Why MDR is more than a SOC: response, not just the alert
A SOC monitors and notifies; an MDR monitors, notifies and, above all, responds. The delta is not semantic: it is the difference between an alert left in a queue and a contained incident. MDR adds to the SOC the managed response (isolation, eradication, restore support) and analysts with the mandate to decide. If your outpost stops at the notification, you have a SOC, not an MDR.
The thesis
“We have a SOC” does not mean “we are protected”. A SOC sees and notifies; but if no one acts on the alert in the right way and time, the notification stops nothing. MDR is the SOC that adds the missing piece: the response.
The cost of stopping at the alert
A critical alert at 3 a.m. is worth zero if it stays in a queue until morning. Most serious incidents mature outside office hours, exactly when a SOC without response delegates everything to the customer. The cost of the gap is not the missed detection, it is the missed reaction.
What MDR provides
Managed response: host isolation, eradication, C2 blocking, restore support, and analysts with the mandate to decide, not just to notify. It is what turns a signal into a closed incident, as in Operation Storming Tide.
When it really matters (and when less is enough)
If you have an in-house 24·7 security team able to act on alerts, a SOC that feeds it can be sufficient. If that team is missing, part-time, or relies on a generic MSP, then an alert without response is an illusion of security: there, MDR is the honest choice. For the technical distinction with the technologies see MDR vs EDR vs XDR.
Traditional SOC vs MDR
| SOC (detection) | MDR (detection + response) | |
|---|---|---|
| Output | Alert and notification | Closed incident |
| On a critical alert | Notifies you | Isolates, eradicates, contains |
| Decision | Stays with you | Analysts with mandate to decide |
| Outcome | Depends on your reaction | Median containment ~11 min |
In Operation Storming Tide the technology raised the signals, but what closed the incident (containment, exfiltration and ransomware prevented) was the response of the Fortgale analysts. That is exactly the delta between a SOC that notifies and an MDR that acts.
Read the analysis →Frequently asked.
So a SOC is not enough?
A SOC is necessary but, on its own, it delegates the hardest part to you: acting on the alert, at night, fast, well. MDR fills that gap by adding managed response. See what is a SOC and what is MDR.
What is the concrete delta on times and outcomes?
A SOC measures the time to detect; an MDR also measures the time to contain. Fortgale operates with median containment ~11 minutes from the confirmed alert: it is the outcome, not just the notification.
Can I start with a SOC and add response later?
Yes, but the point is continuity: in the Fortgale model SOC and response are the same outpost, with no handover between vendors. Whoever detects is whoever contains.
When can a SOC without response be enough?
If you have an in-house 24·7 team able to act on alerts autonomously, a SOC that feeds that team can be enough. If that team is missing (or not 24·7), an alert without response is a risk: that is where MDR is needed.
From theory to a real operation.
What you read here, Fortgale runs every day with a European SOC 24·7·365: 287 tools and actors profiled, <30 min median containment. Explore the service: Fortgale MDR service.
Related resources: What is MDR · What is a SOC · MDR vs EDR vs XDR
A technical conversation, not a funnel.
Leave your details: an analyst calls you back within one business day. European SOC, same time zone, proprietary intelligence on the actors active across the EU.