Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Enterprises Outsource Threat Detection to MDR Providers
Transcript
- Lucas: There's a number that's been stuck in my head since I read the latest SANS SOC survey. It says that sixty percent of organizations now outsource at least some of their detection and response work to a managed service provider. That's up from about forty percent three years ago. Luna: So we're talking about Managed Detection and Response — MDR — basically hiring a third party to sit in your security operations center, or at least monitor your tools. Lucas: Exactly. And the term MDR has become distinct from the old managed security service provider model. MSSPs were more about managing firewalls and antivirus. MDR is purpose-built for threat hunting, alert triage, and incident response. The market leaders like CrowdStrike with their Falcon OverWatch, Arctic Wolf, Red Canary — they've been growing at compound annual growth rates north of thirty percent. Luna: What's driving that? I mean, we've been talking about a cybersecurity talent shortage for years — is it really that bad? Lucas: It's worse than most people realize. The latest ISC2 study says there's a gap of about four million cybersecurity professionals globally. And the most acute shortage is in security analysts — the people who actually look at alerts day in and day out. Even if a company can afford an internal Security Operations Center, they can't find the people to staff it. So MDR becomes a forced choice. Luna: Right, so it's not just about cost — it's about access to expertise you literally can't hire. But let's talk cost anyway. How does the pricing work? Lucas: Pricing is typically per endpoint per month — anywhere from three to ten dollars per device, depending on what's included. For a mid-sized company with five thousand endpoints, you might pay maybe two hundred thousand a year for full coverage. Compare that to standing up your own SOC: you need at least three shifts of analysts, a SIEM platform, threat intelligence feeds — we're talking one point five million dollars a year as a floor. The math gets compelling fast. Luna: But there has to be a trade-off. If you outsource detection, you're handing over a lot of control over how alerts are triaged and escalated. Lucas: That's the big risk. Your MDR provider might use a different severity scale than your internal team would. They might be too aggressive and generate noise, or too conservative and miss things. There's also the question of integration depth. If your MDR tool isn't deeply connected to your environment — identity systems, cloud workloads, endpoints — you're getting a hollow service. The best MDRs require you to deploy their own sensor or agent, not just plug into existing tools. Luna: So are companies moving to a co-managed model? Where they keep some internal capability and augment with MDR? Lucas: That's actually the most common approach we're seeing in 2026. Enterprises with mature security programs use MDR for overnight and weekend coverage — the so-called follow-the-sun model. Their internal team handles the day shift, and MDR takes over after hours. But smaller companies that can't justify even one analyst often go full MDR, handing over everything. Luna: Let's talk about a concrete example. I remember reading about a mid-sized retailer — maybe fifty stores — that switched to a co-managed model with Arctic Wolf. Their mean time to detect went from over two days to about fourteen hours. Lucas: Yeah, I remember that case. The key was that Arctic Wolf's analysts correlated logins from point of sale systems with network anomalies that their internal team had been ignoring as false positives. That's the value of having fresh eyes that see patterns across multiple clients. An internal SOC only sees one environment, so they normalize weirdness. An MDR sees thousands of environments, so they know what's actually anomalous. Luna: That's a strong selling point — pattern recognition at scale. But does any of that conflict with regulations? Some industries require that certain security functions stay in-house. Lucas: Absolutely. Financial services and healthcare have strict rules about data residency and who has access to raw logs. MDR providers have to offer dedicated tenants — sometimes even on-premises deployments — to comply. And for the most sensitive investigations, banks still keep a fully internal red team. So MDR is not a complete replacement; it's a force multiplier. Luna: And what about the vendors themselves? We've seen some consolidation — CrowdStrike acquiring a couple of smaller MDR firms, SentinelOne building out their own service. How do buyers evaluate the increasing number of options? Lucas: The number of options is actually a problem. Gartner lists over thirty MDR providers. I think the key differentiator is detection engineering — how quickly does the provider create new detections for emerging threats. CrowdStrike, for example, releases dozens of new detection rules per week. A smaller provider might only do a few per month. That delta matters when a new malware variant drops. Luna: So speed of detection updates is an iceberg metric — easy to overlook but critical when something hits. Lucas: Exactly. And the second metric is time to respond. Once an alert fires, how fast does the MDR start acting? The best contracts guarantee phone call escalation within fifteen minutes for critical incidents. But I've seen MDRs where response takes an hour because they're drowning in alerts from too many clients. Luna: That ties into something we've touched on before — alert fatigue isn't just an internal problem. MDR analysts face it too, even with automation. Lucas: Right. And that's where the next wave of MDR differentiation is coming from — using AI to triage alerts before they even reach a human. CrowdStrike's Charlotte AI, Microsoft's Security Copilot — they're all aiming to reduce the false positive burden. But the irony is, these AI tools also need tuning, which requires more skilled labor. It's a recursive problem. Luna: On that point — a quick honest thing. We're able to dig into these nuanced topics every day because of a handful of listeners who chip in on buy me a coffee dot com slash fexingo. That's what keeps the show ad-free and lets us spend time on episodes like this. If these conversations are useful for what you're building or running, that's the way to support. Lucas: Yeah, it's a small group, but they make a big difference. And it means we never have to do sponsored content that distorts the analysis. So, back to MDR — one trend I think is really interesting is the rise of vertical-specific MDR. You have providers that specialize in manufacturing, or healthcare, or even K-12 education. They understand the threat landscape specific to those sectors. Luna: Right, like a hospital's SOC needs to know about medical device vulnerabilities and HIPAA specifics, which a generalist might not prioritize. Lucas: Exactly. And that's where I think the market is heading. The generalist MDRs will keep growing, but the specialists will win the most regulated verticals. We're already seeing CyberMDX in healthcare, though they were acquired by Forescout. And Dragos for industrial control systems. They're essentially MDR for OT environments. Luna: Do you think the talent shortage will eventually ease? Or is MDR a permanent structural shift? Lucas: I think it's permanent. Even if more people enter cybersecurity, the attack surface is growing faster. Cloud-native architectures, IoT devices, remote work — there are more signals to analyze every year. No organization can scale its internal team at the same rate. So MDR becomes less of a choice and more of a default. Luna: That's a sobering thought, but it's also an opportunity for the companies building better detection services. Thanks, Lucas. Lucas: Always a pleasure. And to our listeners, we'll be back tomorrow with another deep dive.