Managed Detection & Response (MDR)
Real security monitoring without building an internal SOC.
Our in-house SOC analysts monitor your endpoints, Microsoft 365, Google Workspace, Azure, AWS, network and servers 24/7. They investigate what matters, take pre-approved containment actions when a threat is confirmed and tell your team clearly what happened and what to do next.
- 24/7 in-house SOC
- Managed EDR included
- Pre-approved containment
- Monthly report reviewed with you
MDR at a glance
What ACS Cyber MDR is and who it is for
Managed detection and response (MDR) is a security service in which analysts monitor your systems around the clock, investigate suspicious activity and act to contain threats. It pairs detection technology with the people and processes that respond to what the technology finds.
ACS Cyber is the managed security services provider (MSSP) and cybersecurity division of Atlantic Computer Systems, with an in-house 24/7 SOC. Our MDR service is built for small and midsize organizations that need around-the-clock monitoring without staffing a security operations center of their own.
ACS supplies and manages the endpoint detection and response (EDR) agent, so there is no separate tool to buy or maintain. To get started, book a free 30-minute consultation. Typical onboarding takes 2-4 weeks.
ACS Cyber MDR in brief
| Question | Answer |
|---|---|
| Who monitors? | Our in-house SOC analysts, 24/7 |
| What is covered? | Workstations and servers through our managed EDR agent, Microsoft 365, Google Workspace, Azure, AWS, and firewall and network activity |
| Who acts on a threat? | SOC analysts take pre-approved containment actions under rules agreed with you in advance |
| How long is onboarding? | Typically 2-4 weeks |
| How is it reported? | A monthly security report, reviewed with you |
| Where are you? | Nationwide support, headquartered in San Jose, California, with an office hub in Boston |
Is this you?
Signs your organization is ready for managed detection and response
No one is watching after hours
Your tools raise alerts at night and on weekends, but nobody reviews them until the next business day.
Alerts arrive without answers
Your IT team sees warnings from endpoint, email and cloud tools but lacks the time or context to decide which ones are real.
Questionnaires are hard to answer
An insurance application or client security review asks who monitors your environment and how incidents are escalated, and the answer is unclear.
Security depends on one person
One administrator or outside provider carries the whole security load, and coverage stops when that person is busy, away or moves on.
Why MDR
Tools generate alerts. MDR turns them into decisions.
Endpoint protection, email filtering and cloud security settings all produce alerts. On their own, they cannot tell an attacker from a misconfigured script or an employee signing in from a new location.
MDR combines that technology with experienced investigation, defined response processes and ongoing improvement. Our in-house SOC analysts validate meaningful alerts, investigate the surrounding activity, take the containment actions you have pre-approved and escalate to your team with clear recommendations. Each investigation feeds back into detection tuning and improvement recommendations, so monitoring gets sharper and your environment gets harder to attack over time.
What MDR combines
- Technology that collects activity from endpoints, identities, email, cloud and network
- Experienced investigation by our in-house SOC analysts, 24/7
- Response processes agreed with your team in advance
- Ongoing improvement through tuning, threat hunting and reporting
EDR vs MDR
What is the difference between EDR and MDR?
Endpoint detection and response (EDR) is a technology. Managed detection and response (MDR) is a service that uses EDR and other data sources, plus the people who act on what they find.
| Area | EDR (a tool) | MDR (a managed service) |
|---|---|---|
| What it is | Software on laptops and servers that records activity and blocks known malicious behavior | A service that combines EDR with identity, email, cloud and network signals, monitored by our in-house SOC |
| Who runs it | Your team or IT provider buys, deploys and maintains it | ACS supplies and manages the EDR agent as part of the service |
| Who watches alerts | Your team, when someone has time | Our SOC analysts, 24/7, as their core job |
| Investigation | Raw alerts that someone must interpret | Human-led investigation into what happened, which systems are involved and whether it is still underway |
| Response | Automated blocking of known threats; everything else waits for a person | Pre-approved containment by SOC analysts, plus clear guidance and escalation to your team |
| Reporting | Dashboards that require interpretation | A monthly security report with an executive summary, reviewed with you |
MDR does not replace EDR; it relies on it, which is why ACS includes and manages the EDR agent.
Coverage
What our SOC monitors
Onboarding confirms exactly which systems are in scope for you.
Endpoints and managed EDR
ACS supplies, deploys and manages the EDR agent on your laptops and desktops. Analysts watch for malicious processes, persistence and unusual behavior.
Identity
Sign-ins, multi-factor authentication changes, privilege changes and unusual access patterns in your Microsoft 365, Google Workspace and cloud identities.
Microsoft 365 and Google Workspace
Mailbox access, inbox rules, file sharing, administrative changes and suspicious application consent in the tenants your business runs on.
Azure and AWS
Risky configuration changes, unusual data access and suspicious administrative activity in your cloud accounts and workloads.
Firewall and network
Firewall and network activity that reveals unusual connections, internal scanning and traffic to known malicious destinations.
Servers
Server activity on-premises or in the cloud, through our managed EDR agent, where your critical applications and data live.
What’s included
Everything your MDR service includes
Every engagement includes these capabilities. What changes is the scope of systems and the containment rules you approve.
24/7 security monitoring
Our in-house SOC watches your environment around the clock, including nights, weekends and holidays.
Alert validation and investigation
Analysts separate real threats from noise and investigate the surrounding activity before contacting your team.
Managed EDR
ACS supplies, deploys, tunes and maintains the EDR agent on your workstations and servers.
Email threat detection
Investigation of phishing, malicious links and inbox manipulation in Microsoft 365 and Google Workspace, which often come before payment fraud.
Threat hunting
Proactive searches for attacker techniques and suspicious patterns that have not triggered an alert.
Pre-approved containment
SOC analysts isolate a device or disable an account under rules agreed with you in advance.
Incident escalation
A defined 24/7 escalation path to your contacts, with a direct handoff to our incident response team.
Monthly security reporting
A monthly report on activity, investigations, trends and open recommendations, reviewed with you.
Security improvement recommendations
Prioritized changes to configurations and controls, explained in business terms, with help to carry them out.
MDR vs incident response
How MDR and incident response work together
MDR is an ongoing service that detects and contains threats early. Incident response is a focused engagement to contain, investigate and recover from a confirmed incident. ACS Cyber provides both under one roof.
| Area | Managed detection and response | Incident response and DFIR |
|---|---|---|
| Purpose | Find and contain threats early, around the clock | Contain a confirmed incident, establish what happened and restore operations |
| How it starts | Onboarding, typically 2-4 weeks | A call to our 24/7 incident line, or an escalation from MDR |
| Main outputs | Escalations, containment actions, a monthly report and recommendations | Forensic findings, a timeline, the root cause, a recovery plan and a hardening plan |
| Who it is for | Organizations that want 24/7 monitoring by an in-house SOC | Any organization with an active incident, including non-clients |
Learn more about incident response and DFIR. If you think you have already been compromised, see how we help or call 1-650-300-7557.
Onboarding
How we bring your environment under monitoring
Typical onboarding takes 2-4 weeks, depending on the size and complexity of your environment.
01
Scope and discovery
We review your users, devices, cloud tenants, network and existing tools, confirm what is in scope and identify escalation contacts. You receive a written scope before anything is deployed.
02
Deploy and connect
We deploy our managed EDR agent to your workstations and servers, then connect Microsoft 365 or Google Workspace, Azure, AWS and your firewalls. Detection rules are tuned so analysts focus on activity that matters.
03
Baseline and containment rules
We learn what normal looks like for your organization and agree on your runbook: who we call, which containment actions our analysts may take on their own and what needs your approval.
04
Go live with 24/7 monitoring
Our in-house SOC begins monitoring around the clock. We test the escalation path with your contacts before it is needed.
05
Monthly reviews
Each month we walk through your security report with you, discuss investigations and trends, and agree on the next improvements. Scope and runbooks change as your environment does.
Containment rules
Pre-approved containment, decided before it is needed
Before monitoring starts, we agree with your team which containment actions our SOC analysts may take on their own, who receives escalations and how we reach them.
For example, you may approve us to isolate a compromised laptop immediately but ask us to call before disabling an executive’s account. Those rules are written into your runbook, so nobody has to improvise in the middle of the night.
Every escalation explains what we observed, what we already did and what we recommend next.
Your regular deliverables
- Monthly security report, reviewed with you
- Executive summary for leadership and boards
- Escalations as they happen, through the agreed 24/7 process
- Prioritized improvement recommendations
- Runbooks and escalation contacts kept current
Who does what
One accountable team
Atlantic Computer Systems provides managed IT, including helpdesk, Microsoft 365 administration, cloud, networks and VoIP. Because ACS Cyber is its cybersecurity division, the analysts who find a weakness can hand the fix to engineers in the same organization, so it is carried through in the underlying IT. Atlantic Computer Systems also offers co-managed IT for organizations that keep their own IT staff, and managed cybersecurity services as part of its managed IT.
01
In-house SOC analysts
Monitor your environment 24/7, investigate alerts, hunt for threats and take pre-approved containment actions.
02
Incident responders
Take over when an alert becomes an incident, with in-house forensic investigation and recovery coordination.
03
IT engineers from Atlantic Computer Systems
Can carry out hands-on remediation when you want it, from reconfiguring Microsoft 365 to rebuilding affected systems.
04
Your team
Approves runbooks and containment rules, receives escalations and makes the business decisions.
Frameworks and insurance
Evidence for insurers, auditors and clients
Cyber-insurance applications and client security reviews often ask whether you use EDR, whether your environment is monitored around the clock and how incidents are escalated. MDR gives you a clear, accurate way to answer. Atlantic Computer Systems, our parent company, outlines common cyber-insurance requirements.
Monitoring and reporting also support readiness for the HIPAA Security Rule, PCI DSS, SOC 2 and NIST CSF 2.0. MDR supports these programs; on its own, it does not satisfy any of them. Our risk and compliance team can map MDR evidence to your controls.
MDR can help support
- The Detect and Respond functions of NIST CSF 2.0
- Logging and monitoring expectations in PCI DSS
- Security incident procedures under the HIPAA Security Rule
Related services
Related services and support
Incident Response and DFIR
When monitoring confirms an incident, our responders contain it, investigate with in-house forensics and guide recovery.
Vulnerability Management
Scanning, risk-based prioritization and in-house penetration testing to close the weaknesses attackers rely on.
Security Awareness Training
Help your people recognize phishing and impersonation before they click, reply or pay.
Have you been compromised?
If an attacker may already be in your systems, see how we contain, investigate and recover, client or not.
FAQ
Managed detection and response questions
ACS Cyber provides 24/7 SOC monitoring for small and midsize businesses through its managed detection and response service. Our in-house SOC analysts monitor endpoints, Microsoft 365, Google Workspace, Azure, AWS, network and servers, and act on confirmed threats under rules you approve.
EDR is software that records and blocks malicious activity on individual devices, while MDR is a managed service in which analysts use EDR and other signals to investigate and respond 24/7. EDR tells you something happened on a device; MDR tells you what it means and acts on it.
In-house. Our own analysts staff the security operations center around the clock, and our own responders and forensic investigators take over when an investigation becomes an incident.
An MDR provider can contain an attack, not only alert on it, when containment is part of the service, as it is with ACS Cyber. When our SOC analysts confirm a threat, they take the containment actions your runbook pre-approves, such as isolating a device or disabling a compromised account, then tell your contacts what they found, what they did and what to do next.
No. ACS supplies and manages the EDR agent as part of the service, including deployment, tuning and maintenance. Your firewalls, Microsoft 365 or Google Workspace tenant and cloud accounts stay in place and are connected to our monitoring during onboarding.
Yes. We monitor sign-ins, mailbox activity, inbox rules, sharing and administrative changes in Microsoft 365 and Google Workspace, and we also cover Azure and AWS.
Typical onboarding takes 2-4 weeks, depending on the size and complexity of your environment. It covers scoping, EDR deployment, connecting cloud and network sources, agreeing on containment rules and testing escalation.
Access is arranged through secure, documented methods. We never ask you to send passwords or sensitive files by email.
MDR pricing depends on the users, devices, servers and cloud services in scope. We provide a quote after a scoping conversation, and the free 30-minute consultation is a good place to start.
No security service can promise that. MDR is designed to detect threats early and limit how far they reach, and it works well alongside vulnerability management, awareness training and tested backups.
Managed Detection & Response
See what 24/7 monitoring would look like for your environment
In a free 30-minute consultation, we discuss your environment and goals and explain how MDR would be scoped. For an active incident, call our 24/7 incident line instead.