Free service guide · PDF

The MDR and 24/7 SOC Buyer's Guide

How to compare managed detection and response providers on coverage, response and proof, not marketing.

The four parts of any MDR service and how to tell them apart
A coverage checklist for endpoints, identities, email and cloud
An approval matrix template and the response-time definitions to get in writing
Red flags, sharp questions and a 90-day plan for evaluating your provider

11 pages23-item checklist30/60/90-day plan

Cover of The MDR and 24/7 SOC Buyer's Guide

Get your free copy

Instant PDF download. No sales pitch inside.

Cover and two sample pages of The MDR and 24/7 SOC Buyer's Guide, a free 11-page PDF guide from Alpiba with a 23-point checklist — A look inside: the cover and two pages from the 11-page PDF.

What's inside

Inside the guide.

MDR proposals tend to look alike: 24/7 monitoring, AI-driven detection, rapid response. The differences that matter sit underneath: what is actually monitored, who is watching at 2am, what they're allowed to do without calling you and what you get in writing afterward.

This guide helps you compare providers on those points, including us. Use the sections to understand what you're buying, the checklist to line proposals up side by side and the questions in sales meetings. The 90-day plan helps you judge a provider after you sign, while it's still early enough to fix problems.

What you're actually buying
Coverage: what must be watched
Response: put speed and authority in writing
Reporting and proof
Red flags
The checklist23 items in 4 groups
Questions to ask any IT provider10 questions
Your 30/60/90-day plan3 phases, step by step
Plain-English glossary8 terms

Read Part 1 free

The opening chapter of the guide, in full. The rest of the guide, the checklist and the 90-day plan are in the PDF.

What you're actually buying

Every MDR service combines four things, and a weakness in any one of them limits the rest.

The four parts of an MDR service
Part	What it means	What to look for
Coverage	The systems and signals being monitored	Endpoints, identities, email and cloud, confirmed against your inventory
People	Who reviews alerts and investigates	Human analysts around the clock, not just automated notifications
Response authority	What the provider can do when it finds something	Agreed actions such as isolating devices and disabling accounts
Reporting	How you learn what happened	Plain-English incident timelines and regular coverage reviews

Offers usually fall into one of three models, and the difference shows up at 2am:

Three common service models
Model	What you get	Who acts at 2am
Tools only	Software licenses and a console to watch	Your own team, if anyone is awake
Alert monitoring	Someone watches and forwards alerts to you	Usually your team, after an email or a call
MDR	Monitoring, investigation and agreed response	The provider's analysts, within your approval matrix

Be careful with services that monitor but don't respond. Forwarding an alert by email leaves the hardest part, deciding and acting, with your team in the middle of the night.

Get the full guide

A preview

A sample from the guide.

Here's the first checklist group and a few of the questions. The full guide has all 23 checklist items, 10 questions and the 90-day plan.

Coverage

EDR agent on every laptop and server, matched to the inventory
Identity and sign-in monitoring for every account, including admins
Email threats and user-reported messages reviewed by analysts
Microsoft 365 or Google Workspace audit logs connected
Compensating controls for systems that can't run an agent
Log retention set to meet insurer, audit and contract needs

Questions to ask any IT provider

1Who staffs your SOC overnight, and are they your employees or a partner's?
2How do you define first response, and what was your average last quarter?
3Which actions can your analysts take without calling us?
4Which data sources are included in the price, and which cost extra?

+ 6 more questions in the full guide

Get the full guide Related: 24/7 SOC & Managed Detection and Response

24/7 SOC & Managed Detection and Response at a glance. Included: 24/7 alert monitoring & triage, SIEM & log correlation, EDR / XDR response, Identity & sign-in monitoring, Proactive threat hunting and Plain-language reporting. How it works: Discovery & Analysis, Solution Design, Implement and Protect & Optimize. — 24/7 SOC & MDR at a glance: what is included and how we roll it out.

Your first 30 days

Where to start this month.

The guide's 30/60/90-day plan begins with these steps. Assign an owner to each and review progress every two weeks.

1Share your asset inventory and confirm agent coverage device by device
2Agree the approval matrix and contact ladder
3Connect identity, email and cloud audit logs
4Document travel patterns, scheduled jobs and authorized tools

Key terms in plain English

SOC: Security operations center: the team that monitors alerts, investigates and responds, often around the clock.
MDR: Managed detection and response: a service combining monitoring tools with people who investigate and contain threats for you.
SIEM: A platform that gathers logs from many systems and correlates them so related events can be investigated together.
XDR: Extended detection and response: detection that links endpoint, email, identity and cloud signals into one view.
Telemetry: The stream of activity data that systems send to security tools, such as sign-ins, process activity and audit logs.
False positive: An alert triggered by harmless activity. Tuning reduces them so real threats stand out.
Threat hunting: Analysts proactively searching for signs of an attacker that automated detections haven't caught.
Approval matrix: A written agreement on which response actions a provider can take immediately and which need your sign-off.