Managed Detection and Response Built for Mid-Sized Organizations

Managed detection and response, or MDR, combines security technology with human analysts who monitor, investigate, validate, and respond to threats on your behalf. The service adds operational expertise to the tools protecting your environment. Core Defense, Tier 01 of the CompassMSP Apex Security Platform, provides continuous monitoring, AI-assisted triage, analyst validation, and scoped containment across supported endpoint, identity, network, and cloud sources.

 Core Defense connects analyst validation, multi-source correlation, and scoped containment with Compass’s broader delivery model. Compass Command Center brings account intelligence into that work, helping teams understand your business priorities, environment, and operational constraints. When Compass also provides managed IT, security findings can move into patching, hardening, and remediation through coordinated teams. Closed-Loop Delivery carries lessons from investigations into future improvements. When comparing MDR providers, evaluate these responsibilities alongside monitoring and detection capabilities. 

 An internal 24/7 security operations center requires staffing across shifts, coverage for leave and training, technical leadership, detection tools, threat intelligence, and ongoing process development. There is no universal minimum headcount; the requirement depends on workload, complexity, and response responsibilities. MDR provides access to these capabilities through a service engagement, while an internal SOC offers greater direct control. A useful cybersecurity budget comparison considers total operating costs, coverage, expertise, and the responsibilities your organization will retain. 

 Core Defense uses AI-assisted triage and human analyst review to distinguish routine activity, false positives, and genuine threats. Related signals are evaluated together so your team receives findings with context and recommended next steps. The signal-to-noise example illustrates how large event volumes can narrow into a smaller set of investigations and confirmed threats. Those figures describe an illustrative filtering process, rather than a guaranteed detection ratio or a fixed number of incidents. 

 Core Defense extends visibility into identity and cloud activity, with correlation across supported network sources as well. This helps analysts connect activity that may appear unrelated when reviewed in separate tools. For example, a compromised account can provide access to cloud services and other systems without relying on malware. MITRE ATT&CK’s Valid Accounts technique documents how attackers abuse legitimate credentials for access, persistence, and privilege escalation. Monitoring these connected signals helps Compass investigate the broader activity surrounding an alert. 

 Yes, where supported integrations and appropriate access are available. Compass evaluates your existing endpoint, identity, network, and cloud tools to determine which telemetry can support monitoring and investigation. Compatibility depends on the product, configuration, licensing, and available connectors. Where additional tooling or consolidation would improve coverage, Compass explains the options and trade-offs. Our guide to evaluating bundled cybersecurity services outlines questions to ask about integrations, duplicated tools, and service responsibilities. 

 Core Defense provides around-the-clock security oversight, with a 15-minute response target for incidents requiring immediate security action. The applicable severity, timing trigger, and response responsibilities are defined in the engagement. A response target is different from a guaranteed containment or resolution time. Once analysts validate a threat, they initiate authorized actions and follow documented escalation procedures. NIST’s incident response guidance explains why preparation, detection, response, and recovery need to work together to reduce incident impact. 

 No. Core Defense supports your internal team by handling specialized security monitoring, analyst validation, and scoped containment. Your organization retains its business and technology decision-making responsibilities, while remediation ownership is defined in the engagement. In co-managed IT environments, Compass and your staff coordinate responsibilities and escalation procedures. Account intelligence helps connect security findings with the operational context your team needs to take effective action. 

 Core Defense includes analyst-led detection and response activities, including containment within the agreed service scope. An incident requiring deeper forensic investigation, extensive recovery work, or additional coordination may require a separate incident response engagement. Compass’s incident response information explains the availability of additional support and applicable billing arrangements. Organizations that need continuous forensics, dedicated analyst support, and deeper investigation as ongoing capabilities should evaluate Complete Security. 

 Yes, Core Defense can support a regulated organization’s security program through monitoring, analyst validation, scoped response, and reporting. The appropriate coverage depends on your specific risks and obligations; MDR alone does not establish compliance or certification. The NIST Cybersecurity Framework provides a structure for managing cybersecurity risk, while Compass Compliance & Risk Management helps connect applicable requirements with controls, documentation, and remediation priorities. Organizations needing deeper forensic evidence may benefit from Complete Security. 

 Core Defense monitors supported identity signals, including authentication activity, privilege changes, and suspicious account behavior, and correlates them with endpoint and cloud findings. When analysts confirm a threat, response actions may include account restrictions, session revocation, or credential resets, depending on technical capabilities and authorized scope. MITRE ATT&CK explains how attackers use compromised accounts to maintain access and move between systems. This makes identity monitoring an important complement to endpoint protection. 

 Core Defense provides monthly security reporting that explains activity, findings, response outcomes, and recommended improvements in business terms. These reports help leadership understand the work being performed and identify priorities for further action. They can also contribute to audit and insurance evidence, although additional documentation may be required. vCISO & Security Advisory can build on operational reporting to support broader risk discussions, investment planning, and board communication when included in your engagement. 

 Yes. Core Defense can expand to support additional users, locations, and supported cloud services as your needs change. New environments may require additional connectors, licensing, deployment, and detection tuning. Because Core Defense, Complete Security, and Enterprise sit within the Apex Security Platform, Compass can reassess coverage as your risk profile evolves. Complete Security adds deeper investigative capabilities, while Enterprise supports more complex requirements through a tailored engagement. 

We will begin in this chapter by dealing with some general quantum mechanical ideas. Some of the statements will be quite precise, others only partially precise. It will be hard to tell you as we go along which is which, but by the time you have finished the rest of the book, you will understand in looking back which parts hold up and which parts were only explained roughly.