Managed detection and response (MDR) is a security service that monitors an organisation’s systems around the clock, investigates suspicious activity and responds to threats on its behalf, without the organisation needing its own security operations centre (SOC).
For SMEs and scale-ups, MDR is only as good as the data it can see. A single alert rarely tells the full story. The surrounding signals decide whether an event is routine or dangerous. This guide explains how MDR works across endpoint, email, identity and cloud tools, what to ask any MDR provider, and how HOPLONai’s agentic MDR answers those questions.
Why does managed detection and response need connected security data?
The UK’s National Cyber Security Centre says security monitoring “allows for the active detection of threats and potential security incidents”. The catch is that most organisations monitor each tool separately. EDR watches endpoints. Email security checks messages and attachments. Microsoft 365 or Google Workspace holds sign-in data. Cloud storage holds business files. Each one sees only part of an incident.
EDR monitors endpoints. Email security checks messages and attachments. Microsoft 365 or Google Workspace provides identity and sign-in data. Cloud services contain business files and sensitive information.
The problem is that each system sees only part of an incident.
Take a suspicious file on a laptop that contacted an unusual domain. On its own, that is one EDR alert. The investigation only becomes clear when someone also checks:
- where else the same file has appeared
- which domains it contacted
- whether employees received emails from those domains
- whether the same users had unusual sign-ins
- whether other devices show similar behaviour
Answering those questions by hand means opening four or five consoles. MDR exists to do that joining-up for you.
This is where connected security integrations become operationally important.
How an MDR investigation works, step by step
- Detect. A connected tool raises an alert, such as an EDR detection on a laptop.
- Enrich. The alert is expanded with context from other tools: file sightings, contacted domains, sign-in logs and device vulnerabilities.
- Correlate. Related events are linked into one investigation instead of staying as separate alerts.
- Decide. An analyst chooses a response and whether it needs the customer’s approval.
- Respond and record. The action runs, such as isolating the device, and the outcome is reported.
In traditional MDR, human analysts at the provider carry out steps 2 to 4. In agentic MDR, AI analysts carry them out, and people approve the actions that matter.
Our guide to connecting your security stack without adding more noise explores the wider problem of disconnected security tools.
What does each tool add to an MDR investigation?
| Tool | What it sees | What it adds to the investigation |
|---|---|---|
| EDR | Detections, file hashes, contacted domains, device vulnerabilities | The starting point: what happened on the device, and where else it happened |
| Email security | Messages, senders and attachments | Who was targeted, and whether the threat arrived by email |
| Identity (Microsoft 365, Google Workspace) | Sign-in logs | Whether an account may be compromised as well as a device |
| Cloud storage (Google Drive, OneDrive) | Sensitive data in stored files | Whether business data is exposed |
Five questions to ask any MDR provider
- Who investigates alerts: people, AI, or both?
- Which of our existing security tools does the service work with?
- Which actions can it take without our approval, and can we control that?
- Can we see a record of every action proposed and taken?
- What does it cost to start, and how does it scale as we grow or, for MSPs, add clients?
How HOPLONai’s agentic MDR answers those five questions
HOPLONai delivers agentic MDR (agentic managed detection and response): AI analysts monitor your systems 24/7, investigate and connect alerts across your security tools, and take action to stop threats, with a person approving anything high-risk.
1. Who investigates alerts?
HOPLONai’s AI analysts investigate alerts across connected modules and vendor data rather than one alert at a time. Each starting signal pulls in context from another tool:
| Starting signal | Context HOPLONai adds |
|---|---|
| Suspicious file hash | Every other host in the tenant where the file has appeared |
| Endpoint detection | Domains the device contacted |
| Suspicious domain | Users who received email from that domain |
| User activity | Microsoft or Google sign-in context |
| Device inventory | Per-device vulnerability information |
The file-hash and endpoint-to-email workflows are live today. In internal HOPLONai testing, a full investigation that takes a human analyst around 45 minutes was completed by HOPLONai’s AI analysts in under 5 minutes, roughly nine times faster. People stay in charge of the decisions that matter, and lean teams dealing with security alert fatigue gain capacity without hiring a SOC team.
2. Which of our existing tools does it work with?
HOPLONai connects to the security tools you already run, including CrowdStrike, SentinelOne, Bitdefender, Microsoft Defender, Trend Micro, Trellix, Sublime, Microsoft 365, Google Workspace, NinjaOne, DefensX and usecure. See the full list of HOPLONai integrations.
Where there are gaps, HOPLONai’s own modules fill them:
- Endpoint Security / EDR for laptops, desktops and servers
- Email Security
- Browser Security
- Human Risk, which spots and trains risky staff behaviour
- External Exposure Monitor, which shows what attackers can see about your business online
- Cloud DLP for Google Drive and OneDrive
- Security Policies: 180+ ready-made policies
- Compliance support for ISO 27001 and SOC 2
Real-time data streams in from email, browser, website, MDM and human-risk sources, and vulnerability sweeps run across the device inventory. Our guide to connecting your security stack without adding more noise explains why this matters.
3. Which actions can it take without our approval?
HOPLONai supports 16 agentic action types, each assigned to a risk category and a guardrail tier. On endpoints, HOPLONai’s AI analysts can scan a device, isolate an infected device and run a full investigation.
Every action passes through Governance Gates, HOPLONai’s safety layer:
- Risk routing. Low-risk actions can run automatically. Higher-risk actions wait for a person to approve them, with a one-click approve button in tools such as Slack.
- Capability checks. The AI analysts know which actions each connected vendor and device supports, so they never propose an action the underlying tool can’t perform. This matters when a business runs CrowdStrike on one estate and another endpoint vendor elsewhere.
- Opt-in remediation. Nothing is remediated unless you have turned it on.
4. Can we see a record of every action?
Yes. Governance Gates keep a full audit log of every proposed and completed action, and any action can be tested in dry-run mode before it goes live. See how it works on HOPLONai’s agentic MDR platform.
5. What does it cost to start, and how does it scale?
You can start on HOPLONai’s free-forever tier, which includes cloud DLP, the External Exposure Monitor, an ISO 27001 toolkit and 180+ security policies. When you’re ready, add paid protection and the AI analysts.
MSPs and MSSPs run HOPLONai for many clients from one account, under their own brand, and keep the client relationship and the margin. More clients doesn’t mean hiring more analysts. See HOPLONai for MSPs.
Agentic MDR vs traditional MDR
| Traditional MDR | Agentic MDR with HOPLONai | |
|---|---|---|
| Who investigates | The provider’s human analysts | AI analysts, with people approving high-risk actions |
| When investigation starts | When an analyst picks up the alert | As soon as the alert arrives |
| Tools covered | Often the provider’s supported stack | Your existing tools plus HOPLONai’s own modules |
| Who acts | The provider, or your team after a handover | Low-risk actions run automatically; high-risk ones wait for your approval |
| What you can see | The provider’s reports | Every proposed and completed action in an audit log |
| For MSPs | More clients usually means more analysts | Many clients from one account, under your own brand |
Businesses without a security team can also read our guide to cybersecurity for SMBs without an internal security team.
FAQ
What is managed detection and response?
Managed detection and response (MDR) combines continuous security monitoring, investigation and response, so organisations can find and act on threats without relying entirely on an internal SOC.
What is agentic MDR?
Agentic MDR (agentic managed detection and response) is a security service in which AI analysts monitor a business’s systems 24/7, investigate and connect alerts across its security tools, and take action to stop threats, with a person approving anything high-risk.
What is the difference between MDR and EDR?
EDR is a tool that detects threats on endpoints such as laptops and servers. Managed EDR adds people to watch those endpoint alerts. MDR goes further: it monitors, investigates and responds across endpoint, email, identity and cloud signals.
What is the difference between MDR and XDR?
XDR is a technology that brings detections from several security layers into one platform. MDR is the service that operates detection and response, and it can run on top of EDR or XDR tools.
Is MDR the same as a SOC?
No. A SOC is a team, usually in-house, that monitors and responds to threats. MDR provides that capability as a managed service, so smaller organisations don’t need to build their own SOC.
Does HOPLONai replace existing EDR or email security tools?
No. HOPLONai works across the security tools you already have and adds its own modules where you need more coverage.
See how your security tools work as one operation
HOPLONai is agentic MDR: the security tools a growing business needs, and the AI team that runs them.
Start free · Book a HOPLONai demo
