Managed Detection and Response for Small Businesses
Who investigates a security alert when everyone has gone home? Get specialist monitoring and response for your covered devices and systems, with Black Swan helping you choose the right protection and understand what happens next.
Specialist security teams working around the clock. A local partner who knows your business.
Managed cyber security · Black Swan Cyber
Who deals with your security alerts when everyone has gone home?
Get specialist monitoring, investigation and response for the systems covered by your service, with Black Swan Cyber helping you choose the right protection and understand what happens next.
EDR, MDR, MXDR… you shouldn’t need to learn the alphabet before getting useful advice.
Book a free 30-minute conversationBased in Chesterfield, supporting organisations across Derbyshire, South Yorkshire and beyond.
The short answer
What is Managed Detection and Response?
Managed Detection and Response (MDR) combines security technology with specialists who look for threats, investigate suspicious activity and respond within an agreed scope. The managed options available through Black Swan include round-the-clock security monitoring and response from specialist partners.
The important questions are simple: what is being watched, who investigates, and what can they do when something is wrong? A service might focus on your computers and servers, or include additional systems. The name alone doesn’t tell you which.
Black Swan helps you make those choices, plan the setup and coordinate next steps with your existing IT support. Our specialist security partners provide the 24/7 security operations.
Glitch & Black Swan explain
Who checks when something looks wrong?
Glitch
Hoping nobody notices
“The alert appeared. I was counting on everyone being busy.”
An unexpected download or suspicious process can be easy to miss. An alert needs someone to work out what happened and what to do next.
Black Swan Cyber
Your security partner
“You shouldn’t have to work all this out yourself.”
We help you understand the protection you need and how it fits your existing setup. Our specialist partners monitor, investigate and respond around the clock within the agreed service scope. Black Swan helps you make sense of the findings and the next steps.
Compare your options
EDR, Managed EDR, MDR and MXDR: what’s the difference?
These terms overlap. Managed EDR can deliver an endpoint-focused MDR service. MXDR describes a broader, connected approach, but it only sees the systems connected to it.
On a small screen, each option appears as a separate card below.
| Term | What it means | What it does | What to check |
|---|---|---|---|
| EDR | Endpoint Detection and Response | Detects and investigates suspicious activity on devices such as laptops and servers. Provides response capabilities. | Who operates it? An EDR licence alone does not promise a 24/7 analyst service. |
| Managed EDR | Managed Endpoint Detection and Response | Adds a provider to operate endpoint detection and response for you. | Check monitoring hours, containment permissions and what remediation is included. |
| MDR | Managed Detection and Response | The managed service: people, processes and technology working together to detect and respond. | It can be endpoint-focused or broader. Confirm the actual systems covered. |
| XDR | Extended Detection and Response | Connects signals from multiple supported security areas to help identify related activity. | Which integrations are actually enabled? XDR alone does not guarantee a managed team. |
| MXDR | Managed Extended Detection and Response | A managed service using extended detection and response across the connected security areas. | Breadth depends on the licensed modules, integrations, data and response permissions. |
| ITDR | Identity Threat Detection and Response | Focuses on suspicious account and identity activity, such as possible account takeover. | Which identities are covered, and is human monitoring and response included? |
Compare coverage, human involvement and response responsibilities. A well-scoped service you understand is more useful than a broad label with gaps nobody has explained.
What happens when something suspicious appears?
This is an illustrative process. The actions available depend on the selected service, the affected system and the authority agreed during setup.
01 / Detect
Something needs a closer look
Activity on a monitored device or connected account triggers an investigation. That might be a suspicious process, unusual sign-in or an attempt to maintain access.
02 / Investigate
Analysts assess the evidence
The security team reviews the signals, works out what they mean and decides which response is appropriate.
03 / Respond
Contain the threat and agree next steps
Where supported and authorised, actions can include isolating a device, stopping a malicious process or restricting a compromised account. Further fixes may need your IT provider’s involvement.
Automated controls can also act during an attack. Human investigation, notifications and follow-up sit alongside those controls. We agree the responsibilities before deployment.
Glitch & Black Swan explain
The laptop looks fine. What about the account?
Glitch
Hoping nobody notices
“I signed in as you. The laptop didn’t need to be involved.”
A stolen password or hijacked session can give an attacker access to a cloud account from another device. Protecting your computer does not automatically cover everything happening in your Microsoft 365 identity.
Black Swan Cyber
Your security partner
“Let’s check the account as well as the device.”
Identity monitoring can complement endpoint protection. We help you decide whether you need both and confirm the coverage. Adding two products does not automatically mean their alerts are correlated or that you have a complete MXDR service.
Do you need a managed service?
It may be a good fit if…
- Your IT support is reliable, but security alerts wait until office hours.
- You have tools in place without anyone clearly responsible for investigation.
- Your business depends on its computers, servers or cloud accounts.
- You need specialist security help without employing a dedicated security operations team.
You may already have what you need if…
- Your current agreement provides appropriate managed monitoring and response.
- You have a capable security team with suitable coverage and clearly assigned responsibilities.
- Your existing provider can demonstrate that the relevant devices and accounts are covered.
We should establish that before adding another subscription.
For a small business, school, charity or care provider, the starting point is the same: understand the systems you rely on and who will act if they are attacked.
Costs, without the guessing
How much does managed detection and response cost?
There isn’t one price for every MDR or MXDR setup. Device numbers, identities, security modules, compatibility and the response service all affect the quote. Wider coverage may require additional licences or changes to your existing setup.
A concrete endpoint example
Our Huntress Managed EDR service is:
£7 per device / month + VAT
12-month minimum term.
Volume discounts are available.
Five devices cost £35 per month + VAT, or £420 + VAT over the minimum term, before any applicable volume discount.
This is the Huntress endpoint service price. It is not an all-inclusive MDR/MXDR or identity-protection price.
What to ask for in a quote
- The devices, accounts and systems included.
- Required licences and any setup charges.
- Monitoring hours and response responsibilities.
- Contract length and renewal terms.
- Any incident work or recovery support charged separately.
We’ll explain the proposed scope so you can compare it with what you already pay for.
What won’t it do?
No managed security service can promise to prevent every attack or guarantee recovery. It cannot monitor a system that has not been connected or deployed correctly.
- It does not replace backups. Containing an attack and restoring your business are different jobs.
- It does not remove the need for updates, MFA and secure settings. Preventive controls still matter.
- It is not automatically an all-inclusive incident response retainer. Forensics, legal advice, rebuilds and recovery may be outside the agreement.
- Containment can interrupt work. Isolating a device or restricting an account may be necessary to limit harm. Agree who can authorise actions and who needs notifying.
- It does not make every device compatible. Operating systems, licences and integrations need checking before deployment.
People and responsibilities
Who does what?
Black Swan Cyber
Helps you assess the gap, choose the service, plan deployment and understand findings. Coordinates agreed next steps with you and your IT provider.
The security partner
Provides the security technology and round-the-clock specialist monitoring, investigation and response within the agreed coverage.
You and your IT provider
Keep contacts current and carry out agreed business decisions, configuration changes and recovery tasks that fall outside the managed security response.
Which service might suit your setup?
Once we understand your needs, these are options we can discuss. They cover different areas and are not interchangeable.
Managed endpoint protection
For monitoring and responding to threats on compatible computers and servers.
Explore Huntress Managed EDR →Microsoft 365 identity protection
For suspicious activity involving supported Microsoft 365 accounts. Complements device protection.
Explore Huntress ITDR →Managed extended protection
For managed security operations across your selected Heimdal modules. Heimdal NGAV is required as a minimum; broader coverage depends on the modules deployed.
Explore Heimdal MXDR →How to compare providers fairly
Ask the same questions of every provider, including Black Swan. A promise of “24/7 protection” needs some detail behind it.
- What exactly is covered? Ask for devices, accounts and connected systems to be listed.
- Who investigates at night? Confirm human coverage and the escalation route.
- What can the team actually do? Separate alerts, containment, remediation and recovery.
- What needs our permission? Agree response authority and emergency contacts.
- What information leaves our systems? Ask about collected data, access, retention and processing arrangements.
- What costs extra, and how do we leave? Check additional work, minimum terms, renewal and offboarding.
The best fit depends on your environment and the help you already have. You don’t need to choose the platform before having that conversation.
Other questions you may have
Is MDR the same as antivirus?
No. Antivirus helps prevent and detect malicious activity. MDR adds a managed investigation and response service using the agreed security tools. We review your existing protection to avoid unnecessary duplication.
Is Managed EDR a type of MDR?
It can be. Managed EDR focuses the managed detection and response service on endpoints. MDR is a broader service term and does not, by itself, tell you whether identities, email or networks are included.
Is MXDR always better than Managed EDR?
No. MXDR can offer broader visibility when the relevant systems are connected. Whether that extra scope is useful depends on your risks, existing protection and budget. Compare the actual coverage and response arrangements.
Will this replace our IT support company?
It does not need to. Managed security can work alongside your existing provider. We agree who handles security response and who takes care of wider IT changes or recovery.
Are Microsoft 365 accounts included automatically?
No. Device monitoring and identity monitoring cover different activity. Account protection needs to be explicitly included in the proposed service and supported by the required integrations.
Can we buy it after an attack has started?
If you suspect an active incident, say so at the outset. Containment and investigation need to be scoped as incident work; a new monitoring subscription should not be assumed to include cleaning up an existing compromise.
How quickly can we get started?
That depends on device numbers, compatibility, access and the service selected. We first confirm the scope, arrange deployment and check that monitoring is working. We will agree a timetable with you rather than promise a fixed setup time for every organisation.
Go a little deeper
Plain-English guides to detection and response
Start with what you already have
Let’s work out who’s watching, and what’s missing.
Bring your current security products, IT support details and a rough device count. I’ll help you understand whether managed detection and response would fill a gap, and which approach makes sense for your organisation.
Kevin Walker · Founder, Black Swan Cyber Security Solutions
Book a free 30-minute conversationPrefer to call? 01246 927142 · hello@blackswancyber.co.uk
Meet Kevin: Founder & lead security consultant
Kevin has spent over 20 years solving real-world IT and cyber security challenges for organisations like yours. His approach is refreshingly straightforward: listen first, understand your constraints, then build security that actually works within your budget and compliance requirements.
Beyond technical expertise, Kevin brings a deep understanding of how organisations really operate, gained through years serving as a Parish Councillor, school governor, and charity trustee. He knows what it’s like to balance competing priorities, stretch budgets, and maintain public trust.
Whether you’re dealing with a security incident or simply want an honest assessment of your current protection, Kevin provides clear guidance without the sales pitch.
Ready to discuss your security needs?
Contact Kevin directly – no lengthy sales process, just practical advice from someone who genuinely wants to help.
