Last October, a 70-person precision machining shop in Macomb County had their entire network locked up on a Sunday night. Their traditional antivirus sat on 80 workstations and never made a sound. The intruder did not drop a known malware payload or click an executable that flagged a signature scanner. Instead, they bought an active remote desktop credential off a dark web forum for forty bucks, logged in through an exposed port, used built-in administrative tools to walk across the subnet, and triggered volume shadow copy deletions before encrypting three virtual hosts. Traditional antivirus stayed green across the console because nothing looked like a classic virus file.
Legacy antivirus protects against threats it has seen before. Modern intrusions walk right past those static signature lists. For mid-market companies running 20 to 250 seats, Managed Detection and Response (MDR) is no longer a luxury reserved for tier-one banks. Cyber insurance carriers are making it mandatory on renewal forms, and your internal IT person cannot stare at a live telemetry log at 3:00 AM on Christmas morning.
Scoping MDR requires knowing the difference between an alert-generating dashboard and an actual team of analysts authorized to pull a cable on a compromised server.
Why Traditional Antivirus Falls Short
Legacy antivirus looks for matching file signatures. A known malicious binary lands in a folder, the software checks the file hash against a local database, quarantines the file, and pops up a desktop alert. That model worked fine fifteen years ago when attackers wrote static executables and emailed them out in bulk.
It fails against how attackers operate now. Intruders bypass file checks entirely using four common methods:
- Living off the land: Attackers rely on tools already installed on Windows machines, such as PowerShell, WMI, and Remote Desktop, to run commands and pivot between machines. To basic antivirus, this activity looks identical to routine system administration.
- Fileless execution: Malicious code executes entirely inside the system memory, never writing a permanent executable file to the hard drive.
- Stolen identity credentials: Legitimate usernames and passwords obtained through phishing or database dumps let attackers log straight into email and VPN endpoints without triggering perimeter alarms.
- Staged ransomware execution: Small, harmless-looking scripts fetch encrypted payloads in stages, bypassing static scanners until the actual encryption sequence begins.
When an attacker uses valid credentials and native operating system tools, traditional antivirus has nothing to scan. By the time a basic signature check trips, the intruder usually holds domain admin privileges, has dumped your Active Directory database, and has spent days exfiltrating sensitive files.
What Managed Detection and Response Actually Does
MDR is an operational security service, distinct from standard standalone software you install and forget. It pairs deep endpoint telemetry with a round-the-clock team of human security analysts who investigate anomalous behavior across your network.
A working MDR deployment relies on three operational layers:
1. Endpoint Detection and Response (EDR) Telemetry The sensor software sits on your laptops, workstations, and servers. Instead of checking files against a static list, it logs process executions, outbound network connections, registry modifications, and account actions. It looks for patterns of behavior, like an unknown process attempting to inject code into a legitimate system file.
2. Continuous Human Monitoring Telemetry creates noise. An engineer compiling software or an IT admin running a scheduled deployment script can trigger alerts that mimic a malicious intrusion. MDR providers run a 24/7 Security Operations Center (SOC). Their analysts filter out normal administrative work, inspect edge cases, and confirm genuine security incidents before escalating.
3. Active Threat Containment Alerting is not containment. If an MDR provider sees active lateral movement on your network at 2:00 AM, sending an automated email to your IT manager does not help. True MDR includes the operational authority to pull an affected workstation off the network remotely, terminate rogue processes, and revoke compromised user credentials immediately.
How to Scope MDR for 20 to 250 Users
Mid-market organizations do not need bloated enterprise security architectures, but they cannot rely on consumer-grade tools that dump alert triage onto an already busy internal IT person. When we evaluate MDR as part of our cybersecurity and risk assessments or broader services, we look closely at four operational areas:
Endpoint Coverage and Inventory Every endpoint matters. Intruders actively search for the one unmanaged box on a local subnet, whether that is an old shipping terminal in the warehouse, an unmonitored test server, or an employee laptop connecting via VPN without updated agents. Your deployment scope must account for all Windows, macOS, and Linux systems, including physical hardware and cloud-hosted servers.
Identity and Cloud Telemetry Workstations represent only one portion of your attack surface. Many business breaches begin with compromised user credentials inside Microsoft 365 or Google Workspace. When scoping MDR, verify whether the service ingests cloud identity logs alongside machine data. If a user logs into webmail from Eastern Europe and runs an unusual administrative script on their office laptop five minutes later, your monitoring team needs to see both events side by side.
Rules of Engagement for Remediation You have to establish clear operational boundaries ahead of time. Work out what actions the external SOC is permitted to execute without waiting for someone on your team to answer a phone call:
- Can the SOC isolate an executive workstation immediately if it detects active credential dumping?
- Is the analyst authorized to force a company-wide password reset on an administrative account under attack?
- Who is the designated emergency contact if an incident requires shutting down a production server?
What actually happens when a detection triggers at 2:15 AM on Thanksgiving?
If your agreement only requires the vendor to email a ticket to your internal queue, you bought software monitoring, not managed response. Real protection requires authorized containment procedures written straight into the service level agreement.
Co-Management vs. Black-Box Operation Some security vendors lock down their consoles and refuse to let your internal staff see raw alerts or investigation notes. Others operate a transparent, co-managed model where your IT staff can review SOC notes and examine telemetry directly. Mid-market IT teams almost always get better results from a co-managed model, because it keeps internal staff informed about what is happening across their systems.
Common Scoping Mistakes to Avoid
Businesses often make buying decisions based on vendor sales pitches rather than operational delivery. We see a few regular mistakes across the contracts we review:
- Assuming antivirus upgrades include human monitoring: Adding an advanced tier to an existing antivirus contract often gives you a better detection engine, but it rarely includes a 24/7 human analyst team to handle the alerts.
- Ignoring server and cloud licensing fees: Some vendors quote low per-seat rates for desktop users, then add heavy surcharges for domain controllers, SQL servers, and virtual machines. Count your entire infrastructure before comparing proposals.
- Overlooking telemetry retention periods: Post-incident forensics often requires reviewing activity from 30, 60, or 90 days prior to confirm when an intruder first gained access. Make sure your data retention window aligns with the standards outlined in the NIST Cybersecurity Framework and matches what your insurance carrier requires.
- Carrying duplicate software licenses: Companies frequently pay for standalone antivirus, separate endpoint management tools, and external security add-ons that duplicate the capabilities of an MDR platform. Review your cybersecurity insurance questionnaires to see which tools satisfy compliance mandates before renewing redundant products.
Finding the Right Fit for Your Organization
Selecting an MDR solution means balancing budget, existing software agreements, internal team skills, and insurance obligations. You do not need to buy every add-on module a vendor pitches, but you cannot leave endpoint monitoring unattended outside business hours. Organizations looking for basic government security baselines can also reference CISA cyber hygiene services to review fundamental controls.
Good Wolf Technology is an independent advisor. We do not resell software licenses, and we do not operate as an IT brokerage. Our job is to evaluate your setup objectively and tell you what fits your actual operational needs.
If you want an objective look at your endpoint defenses, licensing costs, or security contracts, you can schedule a free 15-minute review. We will go over your current environment and point out gaps or duplicate subscriptions without sales pressure. If you have specific vendor agreements you want us to review, drop us a line on our contact page.
FAQ
What is the main difference between EDR and MDR? EDR (Endpoint Detection and Response) is the software tool installed on computers to record system behavior and detect anomalies. MDR (Managed Detection and Response) is the service layer that includes human security analysts who watch that EDR tool around the clock, investigate alerts, and take action to stop attacks.
Does MDR replace the need for regular backups and patching? No. MDR detects and stops active intrusions, but it does not replace routine patch management, immutable backups, or basic identity protections like multi-factor authentication. Security works in layers, and MDR is the layer that handles active threat containment.
How does MDR affect cyber insurance policies? Many cyber insurance underwriters now require active 24/7 endpoint monitoring and human response capabilities before issuing or renewing policies for mid-market companies. Having verified MDR in place helps satisfy underwriting requirements and can prevent claim denials related to unmonitored network environments.
Sources
- NIST Cybersecurity Framework - National Institute of Standards and Technology guidance on core cybersecurity functions: Identify, Protect, Detect, Respond, and Recover.
- CISA Cyber Hygiene Services - Cybersecurity and Infrastructure Security Agency resources for vulnerability scanning and baseline defense posture.