MDR vs EDR vs MSSP vs SOC-as-a-Service: An Operator's Decision Tree for Small Business

Most small-business buyers who say they need "MDR" do not actually mean MDR. They mean something simpler and more honest: they want someone reading the alerts at 2 a.m.

They want to know that if a domain admin account gets popped on a Saturday night, the response does not depend on whether the IT manager happened to glance at a dashboard before going to bed.

The acronyms — EDR, MDR, XDR, MSSP, SOC-as-a-service, SIEM — are the industry's mess, not the buyer's. But the buyer still has to navigate them to make a defensible purchase. So let's do that, hands-on, with a decision tree that gets you to the right answer in about five questions.

This is a companion to the broader EDR vs MDR vs XDR buyer's guide. That piece is about category labels. This one is about how to actually pick.

The direct answer

For most 5-to-500-employee businesses in 2026, the right buy is MDR — EDR (or XDR) plus a 24/7 SOC that reads the alerts and responds. EDR alone assumes someone inside the business will watch it, tune it, and act; most SMBs do not have that person.

MSSPs and SOC-as-a-service typically make sense above roughly 250 employees or in heavily regulated verticals where log breadth across firewalls, identity providers, and SaaS becomes the primary detection question.

The decision reduces to two axes: do you already have endpoint telemetry (EDR), and do you have a team to actually read it. That four-quadrant answer gets you to the right shape faster than any acronym comparison.

The categories, in one honest sentence each

Before the decision tree, the definitions. Operator voice, not marketing.

• AV / next-gen AV. Signature and behavioral models running on the endpoint. No SOC. No human reading alerts. Prevention only.
• EDR. Recording every meaningful endpoint action, generating detections, and offering response actions like isolation or process kill. The platform. Not the people.
• MDR. EDR or XDR plus a 24/7 SOC reading and responding. The category exists because tools without humans do not produce outcomes for small businesses.
• XDR. Cross-domain correlation — endpoint plus identity plus email plus cloud — as a platform layer. Often delivered as part of an MDR service, not as a standalone product for SMBs.
• MSSP. A managed security service provider. Historically log-centric. Runs the SOC for you across whatever tools you bought. Older shape, still common in regulated and larger environments.
• SOC-as-a-service. An MSSP rebrand, mostly. Same shape, often more endpoint-aware than legacy MSSPs, sometimes packaged with a specific SIEM.
• SIEM. Log aggregation and detection content. Not detection by itself. Needs people. Most useful where retention and breadth matter — compliance, audit, broad telemetry.

Notice what those definitions reveal. Three of the seven categories — EDR, XDR, SIEM — are platforms. Three — MDR, MSSP, SOC-as-a-service — are services. AV is the floor everyone already has.

The real question is not which acronym is most advanced. It is which combination of platform and service matches your operating reality.

The four-quadrant reality

Here is the hero framework. Two axes. Four answers.

• X-axis: do you already have endpoint detection telemetry (EDR)?
• Y-axis: do you have a security team to actually read it?

That produces four quadrants, and each quadrant has a clear right answer.

Quadrant 1: telemetry yes, team yes — buy EDR, run it yourself

You have an EDR platform. You have at least a couple of security analysts who watch the queue, tune detections, and act on alerts. You do not need MDR. You need better tools, more coverage, and possibly a SIEM for breadth.

• Who you are: mid-market or enterprise with a real internal security function. Rare in the under-200-employee SMB world.
• Price range: roughly $5 to $15 per agent per month for the EDR license itself, plus internal labor.

Quadrant 2: telemetry yes, team no — MDR on top of your existing EDR

You bought CrowdStrike or SentinelOne or Defender for Endpoint a year ago because the sales conversation was compelling. You have not staffed a SOC, and nobody is consistently reading alerts. You want to keep the EDR investment.

• Who you are: a business that made a tooling decision before staffing the human side. Very common. This is where Arctic Wolf, Expel, Red Canary, and Critical Start typically play — they operate the EDR you already own.
• Price range: roughly $15 to $30 per user per month on top of the EDR license you are already paying for.

Quadrant 3: telemetry no, team yes — MSSP or SIEM-led SOC for log breadth

You have an internal security owner or small team. Your bigger problem is breadth — identity logs, firewall logs, SaaS logs, on-prem application logs — and a regulator or auditor cares about retention. Endpoint is one of many problems, not the dominant one.

• Who you are: regulated mid-market, healthcare, legal, or financial services with audit pressure. Less common in the small-business world, more common as you cross 250 employees.
• Price range: roughly $80 to $300 per user per month for MSSP or SOC-as-a-service engagements that include SIEM, log management, and broader scope.

Quadrant 4: telemetry no, team no — MDR with the platform included

You have antivirus, maybe Defender, and that is it. Nobody is watching anything. You want someone to take the whole problem off your plate at a price that does not require a board meeting to approve.

• Who you are: the typical 10 to 200 employee business. Most of the market lives here.
• Price range: roughly $7 to $15 per agent per month for MDR with the sensor and SOC bundled together. This is the Huntress shape of the market.

If you map honestly, most small businesses sit in Quadrant 4. A meaningful minority sit in Quadrant 2 because they already bought EDR. Quadrant 1 is rare. Quadrant 3 shows up in regulated industries.

The 5-question decision tree

The four-quadrant model gives you the shape. These five questions pin you to a specific answer.

1. Do you have a 24/7 internal team that already triages alerts?

If yes, you do not need MDR. You need better tools, deeper telemetry, and possibly a SIEM. Buy EDR directly. Pay for the platform, not the service. Skip the rest of this article and start evaluating CrowdStrike, SentinelOne, or Defender for Endpoint head-to-head.

If no — and for almost every business under 200 employees the answer is no — continue.

2. Do you have an existing EDR investment you cannot write off?

If yes, you are probably in Quadrant 2. You want MDR layered on top of the EDR you already own. Evaluate Arctic Wolf, Expel, Red Canary, and the in-platform managed services from your EDR vendor (CrowdStrike Falcon Complete, SentinelOne Singularity MDR).

Expect the layered cost to run $15 to $30 per user per month on top of your EDR license.

If no, continue. You are probably going to land on bundled MDR.

3. Is your sensitive data primarily in Microsoft 365 or Google Workspace?

If yes — and for most modern SMBs the honest answer is yes — identity threat detection matters as much as endpoint. The attacker does not need to touch a laptop to drain a mailbox or impersonate a CFO.

Bundled programs that combine Managed EDR and Managed ITDR win here because the same SOC sees both surfaces in one investigation thread.

This is also where pure-play EDR plus a separate identity tool plus a separate awareness program creates the integration tax that quietly eats the small-business security budget.

4. Do you have regulator-driven log retention requirements?

If yes — HIPAA, SOC 2, PCI, state privacy law, regulator audit — then SIEM enters the picture. You probably need either an MDR provider that sells log collection and retention as an add-on (ours is Ridge Log), or an MSSP that operates a full SIEM on your behalf with auditable retention.

If no, MDR alone is usually sufficient. Many small businesses think they have a retention requirement, but a careful read of their actual obligations says otherwise. Ask before you buy a SIEM.

5. What does the cyber-insurance questionnaire ask for?

Answer this question first, honestly. It usually forces the choice.

Modern cyber-insurance carriers ask:

• Whether you have EDR
• Whether you have MFA across the org
• Whether you have email security
• Whether you have an offline backup
• Whether you have a 24/7 monitored detection capability

If you cannot answer yes to that last one, you are paying a premium, getting denied coverage, or both. MDR is the cleanest single line item that answers it. See cyber insurance readiness for how this maps to the actual questionnaires.

By the time you have answered those five questions honestly, the right category is usually obvious.

Why does the industry get this wrong?

The acronym salesmanship deserves a paragraph. The market manufactured XDR as a "next tier" because EDR margins were compressing and the analyst quadrants needed a new column.

For most small businesses, XDR did not change the operational outcome — they still did not have a SOC, they still could not read the alerts, and the cross-domain correlation just produced more dashboards nobody watched.

MSSPs evolved into MDR providers when the market figured out that alerts without response is a dead-end product. The legacy MSSP model — log aggregation, monthly reports, ticket-based escalation — was built for a buyer who had an internal security team to receive the handoffs.

Most small businesses do not. So the providers that survived rebuilt themselves around endpoint sensors, faster response loops, and packaged outcomes. That category is MDR, regardless of what the older brand on the contract says.

The honest reading of the market in 2026: MSSP and SOC-as-a-service are usually selling a wider-scope version of MDR, often with a SIEM bolted on, at three to ten times the per-user price.

That extra spend is justified in some environments. It is not justified in most small-business environments.

Does Huntress count as MDR?

Yes. The naming is a marketing artifact.

Huntress' Managed EDR product is functionally MDR:

• They ship the endpoint sensor
• They run a 24/7 SOC
• They generate the detection
• They investigate it
• They escalate to a human analyst with guided remediation

That is the textbook definition of managed detection and response.

The reason Huntress branded it "Managed EDR" rather than "MDR" is partly historical and partly competitive positioning — they wanted to communicate that the product was different from the legacy MDR shape of the early 2020s, where the service often layered on top of someone else's EDR.

For buyers comparing Huntress to Arctic Wolf, Expel, eSentire, or Red Canary: it is the same category. Huntress generally sits at the low end of the price band, with a small-and-mid-market focus, an explicitly bundled sensor, and a partner-led delivery model.

The trade-off is platform depth — Arctic Wolf and Red Canary often integrate with a wider set of third-party telemetry sources, while Huntress optimizes for the SMB-shaped problem.

If you want a deeper head-to-head on the underlying endpoint platforms, the Huntress vs SentinelOne operational comparison covers it.

Where Obsidian Ridge fits

Worth saying plainly. We are not an MSSP. We do not run your help desk, manage your Wi-Fi, procure your laptops, or take ownership of your Microsoft 365 tenant.

What we do is operate the managed cybersecurity program end-to-end on the Huntress platform: Managed Detection and Response, Managed ITDR, security awareness training, and log collection and retention through the Ridge Log add-on when it is warranted, plus the security-operations layer around it.

That security-operations layer is what differentiates a managed program from a vendor subscription:

• HIPAA, ABA, and SOC 2 evidence packs
• Cyber-insurance application support and renewal questionnaires
• Incident response coordination when something serious lands
• Quarterly business reviews that the founder or compliance lead can actually use

For most small businesses, that combination — bundled MDR plus a practitioner running the program — is the operational answer to questions one through five in the decision tree above. Pricing is published openly on the pricing page.

If a business genuinely needs MSSP-shaped scope, such as broad log management, custom application telemetry, OT environments, or regulated retention beyond what Ridge Log offers, we will say so and help you scope it. Talk with us to start that conversation.

The 2 a.m. test

Here is the honest closing test. It is the one we use with every prospect who is debating between categories.

Write down what would happen, in your business, at 2 a.m. on a Saturday, if an attacker landed an initial-access foothold on a laptop right now. Walk through it minute by minute. Who detects it? How?

How long does the attacker have to move laterally before anyone notices? Who isolates the device? Who notifies the partner or the customer?

Who calls the insurance carrier? Who reads the logs at 8 a.m. on Monday to figure out what happened?

If the answer at any step is "nothing reliable" or "we would hope someone sees it" or "the IT manager would catch it eventually," you need a 24/7 SOC. There is no version of the small-business operating model where an internal team builds that capability cheaper than buying it.

MDR is the simplest, cheapest, and most operationally honest path to a real 2 a.m. answer for a small business. EDR is a tool, not an answer. MSSP is over-scope for most.

SOC-as-a-service is usually an MSSP in newer packaging. XDR is a platform feature that lives inside good MDR programs anyway.

Pick the category that closes the 2 a.m. gap. For most small businesses, that is bundled MDR — a 24/7 SOC for the night, and a practitioner running the program by day.

If you want help mapping the decision tree against what you already own, what your insurance carrier is asking for and what your customers expect, Talk with us or look at the managed detection and response service page.

Both are designed to get you to a defensible answer without another vendor demo.