The Evolution of the MDR Model

Eight years after Gartner coined the Managed Detection & Response (MDR) term in its first MDR market guide, more organizations continue to shift to an outsourced model to protect against cyber threats. MDR mind share is increasing – up 29% year over year, according to the 2024 Gartner Market Guide to MDR – and reports project the market will explode in the coming years, growing at 21% annual clips from 2023 through 2032.

MDR adoption is surging mainly because enterprises realize they need to augment the capabilities of their internal security teams. Monetary damage from cybercrime has more than doubled in two years. And while organizations still invest in tools to fend off attacks, nearly three quarters of security leaders feel their solutions haven’t lived up to the hype.

This has placed added pressure on security teams and created more challenges. Organizations are struggling to hire, train, and retain high-level security professionals capable of configuring and managing increasingly complex tools within their environments. With 64% of security practitioners considering new job opportunities, the growing cybersecurity talent gap is preventing many businesses from fully protecting critical assets. As a result, organizations are turning to MDR providers to enhance their security posture.

MDR is Evolving

MDR services have evolved in recent years and will continue to as the attack surface grows. They started by providing organizations with an around-the-clock, human-directed security operation that detects, hunts, and responds to threats. Essentially, the model gave resource-challenged organizations access to a fully functional Security Operations Center (SOC) and high-level security talent.

Now, as cybercriminals’ tactics become more sophisticated, businesses are adopting a more holistic MDR approach. While finding and reacting to threats remains important, modern MDR solutions go further: They anticipate threats, strengthen defenses, and act before those threats can impact the organization. Additionally, they provide internal security teams with context and deeper insights into incidents, enabling them to prioritize effectively and take the best course of action.

Modern MDR services are also leveraging new technologies to harden environments and lower risk as attack surfaces expand. By correlating individualized behavior to known attack vectors, MDR teams can dynamically change their security policies to close potential attack points.

Focusing on Exposure Management

Gartner’s recent MDR report describes an industry-wide push to add “exposure management” to MDR toolkits. Exposure management – also known as vulnerability management – focuses on identifying and then reducing a company’s exposure to external cyber threats. It takes an “outside-in” approach to evaluating security vs. the traditional “inside-out” approach of MDR. Together, both approaches complement each other – providing a holistic view of the security posture. External attack surface management (EASM) tools continuously scan and monitor assets and their vulnerabilities and misconfigurations.

MDR initially focused on providing support to large organizations looking to augment their security needs. However, as attack surfaces grow, smaller enterprises needing more expertise and more immediate response are starting to outsource security entirely to third parties. MDR providers have the means to hire, train and retain a deep bench of security analysts with specialized expertise.

The MDR model is also evolving to provide help to more organizations that have developed advanced security capabilities. Rather than outsource the whole security function, more MDR customers are establishing collaborative relationships guided by specific statements of work that dictate the responsibilities of each team. In addition, more SOC-as-a-service vendors are adapting to leverage the customer’s security tools and operations vs. using their own.

Over the years, the MDR market has changed in size and scope. The significant need for more advanced protection has attracted a wave of new vendors offering a wider array of services. Today, the market is growing more fragmented, with hundreds of Managed Security Service Providers offering some degree of MDR services. At the same time, core MDR providers are integrating what were once adjacent offerings as must-have features of their services.

Industry experts expect the MDR market to continue to evolve. The rush of new entrants is putting pressure on pricing, leading vendors to focus more on automation to reduce service costs. From a services model perspective, the consolidation of adjacent services into MDR offers, both as standard and as add-ons, should continue.

Managed detection and response services are adapting quickly to meet the needs of today’s IT and security teams. Starting out as reactive solutions focused on finding threats and reacting to them, MDR now embraces a more comprehensive strategy that proactively manages and mitigates cyber risks. Organizations that embrace this shift are able to strengthen their defenses and stay ahead of evolving attacks.