Managed Detection and Response (MDR) for Small Business
Antivirus tells you a file looked bad. EDR shows you what a process did on the machine. Neither one calls anybody at 2am. Managed detection and response is the layer where a person reads the Defender for Endpoint alert, decides within minutes whether the odd PowerShell command on the bookkeeper's laptop is an attack, and cuts the machine off before it spreads.
The short answer
Managed detection and response (MDR) services pair endpoint detection and response software with people who watch it around the clock, investigate every alert and contain confirmed threats for you. NetSys engineers run Microsoft Defender for Endpoint, or Defender for Business where Microsoft 365 Business Premium already includes it, on every device: they triage each alert, isolate compromised machines, remove what the attacker left behind and explain in plain language what happened. MDR is included in the NetSys managed agreement or delivered on its own, remotely anywhere in the United States.
The typical small business already owns some endpoint protection. What it does not own is a person whose job is to look at the console. Defender for Endpoint raises an alert when a Word document spawns a command shell or when a sign-in token is replayed from an unfamiliar country. If nobody sees that alert until Monday, the software did its job and the business still lost the weekend. Managed detection and response puts a trained responder between the alert and the damage.
We deploy Defender for Business or Defender for Endpoint through Intune and connect every device to our monitoring queue. Businesses usually arrive from one of two places: an antivirus subscription nobody ever opened, or an EDR product so noisy the internal IT person muted it. The fix is the same. Tune the product, then put a human on shift.
Between the Alert and the All-Clear
Onboarding starts with a device inventory and a behavioral baseline: which processes are normal for your line-of-business software and which countries your people sign in from. That baseline lets us treat a high-severity alert as real instead of noise. When an alert fires, the responder reviews the device timeline and decides whether to isolate. If so, the machine is cut off from the network while our management channel stays open for cleanup, and the root cause goes into a written incident note. Your account manager calls you. No automated email.
What Is Included in NetSys MDR
EDR Deployed Properly
The sensor only helps if it is on every device.
- Defender for Business or Defender for Endpoint rolled out through Intune to Windows, macOS, iOS and Android
- Attack surface reduction rules, tamper protection and cloud-delivered protection enabled and verified
- Automated remediation tuned to act on obvious threats and hand ambiguous ones to a person
- Coverage gaps reported monthly: unenrolled machines, stale sensors, missing policies
Human Monitoring, Every Hour
Alerts go to a responder, not to a mailbox.
- Every Defender alert triaged by a NetSys engineer, weekends and holidays included
- Device timeline, sign-in logs and mail flow reviewed together, since a compromised laptop usually means a compromised account
- Escalation path documented per client: who we call, in what order, what we may do without waiting
- Alert tuning revisited monthly so the queue stays meaningful
Containment and Cleanup
Stopping the spread comes first. The report comes after.
- Network isolation of the affected device with the management channel left open
- Malicious processes killed, persistence removed, files quarantined
- Password reset, MFA re-registration and session revocation for any account the incident touched
- Root cause written up: how it got in, what it reached, what changed to prevent a repeat
Reporting and Evidence
For leadership, the insurer and the auditor.
- Monthly summary of alerts, containments and coverage in language an owner can read
- Incident notes retained as evidence for cyber-insurance applications and compliance reviews
- Findings fed into security awareness training when the entry point was a person
- Included in the all-inclusive NetSys agreement, or delivered standalone alongside in-house IT
Why Businesses Choose NetSys for Managed Detection and Response
Fifteen minutes with a NetSys engineer, not a salesperson, and you will know where your managed detection & response (mdr) stands and what it would take to fix it. Call 845-203-3914 or request a call to discuss the scope and next steps.
Who does the work: meet the NetSys team on our About page.
- A responder reads the alert at 2am and isolates the device before the first employee logs in
- Built on Microsoft Defender, which every Microsoft 365 Business Premium tenant already licenses as Defender for Business
- The same team manages your identities, email and devices, so containment covers the whole environment
- Tuned to your business, so admin tools and line-of-business apps stop producing false alarms
- Your account manager calls with a plain-language explanation, not an automated ticket
- Month to month, with no long-term contract to sign first
Managed Detection & Response (MDR) in practice
- Manufacturing
Large manufacturing plant in Virginia
Password management for 125 employees, management of 160 computers, and managed EDR antivirus across production and office devices.
- Dental practices
Multi-location dental practice
Management of 48 computers across 6 offices, endpoint protection, network segmentation, and centralized backup monitoring.
- Manufacturing
Precision machining company recovering from ransomware
Recovery and restoration of 3 servers and 45 workstations, followed by EDR deployment and immutable backup implementation.
Client names are withheld. Each card is the scope of a real NetSys engagement, as delivered.
Managed EDR and MDR: what each covers
Three things are sold under similar names. The difference is who does the work after the software raises a flag:
| What it includes | Who reads the alerts | What is left to you | |
|---|---|---|---|
| EDR software alone | A sensor on each device that records process, network and registry activity and flags behavior that looks like an attack | Whoever opens the console, which is often nobody | Deployment, tuning, triage and every response decision |
| Managed EDR | The same software deployed to every device, tuned, kept up to date and its alerts reviewed by the provider | The provider, during the hours the agreement sets | Investigation and containment, unless the agreement adds them |
| MDR | Managed EDR plus 24/7 triage, investigation, containment of confirmed threats and a written root cause | A responder, every hour of the year | Approving the escalation list and the actions the responder may take without waiting |
NetSys MDR includes the managed EDR work: Defender rolled out through Intune, tuned, and checked every month for unenrolled machines and stale sensors, with 24/7 triage, containment and a written root cause on top.
What NetSys MDR watches, and what it hands off
MDR covers the devices that carry the Defender sensor and the accounts that use them. Other log sources belong to a different service:
| Source | What the responder looks for | Where it is covered |
|---|---|---|
| Devices | Process, network and registry activity on Windows, macOS, iOS and Android, such as a Word document that starts a command shell or a PowerShell command nobody recognizes | NetSys MDR, every hour of the year |
| Accounts | Sign-ins by the people on those devices, such as a session token replayed from an unfamiliar country | NetSys MDR, reviewed with every device alert |
| The mail flow around an alert, to find the message that started it | NetSys MDR, during the investigation | |
| Firewalls, cloud applications and devices without the sensor | Activity that never reaches Defender | SOC monitoring, which collects those logs into a SIEM and is scoped separately |
For log sources beyond devices: SOC monitoring and managed SIEM.
A device without the sensor is a blind spot, which is why the monthly report lists unenrolled machines and stale sensors.
Managed Microsoft Defender for Business
Microsoft 365 Business Premium already includes Defender for Business, so many small businesses own the software and have nobody running it. What Microsoft provides, and what we add when we manage it:
| What Microsoft provides | What NetSys adds | |
|---|---|---|
| Licensing | Included in Microsoft 365 Business Premium ($22.00 per user per month, paid yearly) or sold on its own at $3.00 per user per month, paid yearly, as of October 2026 | We check the licenses your tenant already holds before anything is bought |
| Size | Built for businesses with up to 300 users and up to five devices per user; Microsoft recommends Defender for Endpoint above 300 users | We deploy Defender for Endpoint instead for larger businesses |
| Devices | Protection for Windows, macOS, iOS and Android | Rolled out through Intune, with unenrolled machines and stale sensors reported monthly |
| Protection | Next-generation antivirus, attack surface reduction, and endpoint detection and response with automatic attack disruption | Attack surface reduction rules, tamper protection and cloud-delivered protection enabled and verified |
| Response | Automated investigation and remediation that examines and responds to alerts | Automated remediation tuned to act on obvious threats and hand ambiguous ones to a person, with every alert triaged by a NetSys engineer, weekends and holidays included |
Microsoft list prices from Microsoft's Defender for Business page, as of October 2026. For managed clients our work sits inside the month-to-month agreement; on its own, MDR is quoted monthly after a short scoping call.
Who does what when an alert fires
Response ownership is settled before the first alert, so nobody has to negotiate it at 3am:
| Stage | What NetSys does | What you do |
|---|---|---|
| Triage | An engineer reads the alert with the device timeline, sign-ins and mail flow, at any hour, and closes false alarms | Nothing at the time; the totals appear in the monthly summary |
| Containment | Within the actions you pre-authorized: isolate the device, kill malicious processes and quarantine files, then reset the password, re-register MFA and revoke sessions for any account the incident touched | Approve that list of actions once, during onboarding |
| Escalation | We call the people on your escalation list, in the order you set | Keep the list current when people join, leave or change roles |
| Cleanup and root cause | Persistence removed through the management channel, and a written note on how it got in, what it reached and what changed | Keep the note as evidence for your insurer or auditor |
| Larger incidents | When an incident reaches past one device or account, scoping, recovery and coordination with your insurer and counsel follow our incident response process | Leadership and counsel make any notification decisions; we supply the facts |
The escalation list and the pre-authorized actions are documented for each client before monitoring starts.
How to choose a managed detection and response provider
Six questions to put to any MDR provider, including us, with the answer to ask for in writing:
| Ask | Why it matters | How NetSys answers |
|---|---|---|
| Who reads an alert at night, and may they isolate a device without waiting for you? | An alert at 2am helps only if someone can act on it before morning | NetSys engineers on a rotation that covers every hour of the year, with a set of actions you pre-authorize |
| Which platform does the service run on? | Many businesses already license an EDR product that nobody operates | Microsoft Defender for Endpoint, or Defender for Business where Business Premium already includes it |
| Is escalation written down by severity? | A 3am incident should not stall on who to call or what may be done | A documented escalation path for each client: who we call, in what order, and what we may do without waiting |
| What counts as containment? | Isolating one laptop does little if the stolen account still signs in elsewhere | Device isolation with our management channel left open, malicious processes killed and persistence removed, plus a password reset, MFA re-registration and session revocation for any account the incident touched |
| What will the report show, and will your insurer accept it? | Insurers and auditors ask for evidence, not assurances | A monthly summary an owner can read, and incident notes kept as evidence for cyber-insurance applications and compliance reviews |
| What happens if you leave? | The sensors, policies and alert history should not leave with the provider | Agreements run month to month, and Defender runs in your own Microsoft tenant under your licenses |
Ask for each answer in the proposal rather than the brochure, and compare what each provider may do on its own authority.
Where we deliver Managed Detection & Response (MDR)
Managed Detection & Response (MDR) in New York City · Managed Detection & Response (MDR) in Westchester County · Managed Detection & Response (MDR) in Nassau County, NY · Managed Detection & Response (MDR) in New Jersey · Managed Detection & Response (MDR) in Stamford, CT. We also support clients remotely wherever their systems run. See all locations and service areas.
Managed Detection & Response (MDR) FAQs
What is managed detection and response?
Managed detection and response is a service that pairs endpoint detection and response software with a team that watches it 24/7, investigates each alert and contains confirmed threats. The people decide whether the flag is real, isolate the machine if it is, clean up and explain what happened. NetSys delivers MDR on Microsoft Defender for Endpoint.
Why choose managed detection and response?
Because detection software only raises a flag, and attacks do not wait for office hours. Few small businesses have anyone whose job is to watch an EDR console at night, so an alert at 2am sits until Monday while the attacker moves from one laptop to the next account. MDR puts a responder on that alert, with authority you agreed in advance to isolate the device and lock the account, without hiring a security team of your own.
What is included in managed detection and response services?
At NetSys: Defender deployed through Intune to every Windows, macOS, iOS and Android device and tuned to your software; every alert triaged by an engineer, weekends and holidays included; containment of confirmed threats, meaning device isolation, malicious processes killed, persistence removed, and a password reset, MFA re-registration and session revocation for affected accounts; a written root cause for each incident; and a monthly summary of alerts, containments and coverage gaps that an owner can read.
What is the difference between MDR, EDR and antivirus?
Antivirus blocks files it recognizes as malicious. EDR records process, network and registry activity on each device and flags behavior that looks like an attack, even when the file is new. MDR adds the people: a monitored queue, investigation and containment. Many small businesses buy EDR and never open the console, which leaves them with expensive antivirus.
Who watches the alerts at night and on weekends?
NetSys engineers do, on a rotation that covers every hour of the year. The Defender alert reaches a person who can see the device timeline and the user's sign-in history, decide whether to isolate the machine, and act without waiting for morning. Each client has a documented escalation list and a pre-authorized set of actions, so containment does not stall on a 3am phone call.
Who handles support and escalations?
NetSys engineers triage every MDR alert around the clock and follow the escalation list you approve during onboarding: who we call, in what order and what we may do without waiting. If an incident reaches past one device or account, we tell you so and the work moves to incident response: scoping, recovery and coordination with your insurer and counsel. Everyday questions about the service go to our help desk, staffed seven days a week from 4 a.m. to 11 p.m. Eastern.
Do we need MDR if we already have Defender for Endpoint?
You need someone to operate it. Defender for Endpoint is the sensor and the response toolkit, but it does not investigate its own alerts or decide when to isolate a machine. If your internal IT person reads the console during business hours, you are covered for roughly a quarter of the week. MDR covers the rest and brings the tuning that makes the console worth reading.
How much does managed detection and response cost?
For NetSys managed clients it is included in the all-inclusive month-to-month agreement, a flat monthly fee per user. Businesses with in-house IT that want MDR alone receive a standalone monthly quote after a short scoping call. The quote moves with the number of devices and operating systems to cover, the Microsoft licenses you already hold, whether you are above the 300 users Defender for Business is built for, and how much tuning the current setup needs before its alerts mean anything. Defender for Business comes with Microsoft 365 Business Premium, which often means no extra software purchase; on its own it lists at $3.00 per user per month, paid yearly, as of October 2026.
What is managed EDR?
Managed EDR is endpoint detection and response software that a provider runs for you: deployed to every device, tuned, kept up to date and its alerts reviewed. MDR adds the response: 24/7 triage, investigation, containment of confirmed threats and a written root cause. NetSys MDR includes the managed EDR work on Microsoft Defender, so you do not buy the two separately.
What should we ask an MDR provider?
Ask who reads an alert at night and whether they may isolate a device without waiting for you, which platform the service runs on and whether you already license it, how escalation is written down, what counts as containment, what the monthly report shows and what happens to the console and your data if you leave. Get each answer in the proposal.
How do we get started with MDR?
Start with a short scoping call about device count, operating systems and the Microsoft licenses you already hold. Onboarding then begins with a device inventory and a configuration review: which machines have the Defender sensor, which protections are on, and what normal looks like for your line-of-business software. Defender is rolled out through Intune to anything missing it and tuned against that baseline, and the escalation list and pre-authorized actions are documented with you before 24/7 triage starts. Call 845-203-3914 or use the contact page to book the scoping call.
Guides on this topic
Someone reads the Defender alert at 2am.
Defender raises the flag. The gap is the person who reads the console. Onboarding starts with a device inventory and a baseline of what normal looks like on your line-of-business software, so a real alert is not buried. When one fires, the responder isolates the machine and your account manager calls you.