How to Tell If Your MDR Provider Will Actually Stop an Attack

You're paying an MDR provider to protect you. Most of them will alert you and wait for someone else to act. This conversation names the one question that tells you which one you actually bought. Know the answer before it's 2am and someone's waiting on you to decide. You signed a contract for managed detection and response. You assumed that meant somebody would step in and stop an attack while it was happening. For a lot of MDR providers, what you actually bought is guided remediation. They find the incident, tell your team what to do, and hand it back to you to execute. That distinction is the entire reason you're paying for this instead of running it yourself, and most buyers don't find out which one they signed for until they're the one on the call at 2am being asked what to do next. Miles Lowry, Senior Territory Manager at eSentire, has sold cybersecurity from every seat in the market, VAR, Nutanix, Rubrik, and eSentire, and he walks through the one question that exposes the gap before you sign. This conversation also covers where the same blind spot shows up everywhere else in a typical MDR evaluation. Buyers send RFPs to eighteen vendors and get eighteen generic capability dumps back instead of a real fit assessment. Rules of engagement quietly change depending on whether the compromised machine belongs to your CEO or your help desk. It also gets into DLP requests that get approved without anyone defining what they're actually trying to stop, and security licensing already sitting in your Microsoft contract that almost nobody has turned on. The buyers with the best MDR outcomes never send a broad RFP at all. Miles names the one question he says he'd ask first if he were sitting on the buyer's side of the table. Know the answer before it's 2am and someone's waiting on you to decide. Want the exact test to run against your own contract? Read the full breakdown: How to Tell If Your Managed Cybersecurity Provider Will Actually Respond During an Attack. What We Get Into (00:00) - The rules of engagement: isolating a device when the CEO's machine is ground zero (00:37) - From VAR to vendor: 14 years across VAR, Nutanix, Rubrik, and eSentire (01:27) - How selling changed when hardware became a subscription (08:40) - What to size up on a first call, and why the customer is the biggest liar (13:22) - Selling cybersecurity to someone who isn't actively shopping for it (17:21) - Why "dragging them through the glass" backfires, and what works instead (21:14) - The real disconnect between sales leadership and what a rep can actually sell (25:08) - Why buyers now know what they want, but just want to pay less (30:35) - What's actually driving purchases: compliance, not fear (32:49) - The RFP pet peeve, and why AI is now writing most of them (41:21) - Why "how much data do you have" is a trick question, and the shift to unlimited SIEM (47:50) - The biggest buyer mistake: "just tell us everything you do" (54:04) - Who should be in the room on the buyer's side and almost never is (01:01:49) - Guided remediation versus an MDR provider that actually takes the response (01:10:43) - What a buyer's team composition reveals about how the deal will go (01:19:32) - Gartner invented SSE and SASE, and now admits MDR is just as muddled (01:31:52) - Microsoft E5 entitlements nobody turns on, and the hardening gap (01:38:29) - The two-to-three-year stale relationship problem, and re-selling existing clients (01:42:33) - Closing: AI, junior analysts, and the CNC-machinist parallel What We Mentioned eSentire CrowdStrike (Falcon Complete) Sentinel One Fortinet Palo Alto Cortex Microsoft Defender, Sentinel, and Entra Nutanix Rubrik Veeam Gartner NIST CSF Log4j Tenable About Miles Lowry Miles Lowry is Senior Territory Manager at eSentire, where he works directly with security leaders on managed detection and response. He's spent 14 years in enterprise technology sales, moving through VAR, Nutanix, Rubrik, and now eSentire, giving him a rare, direct view into where buyers get MDR wrong before they ever sign. LinkedIn: https://www.linkedin.com/in/cloud-ai-expert/ Company: https://esentire.com About Signed Signed is the podcast for buyers in a market built for sellers. Host Max Clark, CEO of ITBroker.com, sits down with CIOs, CFOs, operators, and founders who've lived inside real enterprise tech deals. New episodes weekly. Listen: itbroker.com/podcast About Signed The IT market is built for sellers, not buyers. Signed is the podcast for the buyers. Host Max Clark, CEO of ITBroker.com, sits down with CIOs, CFOs, operators, and founders who’ve lived inside real enterprise tech deals — the ones who can tell you what actually determined whether the deal worked, not what the deck promised. New episodes weekly. An ITBroker.com podcast. Full Transcript Click here to view the episode transcript.