MDR for Small Business: What to Buy and What to Ask

Managed detection and response (MDR) is a service in which an external team monitors your environment around the clock, investigates alerts, and takes or directs containment action when a real threat appears. For a small or mid-sized organization without a staffed security operations center, it is usually the most direct way to make sure that an alert at 2 a.m. on a Sunday is read by a person who can act on it. This guide explains what MDR should include, where it stops, how to evaluate providers without relying on marketing language, and how to scope it so it fits an organization with a lean IT team.

TL;DR

• MDR combines telemetry collection, 24/7 human triage and response. Tooling that only generates alerts for your IT staff to read is not MDR.
• CISA's small business guidance and the FBI point to multi-factor authentication, tested and immutable backups, and rehearsed response plans as baseline controls. MDR sits on top of these rather than replacing them.
• The questions that separate providers are about who triages, what actions they are authorized to take, and what they do when nobody answers the phone.
• Pricing models vary widely and no reliable public benchmark exists for small organizations, so compare scope and unit definitions, not headline numbers.
• Simvay is a Cleveland-rooted cybersecurity firm headquartered in Westlake, Ohio, whose MDR service is staffed by an in-house, US-based team, with no outsourced triage.

Table of Contents

• Why small organizations are exposed in a specific way
• What MDR actually includes
• MDR, antivirus, EDR and an MSSP: how they differ
• Who benefits most, and who should wait
• What to ask a provider before you sign
• Understanding MDR pricing without a reliable benchmark
• Building the response plan that MDR depends on
• How Simvay approaches MDR for smaller and public-sector environments
• FAQ
• Sources

Why small organizations are exposed in a specific way

Small and mid-sized organizations tend to hold the same kinds of valuable data as larger ones: payment records, employee files, client contracts, operational systems. They often defend them with one or two IT generalists, a firewall, and endpoint antivirus. That arrangement can stop commodity malware. It is far less effective against an intruder who logs in with a stolen credential, moves laterally, and stages ransomware over several days.

The FBI’s Internet Crime Complaint Center reported more than 3,600 ransomware complaints in 2025, with documented losses above $32 million. The FBI notes that the loss figure is artificially low: it excludes lost business, time, wages, files, equipment and third-party remediation costs, some victims report no loss amount, and it counts only reports made through IC3, not those made directly to FBI field offices. The figure is a floor, not a forecast, and it says little about any individual organization. What it does show is that ransomware is reported at volume, and the reporters are not only large enterprises.

The timing problem matters as much as the tooling. Intrusions do not wait for business hours, and an unattended alert queue is functionally the same as no monitoring. CISA’s guidance for small businesses frames security as a set of tasks divided by role, beginning with the chief executive, which reflects a point practitioners repeat: this is a governance responsibility, not a purely technical one. An MDR contract does not move that responsibility away from leadership. It supplies the monitoring and response capacity that a small team cannot staff by itself.

What MDR actually includes

Providers use the term loosely, so it helps to break it into components you can verify in a contract.

Telemetry and detection

MDR begins with data. Endpoint telemetry is the common starting point, but credible coverage extends to identity events (sign-ins, privilege changes, token abuse), email, cloud administration logs and network devices. Detection quality depends on which of these sources are actually connected, how long they are retained, and whether detections are tuned to your environment or applied as a generic rule set.

A managed security information and event management (SIEM) layer matters when you need log retention and correlation across sources, for example to answer an auditor or to reconstruct an intrusion after the fact. Some organizations need it for compliance reasons even when the detection need is modest.

Human triage and investigation

This is the part that justifies the service. An alert is a hypothesis; triage decides whether it is a signed binary doing something unusual, an administrator running a legitimate script, or a command-and-control beacon calling out on a schedule. A provider should be able to tell you who performs that triage, where they sit, and whether the analyst who first reads an alert can also act on it.

Simvay’s MDR and managed SIEM service covers 24/7 detection and response, managed SIEM and identity threat detection, delivered by an in-house, US-based team that does not outsource triage.

Response actions

Detection without authority to act produces a notification, not a response. Before signing, establish in writing which actions the provider may take without calling you: isolating an endpoint, disabling an account, revoking sessions, blocking an indicator at the firewall. Then establish what happens when the action carries business risk, such as taking a server offline during production hours. Agree on the escalation path and a second contact before an incident, not during one.

Reporting and tuning

Monthly reporting should show what was investigated, what was closed and why, and what changed in the detection set. Reports made only of alert counts tell you little. Look for evidence that the provider tunes against your false positives, because noise is what eventually causes small teams to stop reading.

MDR, antivirus, EDR and an MSSP: how they differ

Buyers often compare things that solve different problems. The table separates them by type, without naming any product.

CISA’s small business guidance lists baseline controls that MDR depends on: multi-factor authentication for all staff on key systems (especially email) and for every administrator account, backups that are regularly tested with partial and full restores, and quarterly tabletop exercises. Treat those as prerequisites that MDR sits on top of, not items it replaces.

Who benefits most, and who should wait

MDR returns the most value in organizations where three conditions hold: the environment has enough endpoints, identities or internet-facing systems that an intrusion would be consequential; there is no staffed overnight security function; and the leadership expects to be reachable when a serious incident occurs.

That covers a wide range. A regional manufacturer with plant-floor systems, a county office running public safety software, a professional services firm holding client financial records and a clinic with a small IT department all share the profile, even though their regulators differ. Public-sector entities in Ohio, local governments in particular, also operate under Ohio’s public-sector cybersecurity obligations, which add reporting and preparedness expectations; confirm the specifics for your entity with your counsel or legal advisor.

MDR is less useful as a first step if the foundations are missing. If administrators share passwords, nobody knows how many laptops exist, or backups have never been restored, a monitoring contract will surface problems it cannot fix. In that situation, begin with an asset inventory, multi-factor authentication and a restore test, and add MDR as soon as those are in motion. The NIST Cybersecurity Framework 2.0 Small Business Quick-Start Guide is written for organizations with modest or no cybersecurity plans and offers a way to organize that early work.

What to ask a provider before you sign

A short list of precise questions will tell you more than a feature comparison.

1. 1.Who reads the first alert? Ask where the analysts are employed and located, whether any triage is subcontracted, and whether the person who triages is authorized to contain.
2. 2.Which data sources are included in the base scope? Endpoints alone is a narrower service than endpoints plus identity, email and cloud logs.
3. 3.What response actions are pre-authorized? Get the list in writing, and the process for actions that need your approval.
4. 4.What is the escalation path at 3 a.m.? Ask for the sequence of calls, the time between attempts and what the provider does if no one answers.
5. 5.How is the service priced, and what is the unit? Pricing may be per endpoint, per user, per log volume or flat. Each behaves differently as you grow. Ask what happens to the price when you add a site or acquire a business.
6. 6.What happens when an incident exceeds MDR scope? Full incident response (forensics, recovery, legal and communication coordination) is often a separate engagement. Know in advance whether it is included, retained or billed on demand.
7. 7.What do you retain, and for how long? Log retention affects both investigations and compliance obligations.
8. 8.What do reports contain? Ask to see a sample redacted report, not a dashboard screenshot.
9. 9.How does offboarding work? You should be able to retrieve your data and detections if you leave.

Be careful with comparison pages that rank providers. They are frequently assembled from vendor-supplied information, and their scoring criteria are rarely disclosed. Use primary guidance from CISA, NIST and the FBI for what controls matter, and use your own written questions for what a particular provider will do.

Understanding MDR pricing without a reliable benchmark

The most common question from small buyers is the cost, and it is the one with the least trustworthy public answer. Published figures tend to come from vendors, resellers and ranking sites, all of which have an interest in the number they show. No government procurement document or analyst publication gives a defensible price range for small organizations, so this article does not offer one. Any figure you encounter should state its unit and period, for example per endpoint per month, and its scope, before it is comparable to another.

What you can do is normalize quotes yourself. Ask each provider to price an identical scenario: the same number of endpoints, identities, servers and log sources, with the same response authority and the same retention. Then check three details that change the total more than the headline rate does:

• Minimums and tiers. Some contracts impose a minimum endpoint count or a minimum term.
• Onboarding and tuning. Setup effort may be absorbed in the rate or billed separately.
• Incident response. Hours spent on a confirmed incident may be capped, retained in advance or excluded.

Also compare the cost of the alternative honestly. Staffing even a minimal overnight rotation requires multiple trained people, tooling and ongoing training. Few organizations with a lean IT team can do that, which is the principal reason the model exists.

Building the response plan that MDR depends on

MDR shortens the time from intrusion to detection and containment. It does not write your decisions for you. When an analyst isolates a domain controller or disables an executive’s account, someone inside your organization has to approve the business consequences, notify affected parties and decide whether to involve law enforcement or insurers.

The FBI’s guidance on improving cyber resiliency recommends phish-resistant authentication, prioritizing administrators, executives and other high-impact accounts. It also supports exercising response plans, and practitioners consistently find that a plan nobody has rehearsed fails on contact: contacts are outdated, decision rights are unclear and backups turn out not to restore. A tabletop exercise held once a quarter, with leadership in the room, is a low-cost way to find those gaps. CISA’s guidance likewise has the chief executive review and approve the incident response plan rather than leaving it entirely to IT.

The FBI’s incident reporting also underscores backup hygiene. The 2025 IC3 report recommends off-site or offline backups, regularly maintained along with the restoration process, with all backup data encrypted, immutable and covering the organization’s entire data infrastructure. Ransomware operators frequently target backup repositories, so a backup that shares credentials with the production domain is a weaker control than it appears.

A minimum viable sequence

1. 1.Enable multi-factor authentication on every internet-facing system and every administrator account.
2. 2.Inventory endpoints, servers, cloud tenants and third-party access.
3. 3.Verify that backups are immutable and complete a restore test.
4. 4.Write a short incident response plan naming decision makers, outside counsel, your insurer and your MDR contact.
5. 5.Connect telemetry to the MDR provider and confirm the response authority in writing.
6. 6.Run a tabletop exercise within the first quarter and repeat it on a schedule.

How Simvay approaches MDR for smaller and public-sector environments

Simvay serves Ohio and clients nationwide, concentrating on the small and mid-sized organizations that enterprise security firms tend to overlook, along with public sector and critical infrastructure operators, including local government and public safety technology. Its MDR service is built around 24/7 detection and response, managed SIEM and identity threat detection. The work is performed by Simvay’s own US-based team, with no outsourced triage.

For organizations that need more than monitoring, Simvay also offers incident response, including retainers, tabletop and readiness exercises and playbook development. Security leadership is available through a fractional CISO arrangement, and compliance programs are structured to sector-specific frameworks. Infrastructure support is delivered alongside a security engagement rather than as a standalone IT service. Pricing is scoped to the client’s environment; Simvay publishes no price list, so request a scoping conversation through the Simvay site and use the questions above to evaluate any proposal you receive.

The practical value of one accountable team is that the people who scope an engagement also own its execution, and that security operations and the leadership that governs them are not split between unrelated vendors. For a small organization, that reduces the handoffs that slow a response.

FAQ

Is MDR worth it for a business with fewer than 50 employees?

It depends on the data you hold and the systems you operate, not headcount alone. A 30-person firm with client financial records, remote access and no overnight IT coverage has a similar monitoring gap to a much larger one. If the foundations (multi-factor authentication, tested backups) are not in place, address them first or alongside MDR.

What is the difference between MDR and managed SIEM?

MDR focuses on investigating threats and responding to them, usually starting with endpoint and identity data. Managed SIEM collects, correlates and retains logs from many systems, which supports investigation, audit and compliance. Some organizations need both, and Simvay’s MDR service page covers them together.

Does MDR replace antivirus or an internal IT team?

No. MDR adds human monitoring and response on top of preventive controls, and your IT staff still manage systems, patching and user support. The benefit is that security alerts are triaged outside business hours by people who do this work full time.

How much does MDR cost for a small business?

No authoritative public benchmark exists, and published figures usually come from vendors or ranking sites. Ask each provider to quote the same scenario, with the unit and period stated, such as per endpoint per month, plus minimums, onboarding and incident response terms. Simvay scopes engagements to each client’s environment and does not publish prices.

What should an MDR provider be allowed to do without calling me?

That is a contract decision. Many organizations pre-authorize actions such as isolating an endpoint or disabling a compromised account, and require approval for actions that interrupt production systems. Write the list down, name a backup contact, and test it in a tabletop exercise.

Sources

• Cyber Guidance for Small Businesses, CISA
• Improve Cyber Resiliency, FBI
• NIST Cybersecurity Framework 2.0: Small Business Quick-Start Guide
• Command and Control, MITRE ATT&CK
• 2025 Internet Crime Report, FBI IC3

Recommended

• MDR & Managed SIEM
• Free Security Assessment