MDR vs MSSP: Which One Actually Protects You

Published 4 September 2026. Figures are drawn from Gartner’s 2025 Market Guide for Managed Detection and Response Services and its 2026 Market Guide for Outsourced Managed Security Services, the 2026 Sophos Active Adversary Report, the 2026 Verizon Data Breach Investigations Report, the 2026 CrowdStrike Global Threat Report, IBM’s Cost of a Data Breach Report 2026, and published CISA and Huntress incident reporting.

At 03:00 on a Sunday, the difference between these two services is not a feature list. It is whether anyone has permission to unplug the machine.

That is the whole argument, and almost every comparison you will read buries it under a table of capabilities. An MSSP and an MDR provider can run identical tooling, employ analysts of identical quality, and watch the same telemetry at the same hour. What separates them is a clause in a contract that says who is allowed to take an action without asking you first, and how long they are permitted to take about it.

This guide covers what each model actually is, the specific evidence that makes response authority the deciding factor in 2026, why the category labels have stopped being reliable, and the two questions that neither category answers but that will matter more to you than the choice between them.

Short answer: an MSSP manages and monitors your security estate and hands you an alert. MDR investigates, decides and contains, under a contracted commitment to act. If your team can reliably answer an alert within minutes at any hour, an MSSP is the cheaper and broader purchase. If it cannot, an MSSP sells you visibility into an attack you will still lose. Most mature organisations end up buying both, and the incidents happen in the seam between them.

What is an MSSP?

A managed security service provider runs and monitors your security infrastructure on your behalf, across a broad catalogue of services, and escalates what looks serious to you. Gartner’s long-standing definition is deliberately narrow: outsourced monitoring and management of security devices and systems. The emphasis falls on devices, and that is a clue to where the category came from.

MSSPs were built in the perimeter era. The problem they were invented to solve was that firewalls, intrusion detection sensors, VPN concentrators and antivirus consoles all needed constant configuration, patching, tuning and rule maintenance, and very few organisations wanted to staff that. The service therefore grew up around administration: keeping controls running, correctly configured and producing logs. Monitoring came bolted on top.

A typical MSSP catalogue in 2026 still reflects that origin. Managed firewall and network security. Managed SIEM, including log collection, correlation and retention. Vulnerability scanning and reporting. Managed endpoint protection. Compliance reporting and audit support. Identity and access administration. Frequently, device patching and change management as well. It is a broad estate-management relationship, and breadth is genuinely its strength.

What that catalogue does not usually include, by default, is somebody with the authority to isolate one of your servers at 03:40 without a ticket.

What is MDR?

Managed detection and response is a narrower service defined by its endpoint: an external team monitors, investigates and then contains, rather than notifying you and stopping. Gartner’s Market Guide for Managed Detection and Response Services (Pete Shoard, Andrew Davies and Angel Berrios, 1 October 2025) sets four mandatory properties: staffing that is genuinely around the clock and human-led, immediate remote mitigation and containment that goes beyond alerting, daily engagement with each individual customer’s data, and findings expressed as business risk rather than tool output.

The category is younger and was born from a different problem. Endpoint detection tools started producing signal that was far too rich and far too voluminous for the people who owned them to read. MDR exists because detection outran attention. Our guide to what MDR is and when a business needs it covers the decision framework in full, including the conditions under which the honest answer is that you do not need it yet.

For this comparison, one property does all the work. An MDR contract commits the provider to act. An MSSP contract usually commits the provider to tell you.

The one difference that decides everything: who is allowed to act

Break an incident into its seven steps and both models look identical for the first four. The models diverge at step five, and everything downstream of that divergence is a different outcome.

Step	Typical MSSP	MDR
1. Collect telemetry	Provider	Provider
2. Detect the signal	Provider	Provider
3. Triage out the noise	Provider	Provider
4. Investigate and scope	Provider, to a defined depth	Provider, to conclusion
5. Decide on an action	You	Provider
6. Execute the containment	You	Provider, within a contracted window
7. Eradicate and recover	You	You, with the provider directing

Read the right-hand column of steps five and six carefully. That is not a service level, it is a delegation of authority over your production systems. It requires you to have decided in advance which actions a third party may take without a conversation, and it requires the provider to have written those actions down. A provider unwilling to enumerate them is selling you step four with optimistic marketing attached.

Note also that step seven belongs to you in both models. Nobody rebuilds your domain controller, restores your ERP or tells your customers. That boundary is not a weakness of either category, but it is routinely misread during procurement.

The arithmetic that makes notification insufficient

A notification model assumes the gap between alert and action is small enough not to matter. Two 2026 datasets say it is not. The numbers below are all measured, not modelled, and they describe the same window from different angles.

Measure	2026 figure	Source
Average eCrime breakout time, initial access to lateral movement	29 minutes	CrowdStrike Global Threat Report 2026
Fastest breakout observed	27 seconds	CrowdStrike Global Threat Report 2026
Median time from intrusion to reaching Active Directory	3.4 hours	Sophos Active Adversary Report 2026
Ransomware payloads deployed outside business hours	88%	Sophos Active Adversary Report 2026
Data exfiltration occurring outside business hours	79%	Sophos Active Adversary Report 2026
Detections involving no malware at all	82%	CrowdStrike Global Threat Report 2026

Now put a plausible notification chain against those figures. Assume a generous MSSP commitment of fifteen minutes from detection to escalation. Assume your on-call engineer sees the message within ten minutes, which is optimistic at 03:40. Assume ten minutes to read the case, open the console and understand what they are looking at. Assume five minutes to decide and act. Every one of those assumptions is stated rather than measured, and every one is charitable. The total is forty minutes.

Forty minutes is longer than the average breakout time. It is eighty-nine times the fastest observed breakout. In the specific scenario the Sophos data describes most often, an intruder who signed in with a valid credential at 23:40 reaches Active Directory before you have finished reading the second paragraph of the alert.

The 82% malware-free figure matters here too, and it is the reason older MSSP contracts age badly. If the detection strategy assumes a malicious file to quarantine, the most common intrusion of 2026 produces nothing to quarantine. The signal arrives as anomalous behaviour by a legitimate account, which is exactly the kind of alert a notification model pushes back to a customer who is least equipped to judge it. Our guide to how ransomware actually unfolds traces the same sequence from the attacker’s side.

Why the labels stopped being reliable

The two words have become so loosely applied that the market cannot even agree on how large it is. Gartner counted well above 600 providers describing themselves as MDR at the time of its 2025 research, up from roughly twenty credible providers in 2018. Hundreds of established MSSPs now sell MDR as a line item in a wider catalogue, and a large share of MDR specialists have added managed SIEM, vulnerability management and compliance reporting.

Gartner has a term for what this produces at the low end: the vendor-delivered service wrapper. That is a technology-centric offering, typically managed EDR, packaged and priced as a service but delivering no human-led investigation or response leadership. The guide warns explicitly that these are misaligned with what buyers believe they are purchasing.

You can measure the resulting confusion in an unusual place. Grand View Research, Persistence Market Research and The Business Research Company each size the 2026 managed security services market, and their published figures land between roughly 38 and 45 billion US dollars for the same twelve months. That spread is not mostly a forecasting disagreement. It is a scoping disagreement about whether MDR, co-managed SIEM and managed identity belong inside the category at all. When commercial analysts cannot draw the boundary consistently, a supplier’s own use of the label tells you very little.

The practical consequence is that “is this an MSSP or an MDR provider” is close to unanswerable from marketing material, and answerable in about ninety seconds from a contract.

Gartner now writes two guides, for two different buyers

The clearest signal of what these categories actually are is not in either definition. It is in who Gartner addresses each piece of research to. The Market Guide for Managed Detection and Response Services is written for security and risk management leaders. The Market Guide for Outsourced Managed Security Services (Christopher Wiles and Joe Trejo, 5 January 2026, covering 33 vendors) is written for sourcing and vendor management leaders.

That is not a filing convention. It reflects a real difference in what each decision is.

• MDR is a security operations decision. The question is what happens at 03:00 to a specific alert, and it is answered by people who understand attacker behaviour and your environment.
• Outsourced managed security is a sourcing decision. The questions are scope, governance, service levels, pricing models and contractual obligation, and they are answered by people who buy and manage suppliers.

Framing them as competing options on a single axis is therefore the first mistake most buyers make. They are two different purchases that happen to overlap in the middle. The 2026 sourcing guide also carries a forecast worth holding on to: by the end of 2026 Gartner expects more than 40% of organisations, and two thirds of midsize enterprises, to rely on managed providers for cybersecurity validation and operations. Outsourcing some part of this is becoming the default, which makes the question of which part more consequential, not less.

The same research is blunt about the limit: organisations retain full accountability for risk and governance even when they outsource the work. That constraint reappears below, and it is not negotiable by contract.

MDR vs MSSP, compared on the things that change outcomes

The usual comparison table sorts on scope and price. Those are the two dimensions least likely to determine whether an attack succeeds. The table below sorts on the dimensions that do.

Dimension	MSSP	MDR
What you are buying	Operation of your security estate	An outcome: detection through to containment
Who acts at 03:00	You, after a notification	The provider, within a contracted window
Breadth of scope	Wide: network, endpoint, SIEM, vulnerability, compliance, sometimes patching	Narrow and deep: endpoint, identity, email, cloud telemetry
Usual pricing unit	Per device or per service tier	Per endpoint, per user or per identity
What it fails at	Speed of response, and judgement on identity-based attacks	Everything outside the detection surface: patching, configuration, audit evidence
Where it earns its fee	Reducing the operational load of running controls	Compressing the window between intrusion and containment
Best fit	You have a capable team that owns response but not administration	You have tooling nobody watches outside office hours
Worst fit	You have nobody able to act on the alert you were sent	Your real gap is patching, inventory or compliance evidence

The “worst fit” row is the one to read twice. Buying MDR to solve a configuration problem produces expensive alerts about a weakness you already knew about. Buying an MSSP to solve a response problem produces a very well documented breach.

Most organisations end up with both, and the seam is where incidents live

The either-or framing collapses in practice, because the two services solve different problems and mature estates have both problems. A common and entirely sensible arrangement is an MSSP running the firewalls, the SIEM, the vulnerability programme and the compliance reporting, with an MDR provider watching endpoint and identity telemetry and holding containment authority.

That arrangement introduces a failure mode neither vendor will raise during the sales process: the seam. Two providers, two consoles, two escalation paths and two sets of assumptions about who owns which signal. Attacks do not respect the division of labour. An intrusion that starts at a VPN appliance the MSSP manages and ends at a domain controller the MDR provider watches crosses the boundary in the middle of the incident, at the exact moment coordination is hardest.

Five questions close most of the gap, and all five should be answered in writing before either contract is signed.

1. Which signals belong to which provider, named individually? Not “network” and “endpoint” but each specific log source, appliance and tenant.
2. Who declares an incident? If either party can, you need a rule for what happens when only one of them does.
3. Can they see each other’s data? An MDR provider blind to the firewall the MSSP manages is investigating with one eye shut.
4. Is there a single conference bridge during a major incident, and who convenes it? This is the question that gets asked for the first time during the incident itself.
5. Who owns the timeline you will send to a regulator? Two partial timelines are not one timeline, and reconstructing them under a 72-hour deadline is a poor use of the 72 hours.

The question neither category answers: what if the provider is the way in

Whichever model you buy, you are granting a supplier privileged, persistent, automated access to your estate, and that access is now a targeted attack path in its own right. This risk is close to absent from vendor comparisons of MDR and MSSP, and it is the most consequential thing about the decision.

Verizon’s 2026 Data Breach Investigations Report found third parties involved in 48% of breaches, up from 30% the year before. The mechanism is not abstract, and 2026 has supplied unusually clear examples.

• BeyondTrust Remote Support and Privileged Remote Access. CVE-2026-1731, a critical unauthenticated remote code execution flaw disclosed on 6 February 2026 and scored 9.9 in Rapid7’s analysis, allows commands to be run against an unpatched internet-facing instance. Huntress observed an exploitation spike from 3 April. In one 14 April case, ransomware was deployed from the remote support instance of a dental software company and reached three downstream companies. In a 15 April case, an MSP compromise led to the mass isolation of 78 businesses and subsequent exploitation across four downstream customers. The observed tradecraft included rogue domain administrator accounts, endpoint detection tooling disabled through a vulnerable driver, and LockBit 3.0.
• N-able N-central. Two authentication bypass vulnerabilities, CVE-2026-18556 and CVE-2026-18577, allow an unauthenticated attacker to create administrative sessions on internet-facing instances of a platform whose entire purpose is managing other people’s endpoints.
• SimpleHelp remote monitoring. CISA advisory AA25-163A documents ransomware actors reaching an MSP through an unpatched instance, exfiltrating data and pushing an encryptor to that MSP’s client endpoints.

The structural point survives the specific CVEs. A provider that can isolate your hosts can also be used to reach them, and the tooling that grants containment authority grants it to whoever controls the console. This does not argue against outsourcing. It argues for a set of due diligence questions that sit outside the service comparison entirely.

Ask the provider	What a weak answer looks like
What management tooling will touch our estate, and is it internet-facing?	An unwillingness to name the products
How fast do you patch your own remote access platforms, measured?	A policy statement with no observed figure
Is your access to our tenant standing or just-in-time?	Permanent administrative accounts with shared credentials
Is phishing-resistant multi-factor authentication enforced on every account that can reach us?	“We require MFA” without a method named
Can we see and alert on your activity inside our environment?	Provider actions that are invisible in your own logs
What is your own breach notification commitment to us?	Nothing in the contract

The last row deserves emphasis. Under NIS2 your reporting clock starts when you become aware. If your provider learns of their own compromise on a Friday and tells you on a Tuesday, you inherit their delay and none of their excuse. Controlling for that in advance is posture and governance work rather than detection work, and it belongs underneath whichever service you choose.

Your provider is regulated too

Under NIS2, managed service providers and managed security service providers are not merely suppliers to regulated entities. They are in scope themselves. Annex I of the directive, covering sectors of high criticality, includes ICT service management on a business-to-business basis, and that category names MSPs and MSSPs directly.

Placement in Annex I carries the higher supervisory tier. A provider meeting the large enterprise thresholds, broadly 250 or more employees or turnover above 50 million euro with a balance sheet above 43 million euro, is an essential entity, which exposes it to administrative fines of up to 10 million euro or 2% of total worldwide annual turnover, whichever is higher. A provider in the medium band, broadly 50 to 249 employees or 10 to 50 million euro turnover, is an important entity. The rationale for the higher tier is exactly the risk described in the previous section: an incident inside a provider’s infrastructure can reach thousands of customer environments at once.

This changes three things about how you buy.

1. Their compliance status is diligence material, not a courtesy question. Ask which entity type they are, in which member state, and under which national transposition.
2. Your own supply chain obligation applies to them. Article 21 requires in-scope entities to address supply chain security, including the security of direct suppliers and service providers. A security supplier is not exempt from that assessment because they sell security.
3. Accountability does not transfer. Article 20 places responsibility for approving and overseeing cybersecurity risk management measures on the management body. You can outsource the work, the hours and the expertise. You cannot outsource the answer you owe a regulator.

If you are unsure whether these duties reach your organisation, our two-minute NIS2 applicability check settles it, and Who does NIS2 cover, and what you actually have to do covers the obligations that follow. Our NIS2 overview maps the directive onto the controls involved.

What each one costs, and why the unit matters more than the rate

Published rates vary by more than an order of magnitude in both categories, so comparing headline prices tells you almost nothing. Comparing counting units tells you a great deal.

MSSPs generally price per managed device or per service tier, a habit inherited from the era of managed firewalls. MDR generally prices per endpoint, per user or per identity. Those units produce very different bills for the same organisation, and the difference is not proportional to risk.

Take a stated example. A 400-person manufacturer with two sites might run 30 managed network devices and 620 endpoints across laptops, servers and shared terminals. Under a per-device MSSP model the bill scales with 30. Under a per-endpoint MDR model it scales with 620. Now take a 400-person software firm with a flat cloud estate: 4 managed devices, 450 endpoints, 400 identities. The same two price lists produce almost inverted results. Neither vendor is being unfair, and neither unit is wrong. They are measuring different things, and only one of them tracks your actual exposure.

Four cost lines are routinely missed at evaluation in both models.

• Onboarding and tuning. Usually charged separately, and it is the period during which the service is least effective.
• Telemetry ingestion and retention. Especially where a SIEM sits underneath, and especially during an incident, when volumes spike at precisely the moment you have no negotiating position.
• Hands-on-keyboard incident response. Establish whether major incident support is included or sold as a separate retainer. This varies more widely than any other line.
• Exit. Detection content tuned to your environment over two years is an asset. Establish at signature whether it leaves with you, along with case history and raw logs.

If you are modelling this against the cost of building the capability internally, our breakdown of what continuous protection costs per user is a useful reference point for the per-identity end of the market.

Which one actually protects you

Neither category protects you. A specific contract does, and three questions identify it regardless of the label on the cover.

1. Which containment actions may you take without contacting us, and are they listed? Isolating a host, disabling an account, revoking a session, blocking a hash, killing a process. A named list is a service. “We will work with you to respond” is a notification.
2. What is the contracted time to containment, measured from what event, and what happens if you miss it? Time to acknowledge, time to investigate and time to act are three different clocks, and providers quote whichever is fastest. A commitment with no consequence attached is a target, not an obligation.
3. Who is awake, where, and how many of them? Follow-the-sun coverage staffed by people, an automated triage engine with an on-call rota behind it, and a rota that quietly thins after 18:00 all get described with the same phrase.

Answer those three and the category question dissolves. Plenty of firms sold as MSSPs will pass all three. Plenty of firms sold as MDR will fail the second. The evidence bears this out from the other direction: in the Sophos 2026 dataset, cases originating from monitored MDR environments showed a median dwell time of 2.00 days against 5.00 days for all-cause incident response engagements. That comparison is not a controlled trial, and the two populations are not equivalent, since emergency response engagements arrive precisely because something already went badly wrong at organisations that were often not being watched at all. The defensible reading is narrower than the marketing one and still worth having: environments somebody is actively watching get found sooner, and the gap is measured in days of attacker access.

IBM’s Cost of a Data Breach Report 2026 puts a figure on what those days cost. Mean time to identify and contain rose to 247 days, up from 241 and reversing five consecutive years of improvement, and breaches running past 200 days averaged 5.65 million US dollars against 4.32 million for those resolved sooner.

In a Microsoft environment

If you run Microsoft 365, the telemetry both models depend on is already being generated, and you are quite possibly paying for it twice. Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps and Entra ID Protection produce exactly the identity and endpoint signal where modern intrusions appear first, and Microsoft Sentinel can hold the rest.

This changes the shape of the buying decision. The gap is rarely a tooling gap. It is a gap between owning the signal and operating it, which is why a layer that turns Sentinel, Defender, Intune and Entra ID signals into one validated decision across every tenant is a different proposition from another console nobody is watching. The detection and response platform applies that to an existing Microsoft estate without replacing any of it, stopping the threat at the entrance where identity and email attacks actually begin.

One practical note that catches organisations out during incidents rather than during procurement: Microsoft’s own managed service, Defender Experts for XDR, is licensed and sold separately from Microsoft 365 E5. E5 gives you the tooling and the telemetry. It does not give you anyone reading them at 02:00.

Whichever model you choose, the reporting you will lean on most is the part evaluated least during procurement. Being able to produce current, board-ready evidence of what was detected and what happened next is what an insurer, an auditor and a regulator all ask for, and it is the deliverable you will use every quarter rather than once a year.

Why shared defence changes the arithmetic

The same tradecraft hits many organisations in sequence, which means the second target is attacked with indicators the first one already produced. The Bomgar campaign described above is the pattern in miniature: one vulnerability, one class of provider, dozens of downstream victims over a few weeks. Sophos observed the same reuse at the ransomware layer, and Verizon’s third-party figure of 48% describes it at the relationship layer.

Defending against reused tradecraft one organisation at a time means every member pays for the same investigation separately. That is the reasoning behind UnifiedONE’s shared defence intelligence: an attack investigated once in one member environment becomes a validated detection for every other member, usually within minutes. The reasoning behind community protection is straightforward enough that it barely needs arguing, since attackers already share infrastructure, tooling and access brokers. The weekly breakdown of what they actually did to Microsoft environments is published openly in The Repeat.

How that is packaged depends on who carries the operational load. Managed service providers running many tenants have the seam problem at scale and the supplier-access problem pointed at them directly. Smaller organisations without a dedicated security team are the ones for whom a notification model fails hardest. Enterprises already running a security function usually need coverage rather than replacement. Providers building their own service on top of it can do so through partnership without giving up their tools or their brand.

Frequently asked questions

What is the main difference between MDR and MSSP?

Response authority. An MSSP monitors and manages your security infrastructure and escalates alerts to you for action. An MDR provider investigates, decides and contains under a contractual commitment to act. Both may use the same tooling and watch the same telemetry. Only one of them is obliged to isolate a host at 03:00 without asking you first.

Is an MSSP cheaper than MDR?

Usually per unit, but the units differ so the comparison is unreliable. MSSPs typically price per managed device, MDR per endpoint, user or identity. An estate with many network devices and few endpoints inverts the usual answer. Model both price lists against your own asset counts rather than against the example in the proposal.

Can an MSSP provide MDR?

Many do, and Gartner counted well above 600 providers using the MDR label. The label is not the specification. Ask for the enumerated list of containment actions the provider may take unilaterally and the contracted time to containment. Those two answers separate a genuine service from a monitoring product with a service-shaped price.

Do I need both an MSSP and MDR?

Many mature organisations run both: an MSSP for estate administration, SIEM and compliance reporting, and MDR for detection and response across endpoint and identity. If you do, the risk moves to the seam between them. Agree in writing which provider owns each log source, who declares an incident, and who assembles the timeline you will send to a regulator.

Does MDR or an MSSP satisfy NIS2?

Neither satisfies it on its own, because Article 20 places responsibility for approving and overseeing cybersecurity risk management measures on your management body. A service can supply the monitoring, the response capability and much of the evidence. It cannot supply the accountability. Note also that under Annex I your provider is itself in scope, which makes their compliance status part of your supply chain diligence.

What is a vendor-delivered service wrapper?

It is Gartner’s term for a technology-centric offering, typically managed endpoint detection, packaged and priced as a managed service but delivering no human-led investigation or response leadership. Gartner flags these as misaligned with what buyers think they are purchasing. The tell is a contract that commits to monitoring and reporting but never to an action.

How do I check whether a provider is a security risk to me?

Treat their access as a privileged path into your estate, because it is. Ask what management tooling touches your environment and whether it is internet-facing, how quickly they patch their own remote access platforms, whether their access to your tenant is standing or just-in-time, whether phishing-resistant multi-factor authentication is enforced on every account that can reach you, and what they commit to telling you, and how fast, if they are breached themselves.

In short

• The difference that decides outcomes is response authority. An MSSP usually notifies, MDR is contractually obliged to contain, and everything else is scope and pricing.
• A notification chain of forty minutes, built from charitable assumptions, is already longer than the 29-minute average breakout time, and 88% of ransomware is deployed outside business hours.
• The labels have stopped being informative. Gartner counted well above 600 self-described MDR providers and has a specific term, the vendor-delivered service wrapper, for the ones selling tooling as a service.
• Gartner addresses its MDR research to security leaders and its outsourced managed security research to sourcing leaders, which is the clearest evidence that these are two different purchases rather than two options.
• Most mature organisations end up with both, and incidents concentrate in the seam. Settle log-source ownership, incident declaration and timeline ownership in writing before signing either contract.
• Your provider is a privileged attack path. One April 2026 compromise of a single MSP led to 78 businesses being isolated, and third parties were involved in 48% of breaches in 2026.
• Under NIS2 Annex I your provider is regulated too, and under Article 20 accountability stays with your management body regardless of what you outsource.

Sources

1. Gartner, Market Guide for Managed Detection and Response Services, Pete Shoard, Andrew Davies and Angel Berrios, 1 October 2025. Subscription report.
2. Gartner, Market Guide for Outsourced Managed Security Services, Christopher Wiles and Joe Trejo, 5 January 2026, covering 33 vendors. Subscription report. Retrieved 4 September 2026.
3. Sophos X-Ops, Nowhere, man: The 2026 Active Adversary Report, February 2026, based on 661 incident response and MDR cases handled between 1 November 2024 and 31 October 2025 across 70 countries and 34 industries. Retrieved 4 September 2026.
4. CrowdStrike, 2026 Global Threat Report, 24 February 2026. Retrieved 4 September 2026.
5. Verizon, 2026 Data Breach Investigations Report, May 2026. Retrieved 4 September 2026.
6. IBM Security, Cost of a Data Breach Report 2026, July 2026. Retrieved 4 September 2026.
7. Huntress, Uptick in Bomgar RMM exploitation, April 2026, covering CVE-2026-1731 and the downstream compromises of 14 and 15 April 2026. Retrieved 4 September 2026.
8. Rapid7, CVE-2026-1731: critical unauthenticated remote code execution in BeyondTrust Remote Support and Privileged Remote Access, February 2026. Retrieved 4 September 2026.
9. CISA, Advisory AA25-163A: ransomware actors exploit unpatched SimpleHelp remote monitoring and management. Retrieved 4 September 2026.
10. European Union, Directive (EU) 2022/2555 (NIS2), Annex I and Articles 20, 21, 23 and 34. Retrieved 4 September 2026.
11. Microsoft, What is Microsoft Defender Experts MDR, Microsoft Learn. Retrieved 4 September 2026.
12. Market sizing range for 2026 managed security services compiled from published estimates by Grand View Research, Persistence Market Research and The Business Research Company. These are commercial market-research estimates rather than measured figures, and the spread between them is cited here as evidence of scoping disagreement rather than as a market size.