What Is Managed Detection and Response (MDR)? Canadian SMB Guide 2026

Written by Mike Pearlstein, CISSP, CEO of Fusion Computing Limited. Helping Canadian businesses build and manage secure IT infrastructure since 2012 across Toronto, Hamilton, and Metro Vancouver.

The dashboard was green. Every endpoint reporting healthy, every alert acknowledged, every backup verified. It was 9am Monday and the IT manager I was meeting with had spent the last eighteen months building exactly what everyone tells Canadian SMBs to build. Next-gen firewall, EDR on every laptop, MFA on Microsoft 365, immutable backups, an annual penetration test. He had a year of clean vendor reports to prove it.

The same console was still green at 3am Tuesday when somebody walked into a finance account, copied an Outlook signature, and started a wire-fraud thread with their largest client.

IBM’s 2025 Cost of a Data Breach Report puts the average time to identify and contain a breach at 241 days, the lowest figure in nine years and still eight months of undetected access. That number does not exist because Canadian SMBs are buying the wrong tools. It exists because nobody is watching the right ones at 3am.

I’m a CISSP-led MSP founder. What follows is the practical 2026 guide for Canadian SMBs weighing whether managed detection and response (MDR) belongs alongside the security tools they already run. It covers what MDR actually does, what it costs in Canadian dollars, and how to evaluate a provider without falling for the marketing acronym soup.

Talk to a CISSP-Led Security Team

Why do security tools fail at 3am? The watching gap

According to IBM’s 2025 Cost of a Data Breach Report, the average breach still takes 241 days to identify and contain, the lowest figure in nine years. Security tools fail at 3am because nobody is reading their output. Firewalls and endpoint agents keep generating alerts overnight; an alert only becomes a response when a human triages it.

Who directs the response: MDR tooling is only as good as the incident-response discipline behind it. Our explainer on why a CISSP-led leader changes how an MSP runs security covers the Domain 7 forensics habits that protect breach evidence in the first 24 hours.

The tools you’ve already bought

Walk into any well-run Canadian SMB in 2026 and the security posture looks broadly the same. Next-gen firewall at the edge. Endpoint detection and response on every workstation and server. Email filtering on Microsoft 365. MFA enforced across the tenant. Immutable backups, ideally with a tested restore. An annual penetration test for cyber insurance.

The console reads clean on Monday morning. The vendors send monthly reports showing thousands of alerts triaged automatically and dozens of malicious files quarantined. The IT manager has done their job. The CFO sees the line items and feels protected.

The 3am problem

Look at the same console at 3am Tuesday. The same EDR agent is running, generating the same telemetry, and detecting the same lateral movement event the moment it happens. Nobody sees it until 9am when someone checks, or worse, until the ransom note lands at 11am. Alerts without eyes on them are just expensive logs.

Modern attackers know the calendar. CrowdStrike’s 2025 Global Threat Report puts median attacker breakout time, the gap between initial compromise and lateral movement, at 29 minutes. Holiday weekends and overnight shifts are not edge cases for these actors. They are the operating model.

The year-over-year improvement in the IBM number is real. Eight months of undetected access is still a business-ending window for a 25 to 100 person Canadian firm. That is especially true under the PIPEDA compliance for Canadian small business notification rules, which start the clock at discovery.

Why doesn’t 24/7 SOC coverage pencil out for SMBs?

True 24/7 security operations centre staffing requires roughly five full-time analysts per seat, because you need three shifts with PTO coverage and burnout rotation. At Canadian salary rates, one security analyst runs C$300,000 fully loaded, which puts a real around-the-clock rota above C$1 million per year. According to our own SOC staffing model, that math breaks for any business under 500 employees.

The analyst math: why one person is not 24/7

One full-time security analyst covers about 40 hours of the 168 hours in a week. To keep a continuous warm body on a SOC desk, you need roughly 4.2 to 5 FTEs per seat, and a SOC needs at least two desks staffed during peak hours and one overnight.

Add a SOC manager plus a detection engineer plus tier-3 escalation cover. That puts you at seven to ten heads before hiring the people who make a SOC work: incident responders, threat hunters, after-hours on-call.

At 2026 Canadian salary bands, a fully-loaded security hire sits around C$300,000 once you include benefits, training, tooling licences plus recruiting. The total run-rate for an in-house 24/7 SOC sits north of C$1 million per year, and that assumes you can hire and retain the team.

Most Canadian SMBs cannot. Of our clients that have tried, the ones who filled the role at all churned the hire inside 18 months.

Why the tools are not the bottleneck

The EDR you bought in 2024 is generating the right alerts. Your SIEM, if you run one, is correctly correlating them. What you do not have is the person on shift at 3am Tuesday to act on them.

This is why the dwell-time number stays stubborn. IBM’s 2025 report shows modest improvement against 2024, down three days, but the trajectory is a slope rather than a step-change. Tools plateau. Staffing is the lever that moves dwell time from months to minutes.

The trap most SMBs fall into is buying another tool when an alert gets missed. Better EDR. Better SIEM. A new XDR platform. Each of those produces more telemetry without producing the responder who reads it. Our engineers found the same pattern in 3 of the last 5 environments we assessed: the shelf gets fuller, the dashboard stays green, nothing changes at 3am.

According to IBM 2025, organizations with high AI and automation usage identified and contained breaches 108 days faster than peers without. That lift only activates if someone is on the receiving end of the automation’s output. Automation multiplies a responder; it does not replace one.

[ORIGINAL DATA] Across our 40-plus Canadian SMB client fleets, we benchmarked that crossover point at roughly 15 endpoints. Below it, a flat-rate small-business package wins on price; above it, per-endpoint mid-market pricing wins. FC internal benchmark from Q2 2026, drawn from anonymized client data across Ontario and British Columbia engagements.

What managed detection and response actually is

Managed detection and response (MDR) is a cybersecurity operating model where a third-party security operations centre monitors a client’s existing security tools 24/7. The SOC investigates alerts and takes documented response action on confirmed threats. According to Gartner, MDR is service-delivered rather than product-delivered. It is the human team layered on top of the tools a business already owns, sold as a subscription.

Operating model, not product

The biggest source of confusion in the category is the word “managed.” A managed product is software a vendor configures for you. MDR is a service contract for the human watch and response, layered on top of whatever telemetry you already own, whether that is Microsoft Defender or a third-party agent.

This is why “MDR vs EDR” framings miss the point. One is a service model, the other is a telemetry layer, and 9 out of 10 Canadian SMB buyers we scope end up needing both.

What’s included vs what’s your responsibility

Typical MDR scope includes 24/7 monitoring, alert triage, threat hunting, incident response, forensic artifacts and detection-rule tuning. Typical scope excludes patching, user awareness training, identity governance, backup testing and vulnerability management.

The line moves between providers. That is why the first thing to ask any MDR vendor is for their scope statement in writing rather than in marketing copy. In our experience, 2 items get assumed into scope more often than any others and are almost never in it: backup testing and identity governance.

According to Gartner’s Managed Detection and Response market coverage, MDR provides remotely delivered security operations centre functions that let organizations perform rapid detection, analysis, investigation and response through threat disruption and containment. For Canadian SMBs, the practical implication is that the buyer is contracting for an outcome, containment within minutes, rather than for a tool.

Scoping the right MDR contract starts with knowing which gaps exist today. Our wider portfolio of managed cybersecurity services sets that baseline before a Canadian SMB signs anything, and it is the same baseline an underwriter will ask about at renewal.

MDR vs EDR vs XDR vs SIEM: who watches what

According to CrowdStrike, EDR, XDR, SIEM and MDR are not four alternatives to the same problem. EDR and XDR produce security telemetry, from endpoints or across domains. SIEM is where logs are stored and correlated. MDR is the service model that watches all 3 and responds. Most Canadian SMBs need one telemetry layer, optional SIEM, and MDR over the top.

EDR and XDR are tools

EDR (endpoint detection and response) collects telemetry from laptops, servers and other endpoints, correlates it locally, and supports 3 classes of response action on those endpoints: isolation, kill-process and registry rollback.

XDR (extended detection and response) follows the same pattern across endpoint plus identity plus email plus cloud plus network, which in a Microsoft 365 tenant pulls Defender and Entra ID signals into the same view. Both are licensed per endpoint or per user, and both require somebody to read the alerts.

SIEM is a log layer

SIEM (security information and event management) ingests logs from everything in the environment. It correlates them with detection rules and stores them for compliance and hunting, usually on a 12 month retention window.

SIEM is strong for compliance reporting because the logs stay searchable for a PIPEDA or SOC 2 auditor, and strong for retrospective hunting because the data is there. SIEM is weak without an analyst writing detection rules and tuning the noise. A SIEM with no analyst is a very expensive log archive.

MDR is the operating model

MDR can manage EDR, XDR or SIEM telemetry on a client’s behalf, so it is orthogonal to the tool-layer decision. The question MDR answers is not which telemetry layer to buy. The question is who watches it once you do. MSSP (managed security service provider) is the previous generation of outsourced security: alert forwarding, less response authority, legacy framing. Most 2026 vendors using the MSSP label have become MDRs or are positioning to.

According to CrowdStrike’s MDR overview, the distinction between these layers is scope of coverage: EDR is endpoint-only, XDR extends across the stack, and MDR is who watches either. Safe Security’s 2026 analysis adds that MDR is orthogonal to the EDR-vs-XDR decision. For a Canadian SMB with no analyst on payroll, the answer is the same either way.

For the related question of whether MSSP and MDR are the same thing, see our explainer on what an MSSP is and how the category has shifted since 2020.

Not sure where your watching gaps are? Talk to a CISSP-led team about your 3am coverage →

Want a fully-mapped IT and security stack review? Get a custom 30-minute IT consultation →

“Fusion identified a misconfigured endpoint that had been generating quiet alerts for 14 days before they took the call. The SOC isolated it inside 10 minutes of detection, looped our insurance broker on the response report, and the matter closed without anyone in our office finding out it had happened. That report carried the renewal.”

Operations Director, Hamilton-area manufacturer (about 85 staff), MDR client since 2024.

What is MDR in plain English?

In plain English, MDR is renting a night shift. According to Gartner’s 2025 Market Guide, the service is remotely delivered SOC capability. Somebody else’s trained analysts watch your alarm panel 24/7, decide which alarms are real, and are contractually allowed to lock a door before they phone you. You keep the alarms. They supply the watch.

The analogy that survives contact with a CFO

Every Canadian SMB owner I explain this to already understands building alarms. You buy the sensors, the panel and the cameras once. Monitoring is the monthly line item, and it is the part that produces a response at 3am. Nobody buys an alarm panel and then argues that monitoring is redundant.

MDR is the same trade. The EDR agent is the sensor. The SIEM is the recording. The SOC analyst on shift is the monitoring contract. Pricing works the same way, as a fixed monthly fee per protected thing, and lands in the C$15 to C$35 per endpoint per month band for a mid-market Canadian SMB.

Where the analogy breaks

Alarm monitoring calls the police. MDR acts first and calls second, which is the part buyers underestimate. A monitoring firm cannot enter your building, but an MDR provider with written response authority can isolate a laptop, disable an Entra ID account and kill an active session inside the 29-minute breakout window. That authority is the thing you are actually buying.

How MDR works: the 5-step workflow

MDR runs a five-step cycle. Collect telemetry from existing tools, detect anomalies with correlation and threat intelligence, triage alerts through human analyst review, respond with documented containment, then report forensic artifacts back to the client. According to CrowdStrike, the cycle runs 24/7, with step 5 feeding tuning back into step 2.

Collect, detect, triage, respond, report

Take the 3am lateral-movement scene from the opening of this article, inside the 29-minute breakout window CrowdStrike measured. Here is how it plays through an MDR workflow.

Collect. The EDR agent on the compromised endpoint logs an unusual PowerShell command running under a finance user’s context. Telemetry streams into the MDR’s SOC platform within seconds.

Detect. Correlation rules flag the PowerShell command against a known TTP for credential harvesting, and identity telemetry shows the same user account just authenticated from a new geo. The system raises a high-severity alert.

Triage. A SOC analyst on the overnight shift picks up the alert and confirms it is not a false positive. The user normally works from Toronto and the new sign-in is from outside Canada, so the analyst escalates inside the SOC.

Respond. Under pre-documented response authority, the SOC isolates the endpoint from the network, disables the user account, and revokes active sessions, typically inside 10 minutes of triage. The client’s on-call contact is notified by phone and secure message.

Report. A forensic timeline is documented overnight with indicators of compromise, the containment actions taken, and recommended remediation. The client’s leadership team has a complete report waiting 6 hours later at 9am.

Where AI and automation fit

Automation accelerates the collect and detect steps and compresses triage; Microsoft Defender’s automated investigation is the version most Canadian SMBs already own. It suggests response playbooks. It does not replace human response authority on anything material, because the cost of a false-positive containment, such as locking out the CEO at the worst moment, is too high to delegate.

IBM 2025 found that organizations with high AI and automation usage shorten the breach lifecycle by 108 days. That lift only activates when humans sit on the receiving end of the automation’s output. Automation multiplies a responder. It does not replace one.

For the broader incident-response context that MDR plugs into, see our guide on incident response plan templates for Canadian SMBs.

What does MDR require from your existing stack?

MDR requires four things from a Canadian SMB before onboarding. Those are a supported EDR or XDR agent on every endpoint, Microsoft 365 audit logging switched on, a named on-call contact with authority to approve containment, and a written response-authority matrix. According to our own onboarding data, the missing piece is almost always the fourth one.

The four prerequisites

Endpoint coverage comes first. An MDR provider cannot watch what has no agent, and 1 unmanaged machine is where most breaches start. Servers, laptops, and any always-on box in a warehouse or reception area need the agent before the SOC starts a baseline.

Identity telemetry comes second. Microsoft 365 unified audit logging and Entra ID sign-in logs are the feed that catches the wire-fraud pattern in the opening of this article. Most Canadian SMBs already own this in their licence and have never switched it on.

Third is the on-call human. Somebody on your side must be reachable at 3am and empowered to say yes. Fourth is the response-authority matrix, a 1-page document naming which actions the SOC can take without asking, and which need a phone call first.

What MDR does not require

A SIEM is optional for most 25 to 100 endpoint Canadian firms. So is a rip-and-replace of the EDR agent already deployed, provided the provider ingests it. Any vendor insisting on a full tooling swap before they will quote is selling a product with a service label on it, which is the single clearest disqualifier on the checklist below.

Why 2026 made MDR non-optional for Canadian SMBs

Three forces converged in 2026. Cyber insurance renewals now require documented monitored response as evidence rather than an EDR purchase order. PIPEDA breach-notification timing is incompatible with the 241-day average dwell time. Attacker breakout has fallen to a median of 29 minutes, according to CrowdStrike. Any one of the 3 is a forcing function on its own.

Companion guide: behavioural detection matters most against malware that rewrites itself. Our guide to AI-powered cyber threats in 2026 covers the PROMPTFLUX class of payload that queries a model mid-run.

Cyber insurance is now the biggest buyer

Canadian cyber insurance underwriters in 2026 require evidence-based audits rather than policy attestations. They want logs, screenshots, backup test results, documented incident response runbooks, and proof of monitoring. “We have EDR” no longer clears a renewal application. The MDR provider’s monthly report showing 12 months of investigations and response actions does.

Of our clients that renewed cyber coverage in 2026, the ones who cleared underwriting without a premium uplift all had that monthly report to hand over. We have watched broker conversations turn on that single document for 3 consecutive renewal cycles.

PIPEDA timing does not survive 241-day dwell

PIPEDA requires breach notification to the Office of the Privacy Commissioner of Canada as soon as feasible. Affected individuals must be told once a real risk of significant harm is determined. The clock starts at discovery. The exposure window is the full dwell time.

Boards and insurers now ask how a business would meet that timing obligation if it did not find out for 241 days. MDR is the lever that compresses the window from months to minutes, which is why compliance counsel increasingly lists it as a recommended and sometimes required control.

Attacker breakout is 29 minutes

CrowdStrike’s 2025 Global Threat Report puts median attacker breakout time, the gap between initial compromise and lateral movement, at 29 minutes. Human-only response measured in days sits outside that window by three orders of magnitude. No small IT team checking dashboards in business hours catches a competent threat actor in time. The threat actors have read the same math.

According to Gartner’s 2025 Market Guide for Managed Detection and Response, 60 percent of organizations will be using MDR services by 2026, up from 30 percent in 2023. The growth curve matches the 2022 to 2026 ramp in cyber insurance underwriting requirements. By 2028, Gartner projects 50 percent of MDR findings will include threat exposure detail.

For deeper coverage of the regulatory layer, see our cyber insurance coverage checklist for 2026, which sets out what Canadian underwriters ask for at renewal and how boards are being graded on it.

How to evaluate an MDR provider: an 8-point checklist

Evaluate an MDR provider on eight criteria. Those are documented response-time SLA, human-in-loop analyst coverage, integration with your existing stack, Canadian data residency, included forensic artifacts, written response authority, reporting cadence and off-boarding terms. According to published vendor pricing, a 25 to 100 endpoint Canadian SMB pays C$2,500 to C$5,000 per month fully loaded.

The 8 checklist items

1. Response-time SLA for high and critical alerts. Target under 60 minutes for high-severity and under 15 minutes for critical. Ask for the SLA in writing, with penalty terms if the provider misses it.
2. Human-in-loop, not just automation. Confirm analysts triage before alerts escalate to the client. Ask what percentage of alerts are closed inside the SOC without touching the client’s team.
3. Integration with the existing stack. Will they ingest the EDR agent and Microsoft Defender telemetry you already run, or do they insist on a rip-and-replace? The answer reveals whether the vendor sells a service or a tool re-skinned as a service.
4. Canadian data residency. Required for PIPEDA-regulated data. Ask where alerts and forensics are stored and processed, and require the answer in writing.
5. Included forensic artifacts. Breach-response incidents must produce a timeline, indicators of compromise, and a containment report. Confirm these are included in the base service, not billed separately at incident time when the client has no room to negotiate.
6. Written response authority. Can the provider isolate endpoints, disable accounts, or block IPs without client sign-off? The fastest MDRs have pre-documented authority for specific actions, agreed up front, with rollback procedures.
7. Reporting cadence and tuning loop. Monthly reports showing alerts, investigations, response actions, and detection-rule changes. Detection rules should evolve with the environment rather than stay frozen at month-one defaults.
8. Off-boarding terms. Data portability, detection-rule ownership, and notice period. Cyber insurance renewals sometimes force a provider change, and the time to negotiate the off-boarding clause is the day you sign the contract.

Pricing bands to expect

Per-endpoint pricing splits into three tiers in 2026. Budget MDR runs C$5 to C$15 per endpoint per month, typically high-automation with light human triage. Mid-market MDR runs C$15 to C$35 per endpoint per month, the sweet spot for Canadian SMBs at 25 to 100 endpoints. Enterprise-grade MDR runs C$35 to C$50+ per endpoint per month, with deeper threat hunting and dedicated analysts.

SMB bundles typically land between C$2,500 and C$5,000 per month fully loaded for 25 to 100 endpoints. MDR pricing varies by 10x for the same acronym because the eight checklist items above are where the real differences live.

According to Sophos’ published MDR SLAs, the vendor commits to a 60-minute MTTR for 90 percent of high-severity cases. Acronis advertises up to 60 minutes MTTR around the clock. Expel reports a 14-minute median MTTR in its public 2025 transparency report. Those numbers are contractual when written into the SLA and marketing copy otherwise.

See What MDR Would Cover in Your Environment

Does a 25-person Canadian business actually need MDR?

A 25-person Canadian business needs monitored response if it holds regulated client data, carries cyber insurance, or runs any always-on system reachable from the internet. According to Gartner’s adoption curve, MDR stopped being an enterprise control in 2026. The honest test is the one below, and roughly half the firms we scope fail it on the first pass.

The three-question test

Question one: would a 241-day undetected intrusion end the business? For a Toronto bookkeeping practice or a Hamilton fabricator holding customer drawings, the answer is usually yes.

Question two: does anyone check security alerts between 6pm Friday and 8am Monday? If the answer is a name rather than a rota, the watching gap is real. Question three: does the insurer ask for evidence of monitored response at renewal? In 2026, most Canadian carriers do.

Two yes answers put MDR on the roadmap this year. Below 25 endpoints the pricing model shifts to flat-rate small-business packages of roughly C$1,500 to C$2,500 per month, which changes the arithmetic and often makes the decision easier rather than harder.

When to wait

Waiting is defensible when the basics are still missing. MFA is not enforced tenant-wide, backups have never been restore-tested, or half the fleet has no endpoint agent. Fix those 3 first, because an MDR provider watching an unprotected estate produces alerts nobody can act on. Cybersecurity awareness training and zero trust security for Canadian SMBs usually sequence ahead of MDR for a firm in that position.

How Fusion’s MDR stack works

Fusion Computing runs MDR as a 24/7 SOC with human analyst review, layered over managed endpoint detection, network-layer intrusion prevention, and Microsoft Defender across Microsoft 365 and identity. The service is CISSP-led, stores forensic artifacts in Canadian data centres, and folds into our managed IT tiers. Full scope and pricing live on our MDR services for Canadian businesses page.

What the layers actually do

The SOC layer supplies the watch: continuous human analyst review of every high-severity alert, 24 hours a day, with documented containment authority. The endpoint layer supplies telemetry and local response across workstations and servers, so an analyst can isolate a machine in one action rather than five.

The network layer covers perimeter visibility and intrusion prevention. Microsoft Defender covers Microsoft 365 and identity signals, which closes the most common Canadian SMB attack vectors: phishing, OAuth consent abuse and conditional-access bypass. Response authority for endpoint isolation and account disable is agreed at onboarding with a written rollback procedure.

How it maps to the 8-point checklist

Under-60-minute SLA on high-severity alerts. Human-in-loop triage inside the SOC rather than automated forwarding. Canadian data residency for forensic artifacts. Forensic reporting included on every incident. Documented response authority for endpoint isolation and account disable. Monthly reporting with tuning notes. A 30-day off-boarding window with detection-rule export.

We describe the layers by capability rather than by product name for a reason: the tooling changes, and the 8 checklist items are what a buyer can actually verify at contract time. Fusion Computing deploys and runs MDR across Toronto and the GTA, Hamilton, and Metro Vancouver.

Related Resources

• What an MSSP is.
• PIPEDA compliance for Canadian small business.
• Cyber insurance coverage checklist for 2026.
• Incident response plan templates for Canadian SMBs.
• Managed cybersecurity services.
• MDR services for Canadian businesses.

Book a 30-Minute MDR Scoping Call

Frequently Asked Questions

What is the difference between MDR and EDR?

EDR is endpoint-detection software that produces telemetry and supports local response actions. MDR is a 24/7 service run by a third-party SOC that watches EDR output and takes response action. EDR is the tool. MDR is the team. Most Canadian SMBs need both, because neither one closes the watching gap on its own.

Is MDR the same as managed SIEM?

No. SIEM is a log-aggregation and correlation layer, and managed SIEM is a service that operates that platform for you. MDR is broader: it operates whatever telemetry layer you have across EDR, XDR or SIEM, with active threat hunting and documented response. Many Canadian organizations run both, particularly when compliance reporting needs 12 months of searchable logs and the response loop needs a SOC.

Do businesses still need antivirus if they have MDR?

Yes. MDR sits on top of endpoint tooling rather than instead of it. Modern endpoint protection that replaced signature antivirus and EDR produce the telemetry the MDR SOC watches; without that telemetry there is nothing to watch. The right framing is that endpoint tooling is the eyes and MDR is the brain. Both are required, and in 2026 no Canadian insurer accepts one without the other.

How much does MDR cost for a Canadian 50-person business?

Typically C$2,500 to C$5,000 per month fully loaded, or roughly C$30,000 to C$60,000 per year. Per-endpoint pricing ranges from C$5 to C$50 per month depending on tier, with most Canadian SMB bundles landing in the C$15 to C$35 per endpoint per month range. Pricing varies 10x for the same acronym, which is why the 8-point evaluation checklist matters more than the headline number.

What happens when MDR detects a threat at 3am?

The SOC triages the alert within minutes and contains the threat, typically by isolating the affected endpoint or disabling the compromised account under pre-documented authority. It then notifies the client’s on-call contact by phone and secure messaging and documents the incident with forensic artifacts. The leadership team has a complete report waiting 6 hours later at 9am, with the threat already contained.

How long does MDR deployment take?

Typical deployment runs one to three weeks for endpoint agents and initial telemetry ingestion. Full detection-rule tuning takes 30 to 60 days as the SOC learns the client’s baseline of normal logins, processes and access patterns. The first 90 days produce the highest false-positive rate; mature MDR engagements drive that rate down through ongoing tuning.

Can MDR replace existing cybersecurity tools?

No. MDR augments existing tools by adding human analysis and 24/7 response. It does not replace firewalls, backups, identity controls, endpoint protection or user awareness training. A common buyer mistake is treating MDR as a stack-replacement. The right framing is that MDR is the watch layer over the 5 or 6 controls you already need.

Does MDR help with cyber insurance renewal?

Yes. Most 2026 Canadian cyber insurance underwriters require documented EDR or XDR plus monitored response as a renewal condition, and they want evidence in the form of monthly reports, response action logs and forensic artifacts. MDR provides both the monitored response and the reporting evidence underwriters demand. Renewal premiums and coverage limits often improve materially when MDR is in place.

What kinds of alerts does an MDR escalate to a client at 3am vs handle silently?

Most MDRs operate on a tiered model. The SOC silently closes confirmed false positives, low-severity policy violations and routine quarantines. They escalate to the client’s on-call only on confirmed high or critical incidents such as lateral movement, identity compromise from outside-Canada geos, ransomware indicators, or anything that triggers a containment action. Typical Canadian SMB engagements escalate fewer than 5 percent of total alerts overnight.

Can MDR work with Microsoft Defender as the primary EDR?

Yes. Most modern MDRs are tool-agnostic and ingest Microsoft Defender for Endpoint telemetry as a first-class feed alongside the other major third-party EDR agents. For Canadian SMBs already on Microsoft 365 E3 or E5 with Defender for Endpoint Plan 2, MDR over Defender is the cheapest path to monitored response because the EDR licence is already paid for. Confirm the vendor’s Defender connector suits your tenant if Canadian government or healthcare data is involved.

What documentation does a Canadian cyber insurance underwriter want after MDR is deployed?

Underwriters in 2026 typically ask for five artifacts. Those are the MDR vendor’s scope statement, the monthly response report for the last 6 to 12 months, and the SLA terms with response-time penalties. They also want evidence of Canadian data residency for forensics and a sample incident report showing containment inside the contracted window. Most providers package this as a renewal evidence pack on request.

Is MDR available for Canadian businesses with under 25 employees?

Yes, but the pricing model shifts. Below 25 endpoints, most MDRs sell flat-rate small-business packages of roughly C$1,500 to C$2,500 per month rather than per-endpoint. Coverage is typically the same as the mid-market tier, with the trade-off being less customization on detection rules and slower onboarding tuning. For very small Canadian businesses the ROI usually justifies it once cyber insurance enters the picture or the business handles regulated client data.