MDR vs SOC as a Service vs MSSP: What You're Actually Buying

MDR, SOC as a service, and MSSP describe different answers to one question: who owns the detection stack, the analysts, and the response when something breaks. Managed detection and response (MDR) means the vendor detects and responds on their own platform: their agent, their telemetry, their analysts, priced per endpoint. SOC as a service means an operated security operations function: detection engineering, alert triage, and escalation, often co-managed on tooling you own. A managed security service provider (MSSP) manages security devices and forwards alerts across a broad estate, priced per device or as a tiered bundle. The difference that matters most in an incident is accountability. An MDR contains on the endpoint and hands off. An MSSP notifies. A co-managed SOC escalates down a path you rehearsed together.

What the vendor owns in each model

MDR is a product with humans attached. The vendor's platform is the service: you deploy their agent, your telemetry flows into their tenant, their detection content runs against it, and their analysts act on what fires. You are buying an outcome on their stack, and the economics work because that stack is identical across every customer. Deployment takes days, which is the model's real strength.

SOC as a service is a function rather than a product. You are buying what a security team would otherwise build: SIEM operation, log source onboarding, detection engineering, alert triage, tuning, and reporting. Some providers host all of it on their own platform, which makes them look like MDR with a different label. The co-managed variant runs on your SIEM and EDR, in your tenant, with the provider carrying the engineering and the queue while your team keeps decisions and business context.

An MSSP descends from device management, and breadth is the offer: firewall policy, IDS and IPS, email gateway, VPN, endpoint agents, plus monitoring and alerting across all of it, usually priced per device per month and run through a ticket queue. Depth is the trade. Alert investigation is often shallow, and response beyond notification is typically a separate line item.

The labels blur in practice because vendors wear whichever one is selling. Buy on contract terms instead: who owns the tooling, where the data lives, and who is accountable for which actions. The next three sections are that checklist.

Where accountability sits when an incident happens

MDR accountability is strong inside the agent's boundary and ends at it. A good MDR will isolate a host, kill a process, and block a hash on covered endpoints within minutes, at 3 a.m., without asking. Beyond the agent, for a compromised SaaS tenant, business email fraud, or a subnet with no coverage, the finding comes back to you with recommendations. Read the response definition in the contract, because response frequently means containment actions on covered endpoints plus advice.

MSSP accountability is measured to notification. The SLA clock stops when the ticket opens or the call goes out, so time to alert is contractual and time to contain is yours. Many MSSPs sell response as a separate retainer or on time and materials, which works if you knew it going in and surprises you badly if you assumed otherwise.

A co-managed SOC makes accountability explicit because no product boundary implies it. Who triages, who holds containment authority over which systems, what severity escalates, to whom, and on what timeline all go into a responsibility matrix, and the escalation path gets exercised in tabletop drills before a real incident tests it. Escalations arrive in your incident response process with severity, scope, and evidence attached.

A concrete case makes the boundaries visible. An attacker phishes an OAuth consent and starts pulling mailbox data through the granted token, with no malware on any endpoint. An MDR sees nothing unless its scope includes your identity provider and SaaS logs, and many contracts price that coverage separately. An MSSP forwards the identity alert if a device in its scope raised one, then waits for you. A SOC that ingests your identity and SaaS telemetry catches the consent grant, ties it to the sign-in anomaly, revokes access only if the responsibility matrix grants that authority, and escalates with the evidence already assembled. Which of those you are buying is a contract question, and it is answerable before signature.

Whichever model you buy, put one question to the vendor: during an incident, who takes the action that stops it, on what authority, and where is that written down. The quality of the answer tells you what you are buying.

Tooling ownership and data gravity

Telemetry is heavy, and wherever a year of it accumulates is where your next decision defaults. With MDR, the agent, the platform, and the detection content belong to the vendor, and your security history builds in their tenant. Switching later means redeploying agents, losing tuning, and exporting whatever the contract lets you export, so negotiate data portability before signature rather than at renewal.

With an MSSP, the devices are usually yours while the management layer, configuration history, and runbooks live in the provider's systems. Exits hurt less than MDR migrations but still leak knowledge, because the operational record of your own network walks out with the contract.

A co-managed SOC inverts the gravity. The SIEM and EDR run under your contracts in your tenant, detections are version-controlled where you can read them, and every disposition and tuning decision stays in your environment. Providers become replaceable, and audits stop depending on another firm's platform. The cost of that ownership is visible tooling spend: you pay SIEM ingestion and EDR licenses directly rather than inside a bundle, which is the transparent version of a cost you were paying anyway.

How the pricing differs

As of mid-2026, mainstream MDR runs $8 to $25 per endpoint per month, with platform-tied enterprise offerings at $25 to $45. MSSP spend spans a wider band because scope varies more, and most organizations land between $2,000 and $25,000 per month depending on device count and service breadth. Co-managed SOC as a service usually prices as a flat monthly retainer, commonly $5,000 to $25,000 in the mid-market, with the number driven by log volume, coverage hours, and response depth rather than endpoint count. The full breakdown, including what the cheap tiers cut and the costs quotes leave out, is in our guide to SOC as a service pricing.

A decision framework: team, stack, and obligations

Three variables decide most of these purchases.

• Team size. With no security staff, buy MDR and get detection and response working this quarter; an operated function you cannot supervise is a poor first purchase. With one or two security engineers, either model works, and the question becomes whose stack you want to build on. With a team that holds business context and intends to keep decisions, co-management adds depth without taking ownership away.
• Existing stack. Money already committed to Microsoft Sentinel, Defender, or CrowdStrike argues for a co-managed SOC that operates it, since MDR would duplicate that spend on the vendor's platform. No stack and no appetite to own one argues for MDR. A sprawl of firewalls and appliances that nobody patches argues for an MSSP, whatever else you buy.
• Compliance obligations. SOC 2, ISO 27001, and HIPAA expect monitoring controls with evidence. A co-managed SOC produces dispositions, tuning logs, and monthly reviews inside your tenant, in the format assessors ask for. MDR gives you the vendor's reports and attestations, which usually satisfy auditors but live outside your environment. If your auditor will ask to see the alert and what you did about it, owning the trail matters.

The models also combine. A common mid-market shape is MDR on the endpoint fleet, where the productized response is strongest, alongside a co-managed SOC that owns identity, cloud, and SaaS detection on your SIEM, with one escalation path so an incident does not fork between two vendors. What matters is that a single responsibility matrix covers both contracts, because attackers do not respect procurement boundaries.

When a co-managed SOC beats both

Co-management wins when three things are true at once: the telemetry contracts already exist, an auditor or customer will ask for monitoring evidence in your environment, and your team intends to keep decision authority. In that position, MDR would re-platform you onto a vendor's stack and an MSSP would add breadth without depth, while a co-managed SOC turns tooling you already pay for into a detection capability you keep. Detection content, triage records, and tuning history accumulate as your asset, so changing providers later means replacing labor rather than rebuilding a program.

The model has real losing cases too. With no internal team, co-management leaves decisions with nobody, and MDR's speed to value wins. With no monitoring stack and no budget to own one, the bundled model costs less for the first two years. Buy for the organization you run today, with an exit you can live with in three years.

BD Emerson runs SOC as a service as a co-managed operation on your stack: detection engineering, triage on an agreed coverage window, and escalation wired into your incident response. If the immediate gap is visibility into traffic and infrastructure, network security monitoring is the starting point. Either way, the first conversation covers your telemetry and your team, because those two facts decide which of these three models you should be buying.