Skip to content
Made in the UK

Managed Detection and Response

Who fixes the issue after an MDR provider detects it?

By , Head of SOC and IR, CybaVerse. Last reviewed

It depends on the provider, so ask before you sign. Many MDR services detect and advise, leaving the fix to the MSP. A better model has the SOC contain within pre-approved actions, the root cause remediated and tracked to closure, and the MSP handling recovery.

This page is part of our managed detection and response for MSPs guide.

Why is "who fixes it" the biggest MDR complaint?

MSPs repeatedly tell us the same thing: their current provider sends alerts, sometimes hundreds a month, but the work of fixing the cause lands back on their engineers. Vendor service descriptions often state that the customer or MSP must remediate reported compromises. That is not wrong, but it is rarely clear at the point of sale.

What are the four stages after a detection?

Every confirmed threat moves through four stages. Each needs a named owner in your contract and runbook, because gaps between stages are where attacks reopen and where MSP engineers absorb unplanned work. The table shows the typical owner for each, which you should confirm with any provider.

StageWhat happensTypical owner
Detection and triageAlert validated, correlated, prioritisedMDR SOC
ContainmentIsolate device, disable account, kill process, block IOCsMDR SOC within pre-approved actions
RemediationClose the way in: patch, config change, remove persistenceShared; depends on provider and licence
RecoveryRebuild, restore data, return to normalMSP or client IT

How do you agree remediation responsibility with an MDR provider?

Use these steps during evaluation and onboarding. They turn a vague promise of "response" into a clear, testable agreement that your engineers, your clients and the provider's analysts all understand before the first real incident. Revisit the agreement after every significant incident.

  1. Step 1: Ask for the service description, not the brochure

    Read which actions the provider performs, which it only recommends and which are out of scope.

  2. Step 2: List containment actions and approve them per client

    Decide which actions the SOC can take immediately, and which need a call first, for example isolating a server.

  3. Step 3: Define what "remediated" means

    Agree that an incident is closed only when the root cause is fixed and verified, not when the alert is acknowledged.

  4. Step 4: Agree how remediation is tracked

    Remediation steps should be recorded on the incident itself so you, the provider and the client see the same status.

  5. Step 5: Map recovery tasks to your team

    Rebuilding devices and restoring data usually sits with the MSP. Make sure engineers know when the hand-off happens.

  6. Step 6: Test it

    Run a simulated incident and check who did what, how fast, and whether the case closed with the cause fixed.

How do you know remediation is actually working?

You know remediation is working when the same incidents stop recurring, open critical vulnerabilities trend down and cases close with a recorded root cause. Track these monthly per client and share them in your service review, so remediation becomes a visible outcome rather than an invisible cost.

  • Repeat incidents per client per quarter
  • Median time from containment to root-cause fix
  • Open critical and high vulnerabilities over time
  • Cases closed with a recorded root cause

How does CybaOps handle response and remediation?

CybaOps keeps detection and response on one case. The CybaVerse SOC works the incident, recovery hand-offs to the MSP are recorded on the case, and the CybaOps Remediation Engine can fix security issues automatically, so gaps get closed rather than just reported.

  • Our UK-based security operations centre monitors customer environments 24 hours a day, 7 days a week.
  • Incidents are worked as cases in CybaOps, so every alert, action and note sits in one record your team can see.
  • CybaEdge adds unlimited incident response, threat hunting and premium identity threat detection and response, delivered by our UK SOC.
  • The CybaOps Remediation Engine is live today: it can fix security issues automatically, so gaps get closed rather than just reported.
  • CybaVerse focuses on closing the route an attacker used, then checking the rest of the estate for the same weakness.
  • Pre-approved response actions are agreed with the MSP for each client during onboarding.

After detection

Who fixes the issue after MDR detects it

It depends on the provider, so ask before you sign.

01 Detected by

Multi-tenantPartner / MSP CustomerCustomerCustomer+
CybaOps by CybaVerse

After detection

02 The 6-step path

  • Role-based access
  • UK-based analysts
  • ISO 27001

03 Outcomes

Explore

Hover or tap any part of the diagram to see what it does.

  • In
  • CybaCore
  • CybaEdge
  • CybaOne
  • CybaRemediate

What else do MSPs ask about MDR remediation?

These questions come up in nearly every MSP evaluation of MDR. They focus on where the provider's responsibility ends and where the MSP's begins.

Does MDR include fixing vulnerabilities?

Some services do, many do not. Ask specifically about software updates, configuration changes and verification. Clarifying this before you sign avoids gaps where an issue is detected and contained, but nobody is clearly responsible for fixing the root cause and confirming it is closed.

Who rebuilds a compromised device?

Usually the MSP or client IT team, after the SOC has contained it. Agree this responsibility during onboarding, along with how the device is restored, who confirms it is clean and how the work is recorded against the case.

What if we do not pre-approve any actions?

The SOC contacts you before containing, which slows response, especially out of hours. Pre-approving a small set of containment actions, such as isolating a device, lets analysts act quickly while you keep control of more disruptive decisions.

How do we know remediation is finished?

When the root cause is fixed and verified, and the case is closed with that recorded. Verification matters because a fix that has not been checked may not have worked, and a clear record helps you show clients and auditors what was done.

What should you do next?

See how detection, response and remediation share one workflow on the CybaOps Platform page, or read how MSPs deliver it on the Partner page.

Related: What are pre-approved response actions in MDR, and which should an MSP approve? and How do you switch MDR providers mid-contract without a coverage gap?

See how a case is worked from alert to closure.

Book a CybaOps demo