Twelve questions to ask an MDR provider
The questions that separate providers quickly, including the three most will not answer straight.
Before the demo
Most MDR evaluations are decided by the demo, which is the part every provider has optimised. These questions are more useful because they are harder to rehearse.
The twelve
1. What happens to an alert that nobody escalates? The honest answer describes the service. If low-severity alerts are closed automatically at volume, say so; that may be fine, but you should know.
2. How was your coverage figure measured? Claimed from datasheets, or demonstrated by testing? The difference is the whole question.
3. Who owns containment at 3am, and what may they do without me? Get the specific list, in writing, per environment.
4. What happens when a log source stops shipping? Silent detection failure is the most common way monitored organisations get hit.
5. Can you cover operational technology, and how? If the answer involves scanning, ask what their insurer thinks.
6. What do I see, and when? Ask for the analyst view, not the executive dashboard.
7. How do detections get written and tuned, and by whom? A service that only consumes vendor rules is a reseller with a rota.
8. Show me a case you got wrong. Everyone has them. How a provider talks about theirs is the single most informative moment in an evaluation.
9. What is the escalation path into my team, and who decides? Ambiguity here surfaces during an incident, which is the worst possible time.
10. What happens at renewal if I want to leave? Ask specifically about detections, tuning and case history: what leaves with you.
11. Do you compete with me or my partners? Relevant for MSPs and anyone selling security onward.
12. What would make you tell me I do not need this? The answer tells you whether you are talking to advisers or to a quota.
The three most will not answer straight
Questions two, eight and twelve. Coverage measurement, because most providers have not measured it. A case they got wrong, because the instinct is to protect the sale. And what would make them say no, because most commercial models cannot accommodate that answer.
A provider who answers all three plainly is worth more of your time than one with a better demo.
Questions, answered
What if a provider will not answer question eight?
Where this goes next
Want this applied to your estate?
Tell us what you are protecting and where you feel exposed. We will map it to the right capabilities and set up a walkthrough.