Skip to content
Made in the UK

Managed Detection and Response

How do you measure whether an MDR service is actually reducing risk?

By , Head of SOC and IR, CybaVerse. Last reviewed

Measure whether MDR is reducing risk by tracking outcomes you can check yourself: how quickly incidents are confirmed and contained, whether the same root causes keep coming back, how many exposed weaknesses have been closed, and whether coverage gaps are shrinking. Alert counts alone say little, because more alerts can mean either more attacks or more noise.

This page is part of our managed detection and response guide.

Why are alert counts a poor measure?

Alert and ticket counts measure activity. A provider that handles thousands of alerts a month may be doing excellent work or generating noise. Neither number shows whether the client is harder to attack than last quarter. NIST incident response guidance focuses on lessons learned and improvement, not volume.

Boards and clients want to know whether risk is going down. The NCSC Board Toolkit encourages leaders to ask about outcomes and to understand how security reduces business risk. The measures below are built around that question.

Which measures show real risk reduction?

Choose a small number of measures that reflect outcomes, and track them the same way every month. Start with your own baseline, because comparing against someone else's figures tells you little. The table lists measures most MSPs can collect from their MDR service and their own records.

MeasureWhat it shows
Time to confirm and contain incidentsWhether attacks are stopped quickly
Repeat incidents with the same root causeWhether causes are actually fixed
Coverage of devices and identitiesWhether blind spots are shrinking
Critical vulnerabilities open past targetWhether exposure is falling
Findings from post-incident reviews closedWhether lessons lead to change

How do you set up measurement, step by step?

The steps below work for most MSPs and in-house teams. The aim is a simple monthly view per client that shows direction of travel, not a dashboard full of figures nobody uses. Agree the measures with the client first so the report answers the questions they actually care about.

  1. Step 1: Agree three to five measures

    Pick outcome measures from the table that matter to the client.

  2. Step 2: Record a baseline

    Capture the starting position in the first month.

  3. Step 3: Track root causes

    Tag each incident with its root cause and fix.

  4. Step 4: Review monthly

    Compare each measure with the baseline and last month.

  5. Step 5: Act on the results

    Turn repeat causes and coverage gaps into planned work.

What should you ask your MDR provider?

Ask your provider to show how its work changes those measures. A good provider explains what it found, what was fixed and what still needs attention, in plain language. Be wary of reports full of alert totals with no root causes, coverage view or recommendations for the next month.

  • Which root causes did you find this month, and are they fixed?
  • Which devices or identities are not covered?
  • Which incidents repeated, and why?
  • What should we change next month?

Where does CybaOps fit?

CybaOps is the CybaVerse MDR platform, delivered through MSPs, backed by our UK-based security operations centre. Incidents are worked as cases, so root causes and actions are recorded and can be reviewed over time. We do not publish service metrics; ask to see how cases are reported in a CybaOps demo.

  • Our UK-based security operations centre monitors customer environments 24 hours a day, 7 days a week.
  • Incidents are worked as cases in CybaOps, so every alert, action and note sits in one record your team can see.
  • CybaVerse focuses on closing the route an attacker used, then checking the rest of the estate for the same weakness.
  • CybaVM gives continuous internal and external vulnerability scanning, prioritised in one place in CybaOps.
  • CybaOps ties vulnerabilities to the assets they affect, so teams fix what matters first.

Measuring MDR

How to measure whether MDR reduces risk

Measure whether MDR is reducing risk by tracking outcomes you can check yourself: how quickly incidents are confirmed and contained, whether the same root causes keep coming back, how many exposed weaknesses have been closed, and whether coverage gaps are shrinking.

01 Your tools

Multi-tenantPartner / MSP CustomerCustomerCustomer+
CybaOps by CybaVerse

Measuring MDR

02 The 5-step path

  • Role-based access
  • UK-based analysts
  • ISO 27001

03 Outcomes

Explore

Hover or tap any part of the diagram to see what it does.

  • MDR in
  • CybaCore
  • CybaEdge
  • CybaOne

What else do MSPs ask about measuring MDR?

These are the follow-up questions we hear most from MSPs and IT leaders.

How long before MDR shows results?

Expect a settling-in period while analysts learn each environment. After that, trends over a few months are more reliable than any single month. Agree the measures at the start so you can compare fairly.

Should we compare against industry averages?

With care. Published averages use different definitions and populations. Your own baseline, tracked consistently, is a better guide to whether your clients are becoming harder to attack.

Is fewer incidents always good?

Not necessarily. Fewer incidents can mean less attack activity or worse visibility. Check device and identity coverage alongside incident numbers before treating a fall as a sign of success.

What should you do next?

See how CybaVerse MDR reports on risk on the CybaOps platform page. MSPs can read about the CybaVerse partner model for MSPs.

Related: How should an MDR provider escalate critical incidents to an MSP?, How does an MDR provider handle false positives? and How can an MSP offer 24/7 MDR without building its own SOC?

See case records and reporting in a demo.

Book a CybaOps demo