Managed security
The best MDR providers in the UK: how to build a shortlist that fits
There is no single best MDR provider, only the best fit for your estate, sector and regulator. The four types of MDR provider in the UK market, who each suits, the seven tests that separate them, and how to get from a longlist to a shortlist.
Search for the best MDR providers in the UK and you will find league tables. Most rank providers against criteria you did not choose, and some are written by a provider or paid for by one. The honest answer is that there is no single best managed detection and response (MDR) provider. There is a best fit for your estate, your sector and your regulator, and the work is in finding it.
This guide does that work in four steps: understand the types of provider, decide which type suits you, test a shortlist on the questions that separate them, and watch for the warning signs. For the full set of questions to ask any provider, see our MDR buyer's guide.
A note on independence. Threat Protect sources managed security services for clients, so we have a commercial interest in this market. That is why this guide does not rank named providers. When we recommend one, we name it and say where your data is held, and you can test our proposal on the same questions as anyone else's.
The four types of MDR provider
Most services on a UK shortlist fall into one of four types. The labels blur at the edges, but the type tells you a lot about what you are buying.
1. Vendor-native MDR
The endpoint or platform vendor runs a managed service on its own technology.
- Suits: organisations standardised on that vendor's platform and planning to stay there.
- Strengths: detection and response are built around the tool, and onboarding is usually quick.
- Watch for: coverage of sources outside the vendor's products, and the cost of changing tool and service together if you leave.
2. Specialist MDR provider
A company whose main business is detection and response, working across several security platforms.
- Suits: organisations with a mixed estate, or those wanting to keep the tools they already run.
- Strengths: focus, and the flexibility to work with more than one vendor's technology.
- Watch for: which platforms they genuinely support in depth, not just the ones listed on a datasheet.
3. MSSP with MDR in the bundle
A managed security services provider (MSSP) that offers MDR alongside managed firewalls, email security, SIEM or compliance support.
- Suits: organisations that want one provider accountable for several services.
- Strengths: a single relationship and a single contract.
- Watch for: who actually runs the detection and response. It is often a specialist partner, which is fine, provided you know who it is and who is accountable to you.
4. Managed SOC or co-managed SIEM
A wider service built around a security operations centre and a SIEM platform, sometimes shared with your own team.
- Suits: larger organisations with in-house security staff, or those with log retention and evidence obligations that go beyond endpoint detection.
- Strengths: broad visibility across many sources, and the depth of evidence regulators and auditors ask for.
- Watch for: the effort needed on your side to tune it and act on what it finds.
If you are not sure which of these you need, the managed service selector works through it in a few minutes, and managed SOC and managed SIEM explain the larger services.
Seven tests that separate MDR providers
Once you know the type, these are the questions that tell providers of that type apart. Each one is covered in more depth in the buyer's guide.
1. Are people watching at 2am, or only systems?
"24×7" can mean analysts triaging alerts around the clock, or automated alerting overnight with investigation the next working day. Ask who looks at a high-severity alert at 2am on a Sunday, how quickly, and what they can do about it.
2. What will they do without asking you?
Fast response depends on authority agreed in advance: isolating a device, disabling an account, blocking a domain. Ask for the written list of pre-approved actions and how it can be tuned to your business.
3. What do they cover beyond endpoints?
Many intrusions start with a stolen password, not malware. Check that identity, email and cloud platforms are monitored and responded to, not just laptops and servers.
4. Where is your data held?
Ask where telemetry is stored and processed, for how long, who can access it, and whether UK hosting is available. For regulated firms, check the arrangement against your own outsourcing and third-party obligations.
5. Who does the work, and who is accountable?
Delivery through specialist partners is common and not a problem in itself. You need to know who has access to your environment and which party answers to you for the service levels in the contract.
6. What will your board and auditors receive?
Ask for a sample monthly report. It should show what was detected, what was done and how quickly, and what would stop it recurring. A report that only counts alerts tells a board very little.
7. How do you leave?
Ask about notice periods, minimum terms and how your data and incident history are returned, before you sign rather than at renewal.
Warning signs on a shortlist
- A "best provider" claim with no explanation of who the service is best for.
- "24×7" that turns out to mean out-of-hours alerting.
- No written list of pre-approved response actions.
- Vague answers on who does the monitoring or where your data goes.
- A price that excludes the incident response you assumed was included.
- Long minimum terms with no clear exit.
From longlist to shortlist
- Write down your requirements first. Your current tools, the sources that need covering, data location, regulatory obligations and who on your side will receive escalations.
- Pick the type, or two types, that fit those requirements.
- Build a longlist from that type. Analyst market guides, peers in your sector and your insurer's expectations are all reasonable sources.
- Cut to three and ask each one the seven questions in writing, on the same scope.
- Compare like for like: response authority, coverage, data location, reporting and exit terms, then price.
Want an independent shortlist?
If you would rather not run the process yourself, our Your Security Buyer service does it for you: we take your requirements, source and compare MDR services across providers, negotiate terms, and present the options side by side, with one point of accountability once you choose. If you already have proposals, book a call and bring them. We will compare them on the tests above, including ours.
Further reading
Frequently asked
Questions readers ask before getting in touch.
- The best provider is the one that fits your environment: the security tools you already run, the sources you need covered (endpoints, identity, email, cloud), where your data must be held, and what your regulator expects. A provider that suits a 300-person law firm on one endpoint platform may be a poor fit for a manufacturer with operational technology. Start from your requirements, then test providers against them.
- It can be a strong option if you are standardised on that vendor's platform and plan to stay there, because the service is built around the tool. The trade-offs are coverage outside that vendor's products and the cost of switching both tool and service together later. Compare it against at least one provider that works across vendors before deciding.
- Three is usually enough to compare fairly. Fewer gives you little to measure against; more makes it hard to put every proposal on the same scope and give each one a proper look at response authority, data location and reporting.
- Analyst firms publish market guides and evaluations of MDR services, which can help build a longlist. They assess providers across many markets and buyer types, so they cannot tell you which service fits your estate, your sector or UK data requirements. Use them as a starting point, not a decision.
Talk to us
Want to talk through how this applies to your company?
A 30-minute call with a senior advisor. No pitch. We will read your situation against what is in this piece and tell you the smallest sensible next step.