Not just the endpoint. Most extended detection and response is endpoint-led, with the rest of the estate bolted on afterwards. Ours runs the other way round: Microsoft Sentinel is the correlation engine, everything else is a signal into it, and an AI SOC investigates every one of them to a verdict.
MXDR is two promises bolted together, and vendors tend to keep one of them. The extended half is about how much you can see. The managed half is about who does the work when something fires.
The extended half means detection is correlated across domains rather than evaluated one signal at a time. A failed sign-in is noise. A failed sign-in, then a successful one from a new country, then a mailbox rule forwarding externally, then a file share being enumerated, is an incident - and it is only an incident if something is looking at all four together.
The managed half means that correlation is somebody’s standing job. Detections are tuned as the estate changes, every alert is investigated to a verdict, and containment happens inside limits you set. If any of that arrives back with you as homework, what you bought was extended detection without the response.
These get used interchangeably in sales conversations and they are not the same thing. Two of them describe a technology, one describes who operates it, and the distinction decides what lands on your desk at four in the morning.
Extended detection and response is a product category: tooling that correlates signals across endpoint, identity, email, cloud and network instead of treating each as its own console. Buying XDR gets you the platform. Operating it is yours.
What you have bought: a capability.
Managed detection and response means somebody else watches, investigates and responds. It says nothing about how much of the estate is in scope. Plenty of MDR is endpoint monitoring with a service wrapper, which is a reasonable thing to buy as long as you know that is what it is.
What you have bought: a service, over an unspecified area.
Managed extended detection and response is the service and the scope in one word. Somebody else operates it, and the correlation genuinely spans the estate rather than one domain. The M is the part that means you are not staffing it, and the X is the part that means it is not just the endpoint.
What you have bought: both, and it is checkable.
The honest caveat is that nobody polices these labels, so the acronym on a proposal is worth less than the answer to two questions: which domains are actually correlated, and what reaches you when something fires. Ask both of any provider, including us.
Microsoft already emits nearly all of this. The work is not collecting it, it is making the six talk to each other and then having somebody read the answer.
Microsoft Sentinel is the one thing we need you to have, because it is where the six meet. Beyond that there is no required stack and no second SIEM to license.
Every provider says they respond. Almost none say what an AI SOC will do at 3am without waking you, which is the only part of the answer that matters. Autonomy is configurable per agent and per tenant, so this is a setting rather than a property of the product.
No approval, because none of it changes anything in your estate.
Inside the limits you agreed at onboarding, with every action recorded against the investigation and the reason it was permitted.
These are decisions with consequences outside the security team, so they are not automated on the managed service.
Where that line sits is configurable per agent and per tenant. It is a decision you make with us at onboarding rather than a property of the product, and it is written down before the first alert is taken.
Correlating across domains is a solved problem when everything was built by the same people on the same day. Almost nobody is in that position.
Real estates are inherited. A company buys another company and acquires its identity provider, its endpoint agent, its email tenant and its regulator along with it. The security question is not whether each of those can be monitored, it is whether an incident that crosses three of them is visible as one thing.
Revalize came to us growing by acquisition, with each acquired business arriving on its own legacy systems and under its own regime. What they needed was cover that could absorb the next acquisition without being rebuilt, which is a scope problem long before it is a tooling problem.
“Barely two weeks into our onboarding, they detected and stopped an SQL injection attack against a development server that had a vulnerability in its code… probably the best shining example of why we’ll always be a Wizard Cyber customer.”
Joe JohnsonVice President of Cloud Operations, Revalize
That engagement began before CYBERSHIELD AI carried the queue, and nothing in it is a claim about what the agents did. What has not changed is the part Joe is describing: the same 24/7 operation, the same procedures, and a senior analyst still accountable for the answer.
Buying MXDR from a Microsoft partner usually means buying Microsoft’s tooling with a service wrapper. The tooling is the same for everybody; what differs is what happens between the alert firing and you hearing about it.
That gap is where most MXDR quietly fails, because correlating six domains produces more to investigate rather than less. A human SOC handles that by rationing: low-value alerts closed fast to keep the queue moving, and the depth of any investigation depending on who is on shift. Widening the scope without changing how the work gets done just moves the bottleneck.
An AI SOC removes the rationing. Fourteen specialised agent roles carry triage, investigation, hunting, response and service operations, with 250+ named analyst skills behind them, working a nine-stage pipeline against triage procedures our own analysts wrote. Every correlated incident gets the same treatment at four in the morning as at four in the afternoon.
The stage worth knowing about is the completeness gate. It audits a finished investigation for evidence gaps, generates the steps that would close them, runs those and reassesses. It is a loop rather than a checkpoint, and it is why an investigation does not stop at the first plausible answer.
Average time to an L1 verdict is 3m 30s, measured across our own SOC. The clock starts when the signal reaches us, not when an analyst opens the ticket.
Managed extended detection and response. Extended means detection is correlated across domains rather than one signal at a time. Managed means a provider operates it for you, investigates what fires and responds, instead of handing you a platform and a login.
MDR says who does the work but not how much of the estate is covered, so plenty of it is endpoint monitoring with a service wrapper. MXDR states the scope as well: the correlation spans identity, endpoint, email, SaaS, cloud and network. The X is a claim about breadth.
XDR is a product category, MXDR is a service. With XDR you buy the correlation platform and staff it yourself, around the clock. With MXDR somebody else operates it, investigates every alert and responds inside limits you set. The technology can be identical.
Managed extended detection and response built on Microsoft security tooling rather than a vendor platform alongside it. Signals come from Defender XDR, Defender for Cloud and Entra ID, and Microsoft Sentinel is the correlation engine. There is no second SIEM to license and no duplicated data.
An AI SOC, with people accountable for it. Agents carry triage, investigation, correlation and hunting across all six domains; a senior analyst signs every customer-facing verdict before it reaches you. Extending detection across an estate produces more to investigate, not less, which is the part automation has to solve.
No. Microsoft Sentinel is the only hard requirement, because it is where the signals meet. For the rest of the estate we work with what you already run, and where a connector does not exist we build it. That building is included in the managed service.
Everything that does not change your estate: triage, enrichment, investigation to a verdict, correlation and hunting. Containment is proposed action by action and executed inside limits you set at onboarding. Anything that takes a user or system offline waits for a person by default.
Same operation, different starting point. That page is for organisations buying Sentinel as their SIEM and wanting it run properly. This one is for organisations whose question is coverage across the estate. Most customers end up with both, on one contract.
Average time to an L1 verdict is 3m 30s and to an L2 verdict 7m 50s, both measured across our own SOC. Both clocks start when a signal reaches us rather than when an analyst opens it, which is the measurement that usually gets quietly changed.
A demo against your own tenant rather than a canned one, run by an analyst rather than a salesperson. Nothing is deployed and nothing is priced before the scope is agreed in writing.
