MDR, SIEM, SOC and EDR — in plain English

Security proposals lean heavily on acronyms, and the acronyms overlap enough that it is genuinely hard to tell whether two quotes describe the same thing. They usually do not. Here is the plain version.

EDR — the sensor on the device

Endpoint Detection and Response is software on your laptops and servers. It watches process behaviour rather than matching known virus signatures, so it can catch things it has never seen before. On its own it produces alerts. Somebody still has to read them.

SIEM — the place logs go

Security Information and Event Management collects logs from across the estate — endpoints, firewalls, cloud tenancy, identity — and correlates them. Its value is joining dots that look harmless alone: a failed login here, a new admin account there. Also produces alerts. Also needs somebody to read them.

SOC — the people

A Security Operations Centre is the analysts. Buying tooling without analysts is the single most common mistake in this space: you end up with an expensive alert generator and nobody to triage it. Very few businesses below enterprise scale run their own, which is why most buy it as a service.

MDR — the whole thing, delivered

Managed Detection and Response is the bundle: EDR on the devices, a SIEM collecting the logs, and a SOC of humans watching and acting. The distinguishing feature is the R. A service that notifies you and waits is monitoring, not response. Ask specifically what actions the provider will take without calling you first — isolating a host, disabling an account — and get it in writing.

Which first?

If you have none of it, EDR with someone genuinely watching it beats a full SIEM nobody reads. Coverage of the basics — MFA everywhere, patching discipline, tested backups — beats all of it. Sophisticated detection layered on top of unpatched systems is an expensive way to watch yourself get breached.