Managed Detection and Response (MDR)
Most UK businesses run Microsoft Defender and hope for the best. An MDR service adds a human team that watches the telemetry, triages alerts and contains threats while you sleep. For a 50-seat business, that costs £750/month instead of the £6,000+ a dedicated analyst would need.
What MDR means
Managed Detection and Response is the pairing of endpoint telemetry with a team that hunts for threats instead of waiting for an alert. The team writes detection rules specific to your environment, investigates anomalies, isolates compromised devices and guides containment — all without needing a SOC in-house.
WatchTower MDR versus the incumbents
| Capability | WatchTower MDR | CrowdStrike Falcon Complete | Arctic Wolf | Sophos MDR |
|---|---|---|---|---|
| Per-device price | £15/month | £25–£35/month | £20–£30/month | £18–£25/month |
| Minimum seats | 5 | 50 | 50 | 25 |
| Cyber Essentials evidence pack | Included | Not included | Not included | Not included |
| IR retainer included | Yes (£50k cover) | Add-on | Add-on | Add-on |
| Onboarding fee | None | £2,000–£5,000 | £3,000 | £1,500 |
How it works
- Deploy. The agent installs silently alongside Defender. No uninstall of existing tools required.
- Detect. Behavioural rules and a local AI model spot lateral movement, credential dumping, and C2 beacons that signature-based tools miss.
- Triage. A human analyst reviews every high-confidence alert. False positives are dismissed within 30 minutes; confirmed threats are escalated within 15.
- Contain. One-click isolation from the console, or automated isolation on a rule match.
Who needs MDR?
- SMEs with 20+ devices that handle personal data, payment card data or health records — where a breach is reportable to the ICO.
- Firms bidding for Cyber Essentials Plus who need evidence of ongoing monitoring beyond the assessment day.
- Businesses that have been breached before and want to show their insurer they now have managed detection.