Skip to content
Made in the UK

Managed Detection and Response

How should an MDR provider escalate critical incidents to an MSP?

By , Head of SOC and IR, CybaVerse. Last reviewed

An MDR provider should escalate a critical incident by phoning the first available named contact on an agreed list, then confirming in writing with what happened, what has been done, what decision is needed and by when. Severity levels, contacts and approved actions should all be agreed with the MSP before any incident happens.

This page is part of our managed detection and response guide.

Why does escalation matter so much?

Detection only reduces harm if the right person hears about it in time to act. NIST incident response guidance treats communication and coordination as core parts of handling an incident. In an MSP model there are three parties: the MDR provider, the MSP and the client, so the lines must be clear.

Poor escalation shows up in predictable ways: an email to a shared inbox at midnight, a call to someone on leave or a message without the facts needed to decide. Each one adds delay at the moment delay costs most.

What severity levels should you agree?

Agree a small number of severity levels with clear definitions and a matching escalation route for each. Four levels is common. The aim is that analysts and engineers apply them the same way every time, so a critical call always means the same thing and nobody learns to ignore it.

SeverityExampleHow to escalate
CriticalActive ransomware or confirmed account takeoverPhone call now, then written update
HighConfirmed malicious activity, containedPhone or message within agreed time
MediumSuspicious activity needing reviewTicket or case update
LowInformational findingRegular report

How should a critical escalation work, step by step?

The steps below describe a good critical escalation. They work for any MDR provider and MSP, and they follow NCSC incident management guidance. Write the process down for each client and test it, including out of hours, before you need it during a real incident.

  1. Step 1: Confirm severity

    The analyst checks the evidence and confirms it meets the critical definition.

  2. Step 2: Take pre-approved actions

    Apply only the actions the client has already agreed.

  3. Step 3: Call the first contact

    Phone the first available person on the escalation list, then work down it.

  4. Step 4: Send a written summary

    Confirm the facts, actions taken, decision needed and deadline in writing.

  5. Step 5: Keep the case updated

    Record every call attempt, decision and action with times.

  6. Step 6: Hand over and review

    Agree who leads recovery, then review the escalation afterwards.

What should an escalation message contain?

A good escalation message lets the reader decide in under a minute. It states the facts plainly, without jargon, and makes the decision being asked for impossible to miss. Agree a short template with your provider so every critical message has the same shape and nothing important is left out.

  • What happened and when
  • Which client, users and devices are affected
  • What has already been done
  • What decision is needed, and by when
  • Who to call back, and how

Where does CybaOps fit?

CybaOps is the CybaVerse MDR platform, delivered through MSPs, backed by our UK-based security operations centre. Our UK SOC escalates to the MSP, and incidents are worked as cases so the facts, actions and decisions are recorded in one place that both teams can review afterwards.

  • Our UK-based security operations centre monitors customer environments 24 hours a day, 7 days a week.
  • Incidents are worked as cases in CybaOps, so every alert, action and note sits in one record your team can see.
  • CybaEdge adds unlimited incident response, threat hunting and premium identity threat detection and response, delivered by our UK SOC.
  • CybaVerse is certified under the NCSC Cyber Incident Response (CIR) scheme at Standard Level.
  • Pre-approved response actions are agreed with the MSP for each client during onboarding.

Escalation

How critical incidents are escalated to the MSP

An MDR provider should escalate a critical incident by phoning the first available named contact on an agreed list, then confirming in writing with what happened, what has been done, what decision is needed and by when.

01 The alert

Multi-tenantPartner / MSP CustomerCustomerCustomer+
CybaOps by CybaVerse

Escalation

02 The 6-step path

  • Role-based access
  • UK-based analysts
  • ISO 27001

03 Outcomes

Explore

Hover or tap any part of the diagram to see what it does.

  • MDR in
  • CybaCore
  • CybaEdge
  • CybaOne

What else do MSPs ask about escalation?

These are the follow-up questions MSPs ask most when agreeing escalation with an MDR provider.

How many contacts should the escalation list have?

At least three for each client, covering nights, weekends and holidays, with mobile numbers. Review the list at least twice a year and after any staff change. An out-of-date list is the most common reason escalation fails.

Should the provider call the client directly?

Usually not in an MSP-delivered model. The provider escalates to the MSP, and the MSP leads communication with the client. Agree any exceptions, such as a named client contact out of hours, in writing.

What if the MSP disagrees with the severity?

Talk it through in the post-incident review and adjust definitions if needed. During the incident, act on the agreed severity. Changing definitions mid-incident causes confusion and delay.

What should you do next?

See how the CybaVerse SOC escalates to MSPs on the CybaOps platform page. MSPs can read about the CybaVerse partner model for MSPs.

Related: What should happen in the first 60 minutes after an MDR alert fires at 2am?, Who fixes the issue after an MDR provider detects it? and How can an MSP offer 24/7 MDR without building its own SOC?

See how an escalation is handled and recorded.

Book a CybaOps demo