody answers: whether the SOC may isolate an ordinary workstation, whether it must call before touching a critical server, and who handles a compromised account. If the answer to every consequential action is “we’ll email you,” you are buying an attended alarm, not an overnight response team.
Deployment and recovery do not vanish from the customer’s side
A subscription cannot monitor an endpoint whose agent never checks in. ArmorPoint’s agreement assigns agent installation, supported versions, asset inventory and current escalation contacts to the customer likewise distinguishes its included SOC from deployment, integration and day-to-day management that a managed service provider (MSP) may sell separately.
Before treating any device as covered:
Match the order to the inventory. Count workstations and servers separately, check supported operating systems, and confirm that agents are installed and communicating. List cloud accounts and other data sources explicitly rather than assuming an endpoint subscription includes them.
Agree on the handoff. Provide primary and backup after-hours contacts, approved containment actions and exceptions for critical systems. Arrange a provider-approved escalation drill so you can verify the call route and incident record; check testing conditions before staging activity.
Name the recovery owner. Decide who will reimage devices, restore backups, fix the entry point and coordinate business decisions. An SOC investigation does not by itself fund or perform those jobs.
The exclusions deserve as much attention as the headline service. ArmorPoint’s published agreement excludes ransomware data restoration, operating-system reinstallation and some forensic work; it includes five hours per month of post-eradication assistance, with additional time listed at U.S. USD $300 per hour. Its state that fees are quoted in U.S. dollars and provide for annual renewal unless either party gives written notice 30 days before the term ends. These are ArmorPoint’s published terms, not prices or exclusions to assume for every MDR provider.
The seat minimum can change the price per protected device
As of October 3, 2026, Microsoft lists at U.S. USD $3 per user per month, paid yearly. It covers up to five eligible client devices per licensed user, for businesses with up to 300 users; servers need separate licensing. Defender for Business is also included in Microsoft 365 Business Premium, so check existing entitlements before adding its standalone price to a budget.
As of the same date, at a U.S. USD $8.99-per-endpoint monthly MSRP and shows U.S. USD $7.99 per endpoint per month as its example rate at 100 endpoints. Its standard direct plan has a 50-agent minimum commitment and a 12-month term. Huntress says MSP purchases have no Huntress-required seat minimum, but the MSP sets its own packaging and price.
Sample 12-month subscription budgets
Illustrative U.S.-market USD calculations, before tax—not vendor quotes or signed contracts. Each scenario assumes all listed client devices belong to the stated licensed users, with no servers. Microsoft amounts are monthly equivalents of an annually paid subscription. The 25- and 50-device Huntress amounts model its published MSRP against a 50-agent direct commitment; Huntress does not publish a specific 50-agent quote. The 100-device amount uses its published example rate.
At 50 devices and 40 users, the modelled subscription difference is U.S. USD $3,954 a year. That is not a measured price for better detection: it buys a different service, while excluding the customer’s labour, any MSP rollout or management fees, and separately contracted coverage such as identity monitoring. Nor can an endpoint rate establish the cost of broader MDR; request a written order covering every source you need monitored.
Questions buyers ask before signing
Can automatic EDR make a 24/7 SOC unnecessary?
Yes, for some businesses—but automation and a staffed response are different things. Microsoft Defender for Business includes automatic attack disruption and investigation, which may handle certain threats without waiting for a person. If your business also has a tested on-call route for unresolved incidents, EDR alone may be a sensible choice. If nobody can investigate an alert after hours, automation does not fill that staffing gap.
Does MDR mean the provider can isolate a laptop at night?
No. The answer depends on the tool, permissions and signed scope. ArmorPoint’s published MDR agreement grants standing authority for specified endpoint-containment actions; the Center for Internet Security’s MxDR terms retain response authority with its members unless separately agreed. Ask a prospective provider to identify the exact devices it can isolate, who approves that action and what happens when your contact cannot be reached.
Will endpoint MDR also protect Microsoft 365 accounts and servers?
Do not infer that from “MDR” on a proposal. Huntress prices Managed EDR by endpoint and Managed ITDR separately by identity; an order needs to specify which products and sources are covered. On the EDR-only side, Microsoft says Defender for Business needs an additional licence for servers. Check agent support, identity integrations and response permissions separately for each system you expect the provider to defend.
Does a 30-minute MDR target mean containment within 30 minutes?
Not in ArmorPoint’s published agreement. Its 30-minute high- or critical-priority acknowledgement target measures when an analyst begins investigating after an alert or incident is created, and the document distinguishes that from response actions. For any provider, ask which event starts the clock, which severity qualifies, when the customer is contacted and whether a separate containment commitment exists.
Buy the overnight action your own team cannot provide
No security staff: favour a provider or MSP that will deploy the product, maintain coverage, staff the overnight queue and state its authorised actions in writing. A direct SOC subscription may still leave installation and recovery with you.
Part-time IT: managed endpoint EDR is most persuasive when your team cannot take the night shift; add identity or cloud coverage only for systems the endpoint service does not cover.
An established internal team: keep EDR under your own control if you can reliably staff investigation and response at the hours your business needs. If your team covers days but not nights, price a defined after-hours or co-managed service against that specific gap. The deciding line is not EDR versus MDR on the invoice. It is who is authorised and available to act before the next working day.
Discussion
Loading discussion…