Is EDR enough to protect against modern ransomware or do we need a full MDR service?

All answers to this question.

For a 200-employee company, the "R" in EDR is usually the problem—you have the detection, but who is doing the response at 3:00 AM on a Sunday? Ransomware moves in minutes, not hours. If you don't have a dedicated internal SOC, an MDR service is almost a necessity today. Human analysts can distinguish between a weird admin script and a malicious actor using PowerShell to encrypt your server. We switched to MDR last year, and the peace of mind knowing that someone is actively threat hunting in our environment while we sleep has been worth every penny of the subscription cost.

   Answered 2024-08-15 by Susan Anderson

Does MDR typically include incident response, or is that usually an extra 'retainer' fee on top of the monthly monitoring costs?

   Answered 2024-08-18 by Kevin White

• Kevin, it depends on the provider. Most MDRs include basic remote isolation of infected hosts. However, if you need boots-on-the-ground for a massive breach, that’s usually a separate IR retainer. Always read the Service Level Agreement (SLA) to see exactly where their responsibility ends and yours begins during a crisis.

     Commented 2024-08-21 by Christopher Lee

Even with MDR, you still need a solid offline backup strategy. Security tools can fail, but a clean, immutable backup is your ultimate 'get out of jail free' card.

   Answered 2024-08-25 by Linda Garcia

• Linda is 100% correct. MDR is a preventative and detective measure, but immutable backups are your insurance policy for when the worst-case scenario actually happens.

     Commented 2024-08-28 by Robert Miller