MDR BUYER'S CHECKLIST
How to Evaluate an MDR Provider
A practical checklist for mid-market companies choosing a managed detection & response provider, including the NIS2 supply-chain questions a Greek buyer needs to ask that most generic vendor checklists skip.
How to Evaluate an MDR Provider
A practical checklist for mid-market companies choosing a managed detection & response provider, including the NIS2 supply-chain questions a Greek buyer needs to ask that most generic vendor checklists skip.
Every MDR vendor's homepage says "24/7 monitoring" and "15-minute response." The questions below are the ones that actually separate a real security operation from a marketing page.
1. Detection & response capability
- Is monitoring genuinely 24/7/365 with staffed analysts, or "business hours plus an on-call pager"?
- Ask how their published detect-and-respond figures are measured.
- Do they hunt for threats proactively, or only triage the alerts your existing tools already generate?
- Can they work with the EDR/SIEM/cloud stack you already have where it fits, and if they recommend replacing a tool, can they explain why?
2. Team & staffing transparency
- Who actually handles an escalation: an engineer who knows your environment, or whoever picks up the next ticket?
- How many clients does the engineer accountable for your account look after?
- During an active incident, can you reach an engineer by phone, or do you file a ticket and wait?
- Can they support you in your own language and time zone for incident calls, not just email in a support portal?
3. Contract terms & SLAs
- Which response commitments are written into the contract, and which are published averages?
- If you leave, do you keep your logs, detection rules, and incident history, or does the provider keep them?
- Where is your data stored and processed, and is every sub-processor covered by a data processing agreement?
4. Compliance & supply-chain fit
- If you're in scope for NIS2, Article 21 makes the security of your suppliers your obligation, not just theirs. Will the provider hand you documentation an auditor will actually accept?
- Will they help you hit the Article 23 reporting deadlines (24 hours / 72 hours / one month), or is that entirely on you?
5. Cost structure & scaling
- Is pricing per-endpoint, flat-fee, or tiered, and what happens to the bill when you add 50 endpoints mid-contract?
- How is incident response handled: are hours included, billed per hour at agreed rates, or sold as a retainer you only discover you need after something's already gone wrong?
6. References & proof
- Can they show you a real, redacted incident report, not a case-study slide?
- Will they give you a client reference you can actually call, ideally in your sector or region?
This checklist reflects criteria we'd want answered as a buyer, plus the NIS2 Article 21 and Article 23 supply-chain obligations that apply if you're an in-scope Greek entity. General guidance, not legal advice.
Comparing us against this checklist?
Ask us every question above. We'll answer directly, including the ones other vendors dodge.