MDR is a force multiplier on good operations. It is not a substitute for them.
Managed Detection and Response gives Australian businesses access to security operations capability they usually cannot justify building in-house: after-hours triage, human investigation, proactive hunting, containment guidance and faster response decisions.
The value depends on the environment underneath. MDR performs when endpoints are managed, Microsoft 365 and identity telemetry are available, logs are retained, backups are tested, and someone has authority to act. Without those foundations, MDR still creates alerts, but response remains constrained.
Three questions a buyer should ask before signing
Three questions, three honest answers: what MDR really is, when it pays off for an Australian business, and when it does not yet.
What is MDR, really?
Outsourced security operations for organisations that do not have their own mature internal SOC. The important parts are not just monitoring and alerting — they are prioritisation, human review, proactive hunting, investigation, containment, remediation guidance and ongoing reporting. It is a service layer that sits on top of telemetry sources and operating controls. Without those underneath, the service is constrained no matter how good the demo looks.
When does MDR pay off?
When several things are true at once: a real out-of-hours security gap, heavy reliance on Microsoft 365, Entra and SaaS, endpoint protection deployed and reporting consistently, logs centralised or routable and retained long enough to investigate, meaningful cost of disruption, and no justification for a full in-house SOC. When most of those are true, MDR solves a real operational problem rather than a hypothetical one.
When does MDR not yet pay off?
Poor patching, missing or weak MFA, unmanaged endpoints, untested backups, short log retention, and no escalation authority. MDR detects what is happening but cannot fix the structural conditions that allowed it. Buying MDR before fixing the basics produces an expensive way to describe problems the business is still not operationally ready to fix.
MDR is an operating model, not a product. And not the same thing as the rest of the stack.
- “We have an endpoint product”
- “We have a SIEM”
- Products, not an operating model
- Managed well clean, patched, enrolled, recoverable
- “We have a SOC”
- Prioritisation, human review, hunting
- Investigation, containment, guidance
- Sits on telemetry sources and operating controls
Is the environment ready for the kind of defence MDR provides?
The question is rarely whether cyber risk is real — in 2024, 22 percent of Australian SME owners said their business was impacted by cybercrime (Australian Institute of Criminology 2024 SME survey, cited in ACSC Annual Cyber Threat Report 2024–2025). If most of the first column is true, MDR is probably worth buying now. If two or more in the second are still true, baseline work should usually come first. Headcount is a weak trigger; the better trigger is operational exposure.
Managed endpoints
Credible endpoint telemetry deployed across most devices and reporting consistently.
Microsoft 365 and Entra exposure
Used heavily enough that identity and email compromise are material risks.
MFA and baseline hardening in place
Including blocking legacy authentication.
Logs retained for investigation
Retained or routed for investigation, not just dashboarding.
Backups tested
A realistic recovery path documented and validated.
Escalation path and authority
A named after-hours escalation path and an authority matrix for containment actions.
24×7 need without an internal SOC
The business needs 24×7 triage and cannot justify staffing an internal SOC.
Chronic patch backlog
Unsupported systems remain in use, or asset discovery is inconsistent.
Weak identity controls
MFA is incomplete, legacy authentication is still tolerated, or Conditional Access is poorly designed.
Patchy endpoint management
Personal or unmanaged devices in production use.
Unvalidated backups
Not secure, synchronised and tested; restore confidence has not been validated.
Short log retention
No routing to centralised storage or analytics.
No incident ownership
No one owns incident escalation, communications or post-incident communications.
Muddy MSP–client boundary
No agreement on who isolates hosts, disables accounts, restores data or notifies the client.
If MDR only watches endpoints, it is covering too little of the modern attack path.
Endpoint telemetry still matters, but recent threat reporting consistently shows that a substantial share of detections are now malware-free, with valid-account abuse, credential compromise and edge-device exploitation increasingly central. Microsoft 365 and Entra are where most Australian SMEs live operationally — and where the highest-value modern attacks land: identity compromise, mailbox takeover, OAuth consent abuse, mailbox rule manipulation.
Retention matters as much as coverage. The dwell time on a credential compromise can be weeks; log retention measured in days is incompatible with that timeline.
MDR is not outsourcing accountability. It is augmenting the operating model.
A common misconception is that buying MDR transfers responsibility for security outcomes to the SOC provider. It does not. ACSC guidance is explicit that organisations must define 24×7 reporting contacts, response roles, containment and remediation responsibilities, communications processes and service-provider arrangements. The SOC monitors and investigates. The customer and the MSP run the operating model around it.
A cyber-first MSP that signs an MDR service into its stack is augmenting the operating model, not abdicating it. The customer experience should be one accountable provider with deeper response capability behind it, not two providers blaming each other while an incident plays out.
MDR works best in an environment that can make the service actionable.
Inlight IT's view is that the SOC can investigate and escalate, but the environment still needs managed endpoints, Microsoft 365 and Entra visibility, retained logs, tested recovery, clear containment authority and an MSP or internal team that can remediate what the MDR service finds. If the basics are weak, MDR will surface real issues, but many will be issues the business is not yet operationally ready to fix. If the basics are in place, MDR becomes a genuine force multiplier: alerts are triaged faster, identity and endpoint signals are correlated, containment decisions are made earlier, and findings feed back into hardening, patching and recovery work. The practical question is not “do we need MDR because we are a certain size?” It is “do we have enough exposure, telemetry and operational ownership for MDR to improve our response capability?”
MDR works best when it is introduced into an environment with enough telemetry, baseline hygiene and response authority to make the service actionable.
Fix the baseline before buying MDR
Buy on exposure, not headcount
Agree containment authority up front
Feed findings back into hardening
Where this is delivered.
The argument on this page — MDR as an operating model that needs good operations underneath it, MDR-grade detection sitting inside an accountable client-facing layer rather than as a separate provider, findings feeding back into baseline improvement — describes how Inlight IT delivers Managed Cyber Security. Where the environment requires fuller security operations depth, the SOC-backed tier of MCS provides it, with Inlight IT remaining the accountable client-facing operating layer.
The deeper security operating layer above the managed IT baseline, with MDR-grade detection and response delivered as a component within it rather than as a separate purchase.
What MDR is, how it works and how it differs from EDR, SIEM and an internal SOC.
Confirm the environment can support response.
Review whether endpoint, identity, telemetry and recovery foundations are ready for MDR.
Discuss Managed Cyber Security