Key Takeaways
- Endpoint isolation varies widely among MDR providers – some can act autonomously, others need customer approval, and a few treat it as a separate incident‑response engagement.
- Detection capabilities are usually described clearly in proposals, but response models are often obscured by similar wording, making apples‑to‑apples comparisons difficult.
- In European environments, regulatory pressures (NIS2), hybrid infrastructures, ransomware readiness, and mandatory incident reporting amplify the importance of knowing who actually contains and remediates threats.
- MDR pricing is shaped by more than just the per‑endpoint or per‑user fee; threat‑hunting scope, investigation depth, containment ownership, escalation workflows, and after‑hours support drive most cost differences.
- A structured buyer’s guide—including benchmarks, red‑flag worksheets, and targeted questions—helps organisations align price with the real‑world response capabilities they need.
Introduction: The MDR Review and the Endpoint Isolation Question
The story begins with a routine MDR provider evaluation that seemed straightforward until a single, awkward question shifted the entire discussion: “Who isolates the endpoint?” Up to that point, the competing vendors appeared nearly identical in their marketing materials, emphasizing detection rates, threat‑intelligence feeds, and 24/7 monitoring. The question exposed a fault line in the proposals that had been hidden beneath uniform language, prompting the review team to dig into operational details rather than relying on feature checklists alone. This moment highlighted how a seemingly minor inquiry can reveal fundamental differences in how providers handle the critical containment phase of an incident.
Detection vs. Response: Why the Confusion Persists
Most organisations approach MDR comparisons by focusing on detection capabilities—alert fidelity, false‑positive rates, and the breadth of telemetry collected. Vendors routinely highlight these metrics because they are easy to quantify and showcase in slide decks. However, the real value of an MDR service lies in what happens after an alert fires: investigation, containment, eradication, and recovery. Because response actions are less standardized and often bundled under vague terms like “incident response support” or “managed remediation,” buyers can easily overlook substantial disparities in who actually performs those steps and under what authority they operate.
Endpoint Isolation: Direct Capability vs. Approval‑Dependent Actions
When the review team probed the isolation question, three distinct models emerged. The first provider claimed active, autonomous isolation of compromised endpoints—once a malicious behavior is confirmed, the agent can quarantine the host, block network traffic, or trigger a forensic snapshot without waiting for customer sign‑off. The second provider described a collaborative approach: its analysts investigate and recommend containment, but the final decision to isolate requires explicit customer approval, introducing a potential delay during fast‑moving ransomware events. The third provider took a more cautious stance, stating that isolation would only occur as part of a separate incident‑response engagement once the situation met a predefined severity threshold, effectively treating containment as an add‑on service rather than a core MDR function. These variations have direct implications for dwell time, lateral movement risk, and overall breach impact.
Incident Response Ownership: Separate Engagements and Delayed Action
Beyond isolation, the broader incident‑response (IR) workflow diverged markedly among vendors. Some MDR packages embed IR analysts within the same team that performs detection and hunting, enabling seamless hand‑off from alert to remediation under a single contract and SLA. Others maintain a clear demarcation: MDR handles detection and basic triage, while any substantial IR activity—forensic analysis, malware eradication, or system restoration—is billed as a separate project, often requiring a new statement of work and additional approvals. This split can lead to confusion over responsibility during an escalation, gaps in communication, and unexpected costs when a “minor” alert blossoms into a major incident that triggers the separate IR engagement.
European Complexity: NIS2, Hybrid Infrastructure, Reporting Obligations
The nuances above become even more consequential in European contexts. The NIS2 Directive imposes strict timelines for incident reporting and mandates that operators of essential services demonstrate effective cyber‑risk management, including rapid containment and recovery. Hybrid environments—combining on‑premises servers, cloud workloads, and remote devices—further complicate isolation because agents may behave differently across platforms, and network‑level containment may require coordination with cloud‑provider security teams. Moreover, many European jurisdictions now require detailed incident logs and evidence preservation for regulatory auditors, meaning that any MDR provider that delays isolation or outsources IR could inadvertently jeopardise compliance. Buyers must therefore verify not only technical capability but also the provider’s ability to meet reporting timelines and evidentiary standards within the contracted MDR scope.
Pricing Models: Per‑Endpoint, Per‑User, Tiered, and IR‑Supported MDR
MDR pricing in Europe typically follows a few common structures. Per‑endpoint pricing charges a flat rate for each device under management, scaling predictably with inventory size but potentially overlooking variations in device criticality or usage patterns. Per‑user pricing aligns cost with the number of identities protected, which can be advantageous for organisations with many low‑risk devices but high‑value user accounts (e.g., executives, privileged admins). Tiered MDR services offer bundles—such as “Essential,” “Advanced,” and “Elite”—each adding layers like deeper threat hunting, proactive vulnerability scanning, or guaranteed response SLAs. Finally, MDR with incident‑response support bundles a baseline detection‑and‑response capability with a predefined number of IR hours or a retainer for emergency engagements, aiming to reduce the surprise of separate IR invoices. Understanding which model aligns with an organisation’s asset profile and risk appetite is essential to avoid overpaying for unused capacity or under‑buying critical response depth.
Cost Drivers Beyond Base Fees: Threat Hunting, Investigation Depth, Containment, Escalation
While the base per‑endpoint or per‑user fee sets the floor, the majority of price variation stems from ancillary factors. Threat‑hunting scope determines how aggressively the provider searches for indicators of compromise beyond alert triggers—more extensive hunting yields higher fidelity detection but consumes more analyst time. Investigation depth refers to the rigor with which analysts triage alerts: shallow investigations may rely on automated enrichment, whereas deep dives involve memory forensics, malware reverse engineering, and threat‑intelligence correlation, directly impacting cost. Containment ownership—whether the provider can act autonomously, needs customer approval, or treats containment as a separate project—affects both the speed of response and the potential need for additional billing. Escalation workflows and after‑hours response capabilities (e.g., 24/7 SOC coverage versus business‑hours only) also drive premium charges, especially for organisations that require guaranteed response within minutes rather than hours. Buyers should request a granular breakdown of these elements to see where the true cost lies.
Buyer’s Toolkit: Benchmarks, Red Flags, Worksheets, and Critical Questions
To navigate this complex landscape, the European MDR pricing guide offers several practical resources. Operational cost frameworks translate abstract service descriptors into concrete hourly rates for hunting, investigation, containment, and IR, enabling side‑by‑side cost modelling. Pricing red flags warn of deals that seem too cheap—often signalling limited investigation depth, reliance on customer‑approved actions, or exclusion of after‑hours support. Provider comparison worksheets prompt buyers to map each vendor’s capabilities against their own requirements (e.g., “Can the provider isolate endpoints without approval within 5 minutes?” “Is IR included up to X hours per incident?”). Finally, a curated list of questions buyers should ask before signing covers topics such as: Who holds the authority to execute containment? What are the exact SLAs for investigation and remediation under different severity levels? How are hybrid and cloud assets handled? What reporting artifacts are delivered to satisfy NIS2 or GDPR obligations? Answering these questions transforms a vague proposal into a clear, actionable contract.
Conclusion: Aligning Expectations with Real‑World MDR Capabilities
The initial MDR review taught a valuable lesson: detection is only half the equation. In an era where ransomware can encrypt critical systems in minutes and regulatory penalties for delayed reporting are steep, the ability to isolate, investigate, and remediate threats swiftly and autonomously often determines whether an incident remains a manageable event or escalates into a costly breach. European organisations must look beyond glossy detection metrics and scrutinise the response model hidden within each proposal. By leveraging structured pricing guides, demanding transparency around containment ownership and IR inclusion, and asking the pointed questions outlined above, buyers can ensure that the MDR service they select delivers not just alerts, but the decisive action needed to protect their assets, maintain compliance, and preserve trust.