Organisations have spent years expanding their cybersecurity capabilities as technology environments have become more complicated. However, there is a growing challenge for business and security leaders: knowing whether their managed detection and response (MDR) provider can really see and respond to risks across that environment.
Choosing an MDR provider should not be a set-and-forget decision. Technology environments change, businesses introduce new systems, and threats continue to evolve. The capabilities that met an organisation's needs when an MDR relationship began may not provide the same level of visibility today.
It is therefore no longer enough for an MDR provider to describe what its technology can detect. Organisations need evidence that their provider has visibility across the places where threats can emerge and can connect that activity to inform decisions.
The question for organisations is shifting from 'what does our MDR provider offer?' to 'what can our provider actually see and respond to in our environment?'
Cybersecurity environments have changed considerably. Organisations now have users, cloud platforms, applications, connected infrastructure and a growing number of non-human identities operating across the business. MDR needs to evolve with that environment.
One area that deserves greater attention is non-human identity.
Traditional security programs have largely been designed around people, including who signed in, where they connected from and what they accessed. Organisations now also rely on service accounts, API keys, integration tokens, AI agents, and other machine identities that can operate continuously.
Security teams therefore need to understand how these identities behave and recognise when activity changes in a way that may indicate risk. Simply having logs of machine activity does not necessarily provide that understanding.
Organisations should be asking whether their MDR provider can distinguish between normal and unusual machine activity, not just whether that activity appears in a log somewhere.
This becomes even more important as AI agents start interacting directly with business systems. An action may appear legitimate from an authentication perspective while still being unexpected in its broader context. Detection needs to understand that difference.
Visibility also needs to extend beyond traditional control points.
Modern organisations rarely operate within a single technology ecosystem. Security environments can include different endpoint, identity, firewall, and cloud technologies, alongside operational technology and internet-facing infrastructure.
This can create gaps between individual security tools. An event that appears insignificant within one system may take on greater importance when considered alongside activity elsewhere in the environment. An MDR provider therefore needs to do more than collect telemetry. It needs to connect activity across systems and help security teams understand what that activity means.
Attackers don't organise their activity around the boundaries between an organisation's security tools. Detection can't afford to either.
The real test is whether an MDR provider can connect signals across the environment and understand what they mean together. More data isn't automatically better detection. The value comes from interpreting that information in context and determining what needs action.
Organisations should also consider whether their detection capabilities reflect how attacks are changing.
Security monitoring has traditionally placed significant emphasis on credential-based threats such as phishing and account compromise. These risks remain important. However, internet-facing infrastructure can also provide an entry point into an organisation, requiring different approaches to detection and response.
This makes it important to test the assumptions behind existing security coverage. Organisations should understand what signals would trigger an investigation and how their provider would respond when suspicious activity originates from infrastructure rather than a compromised user.
The same scrutiny should apply to how providers use AI. Organisations should look beyond whether an MDR provider says it uses AI and ask what role the technology plays in practice. That includes understanding where AI supports detection and investigation, how outputs are validated, and where human security expertise remains part of the process.
Ultimately, organisations should expect their MDR provider to demonstrate these capabilities rather than rely on feature descriptions.
One question that organisations can ask their MDR provider is simple: show us how this worked during a real incident.
A real example can demonstrate what was initially visible, which signals became important, how information from different systems was connected, and how quickly that understanding translated into action. It can also help an organisation understand where technology ends and human expertise begins.
MDR should give organisations confidence that meaningful activity can be seen, understood, and acted on. As technology environments continue to change, organisations need to regularly test whether the coverage they believe they have matches what their provider can demonstrate in practice.