TheCardinal Source
Start an engagement →

The Brief   Security   ·   Last updated September 2026

The MDR / MSSP category reset in 2026: what mid-market SOCs are actually buying.

MDR has swallowed traditional MSSP in the mid-market. The 2026 vendor pool sorts along one axis first: does the MDR provider own the EDR under the hood, or is it EDR-agnostic and layering managed detection on top of your existing endpoint tool? That choice has downstream implications for tool consolidation, response authority, and where your data lives.

7 min · Security  ·  Series piece 1 of 4

Questions this article answers

  • What changed in MDR between 2024 and 2026?
  • EDR-owned vs. EDR-agnostic MDR — which fits your posture?
  • MDR plus SIEM: bundled or separate?
  • Response authority — what can the MDR actually do on your network?
  • Vendor concentration risk in mid-market MDR?
  • Pricing normalization across per-endpoint, per-user, and per-GB ingest?
  • SLA maturity — MTTR, first-response, containment?
  • What breaks at the MDR-to-customer handoff?

The procurement question is not whether to buy MDR. It is whether to consolidate on the MDR provider's EDR or preserve an existing EDR investment behind an agnostic MDR, and how much response authority to hand over.

The MSSP category as it existed in 2018 — SIEM ingest, alert triage, ticket-back-to-you — has effectively collapsed in the mid-market. What replaced it is MDR: endpoint-centric detection, 24×7 human analysts, and, in the mature offerings, response authority that can isolate a host or kill a process without waiting for a ticket approval. The vendors that survived the reset either own the EDR they detect on or built an agnostic detection layer that ingests from whatever endpoint tool the customer already runs.

What changed between 2024 and 2026

Three shifts. First, EDR-owner MDRs became first-party services rather than partner-referred: CrowdStrike Falcon Complete, SentinelOne Vigilance (rebranded Wayfinder MDR at OneCon 2025), and Sophos MDR now compete directly on the SOC-as-a-service line. Second, EDR-agnostic MDRs — Arctic Wolf, eSentire, Expel, Rapid7 MDR — expanded their supported-EDR matrix and improved multi-tool correlation. Third, response authority moved from "recommend and wait" toward "act and notify," with the mature vendors now able to isolate endpoints under a pre-agreed playbook.

EDR-owned vs. EDR-agnostic — which fits your posture

EDR-owner MDR (Falcon Complete, SentinelOne Vigilance / Wayfinder, Sophos MDR) wins on tool consolidation, tightest-possible integration between telemetry and analyst tooling, and single-vendor accountability when something breaks. The trade is EDR lock-in and a re-platform cost if the MDR relationship ever ends. EDR-agnostic MDR (Arctic Wolf, eSentire, Expel, Rapid7, Trustwave, Optiv MDR, Deepwatch) wins when you already run CrowdStrike or SentinelOne or Microsoft Defender and want managed detection without changing the endpoint tool. The trade is a second vendor in the chain and a shared blame surface at incident time.

For most mid-market operators, the deciding factor is EDR posture. If the endpoint tool is well-tuned and the CISO is happy with it, an agnostic MDR keeps the investment. If the endpoint tool is under-tuned or dated, an EDR-owner MDR is a two-for-one procurement and often the better value.

MDR plus SIEM: bundled or separate

Every major MDR now offers a bundled SIEM tier. Arctic Wolf's Aurora platform, Rapid7's Insight platform, and eSentire's XDR platform all fold log ingest into the MDR contract. The bundled economics improve steadily under 500 users; above that the calculation gets closer. For regulated verticals with a specific SIEM requirement — a Splunk deployment that finance already runs, a Microsoft Sentinel commit inside an E5 agreement — MDR on top of the existing SIEM is often the cleaner architecture. Do not pay for two SIEMs; pick one, and make the MDR consume from it.

Response authority — what the MDR can actually do

The single most important line in an MDR MSA is the response authority clause. Three levels exist in practice: recommend-only (MDR sends a ticket, customer acts), pre-approved isolation (MDR can quarantine an endpoint under a written playbook), and full active response (MDR can also kill processes, block network destinations, revoke credentials, and initiate multi-host containment). The mature vendors will offer all three tiers; the choice depends on how much overnight autonomy your on-call rotation is willing to grant. The failure mode to avoid: buying recommend-only and expecting containment-tier outcomes.

Buyer-side. Supplier-paid. Buyers pay zero. Compensation has zero weight in the Cardinal Index scoring inside the Cardinal Method. Specific commercial terms live only in the private Decision Memo a buyer signs, never on this page.

Pricing normalization and SLA maturity

MDR pricing is not standardized. Some vendors price per endpoint per month, some per user, some per GB of ingested data, some by a hybrid. Normalize to blended cost per user per month across a three-year term, inclusive of log ingest overage and add-on modules (cloud detection, identity threat detection, ITDR, deception). SLA maturity varies more than the marketing suggests. Ask for the following in writing: mean-time-to-detect on high-severity incidents, first-analyst-response time (95th percentile, not median), containment SLA under the pre-approved response tier, and the credit structure when the SLA misses. If the credit is a token amount that does not actually change vendor behavior on repeat misses, the SLA is not real.

What breaks at the MDR-to-customer handoff

Two persistent failure modes. First: the MDR opens a ticket at 2 a.m. and the customer on-call does not see it until 8 a.m., because the ticket routed to an unmonitored queue. Fix: contract phone or pager escalation for high-severity alerts, tied to the customer's on-call rotation, not to email. Second: the MDR quarantines an executive laptop under the pre-approved playbook mid-earnings-call because the playbook was written by a security engineer with no calendar context. Fix: an exception list for named accounts, written into the playbook and reviewed quarterly.

The buyer-side selection rubric

MDR vendor selection rubric

  1. EDR alignment. Owner or agnostic — matched to your incumbent endpoint tool and its tuning maturity.
  2. Response authority tier. Recommend-only, pre-approved isolation, or full active response — explicit, in writing, with a playbook.
  3. SIEM architecture. Bundled or on-top-of-existing — no double SIEM, ever.
  4. Coverage matrix. Endpoint, identity, cloud, email, network — which is in the base tier vs. add-on.
  5. SLA credibility. MTTD, 95th-percentile first-response, containment SLA, and a credit structure with real teeth.
  6. Pricing normalization. Blended cost per user per month over the three-year term, inclusive of ingest overage.
  7. Escalation architecture. Phone or pager escalation for high-severity, tied to on-call rotation, not shared inbox.
  8. Data residency and exit. Where does telemetry live, how is it exported on termination, and what is the format?

In short

  • MDR has replaced traditional MSSP in the mid-market. The 2018-shape SIEM-ingest-and-ticket-back model no longer wins deals.
  • Vendor pool sorts first on EDR alignment: owner (Falcon Complete, SentinelOne Vigilance / Wayfinder, Sophos MDR) or agnostic (Arctic Wolf, eSentire, Expel, Rapid7, Trustwave, Optiv, Deepwatch).
  • Response authority is the single most important MSA clause. Three tiers exist; buy the one that matches your on-call rotation's autonomy tolerance.
  • Bundle SIEM only when you do not already have a strategic SIEM. Never pay for two.
  • Normalize pricing to blended cost per user per month over three years, inclusive of ingest overage.
  • The two persistent failure modes are ticket routing at 2 a.m. and blind quarantine of executive endpoints. Both are contract fixes.

Sources

All linked sources were live at time of publish (September 2026). Verify before quoting in a procurement document.

Want a calibration on your MDR shortlist?

Run the Tier 1 benchmark.

Send us your current EDR posture, incumbent SIEM (if any), and the top three MDR proposals on your desk. We return a benchmark PDF in five business days sorting owner vs. agnostic fit, normalizing pricing to blended cost per user, and flagging response-authority and SLA clauses that need to move before signature. Free. No follow-up sales drip.

Run the Tier 1 benchmark →

Series  ·  Security

The AI-side sibling: AI in the SOC — vendors and patterns worth procuring in 2026.