If you've sat through three MDR demos in a week, you know the feeling. Slick dashboard, a world map with blinking dots, a slide about "elite analysts," and a 15-minute response SLA. By Thursday they've all blended into one vendor.

The difference shows up later. Usually at 3am, usually on a weekend, when something is actually happening and you find out whether your provider does things or just tells you about them.

These are the questions that tend to make that difference visible before you're locked into a three-year contract.

Start here. If you only ask one question, ask this one.

Get specific. Can they isolate a laptop? Disable a user in Entra ID or Okta? Kill active sessions? Block a hash across the fleet? Under what conditions, and who signed off on those conditions?

If the honest answer is "we'll escalate to your on-call," that's fine, but know what you're buying. That's monitoring with a pager attached. If your on-call is one person who also runs IT, it's monitoring with a pager attached to someone who's asleep.

Ask for an anonymized timeline from a recent case. First alert, first human looking at it, first containment action, all-clear.

You're looking for the gap between "alert fired" and "someone did something." Good providers will happily show you this because they're proud of it. If you get a vague story about how they "escalated immediately," that tells you something too.

This one catches a lot of people. A 15-minute response SLA sounds great until you realize the clock starts when an analyst picks up the alert, not when it fires. If the queue is backed up for 40 minutes, the SLA is still technically met.

Ask for the definition in the contract, not in the deck. And ask for last quarter's median and worst-case numbers. Averages hide the bad nights.

Some MDRs bring their own agent and want it on every endpoint. Others sit on top of what you already run, whether that's CrowdStrike, Defender, SentinelOne or something else. Neither approach is wrong. But a quiet rip-and-replace hidden inside an MDR deal changes the real cost, the timeline and how much your team has to relearn.

Plenty of intrusions now start with a stolen session token or a login from somewhere weird, not a piece of malware on a laptop. If the provider only really sees endpoint telemetry, they'll miss the part of the attack that happens in your identity provider, your SaaS apps or your cloud console.

Ask them to show you an identity-based detection they've actually caught. Not a slide about one.

You don't need names. You do want to know roughly how many customers each analyst covers, whether there's someone senior awake overnight or just on call, and whether the night shift is the same team or an outsourced one.

The good ones make you better between incidents. Tuning suggestions, threat hunts, "hey, we noticed you've got 14 admin accounts with no MFA." If the monthly report is just a count of alerts closed, the relationship is going to be reactive forever.

Nobody likes asking this on a first date, but ask anyway. Who owns the logs? How long are they kept after you churn? Do you get your custom detections and runbooks back? Switching costs are part of the price, even if they're not on the quote.

An MDR provider is basically a team you're hiring to make decisions for you when you're not in the room. Interview them like that.