MDR vs SOC vs SIEM vs EDR vs XDR:
Which Do You Actually Need?

A SOC (Security Operations Centre) is the broader capability: a team of analysts using SIEM, EDR, and threat intelligence to monitor and respond to threats across your entire estate. MDR (Managed Detection and Response) is a specific outsourced service that typically focuses on endpoint and identity-layer threat detection, often delivered via a managed EDR platform with 24/7 analyst response. A SOC ingests logs from everywhere; MDR focuses on endpoint telemetry with response action included. In practice, most managed SOC services include MDR functions and most MDR services include broader log monitoring, so the line has blurred since 2022.

An MSSP (Managed Security Service Provider) sells a broad portfolio: firewall management, vulnerability scanning, patch management, anti-malware, and sometimes SOC services. MDR is a focused outcome-based service: continuous detection and active response to threats. Traditional MSSPs alert you to issues; MDR providers contain and respond. If a managed service provider tells you a critical alert is happening, that is MSSP behaviour. If they tell you they have already isolated the affected endpoint and revoked the compromised user session, that is MDR behaviour.

SIEM (Security Information and Event Management) is a technology platform. It collects, aggregates, and analyses log data from across your environment, then generates alerts based on correlation rules. MDR is a service: human analysts who triage those alerts, investigate, and take response action. You can have a SIEM with no MDR (you are responsible for triage) or MDR with no SIEM (the provider runs everything on their platform). The most common UK mid-market setup uses Microsoft Sentinel as the SIEM and a managed SOC or MDR provider as the response layer.

EDR (Endpoint Detection and Response) is a software product installed on endpoints to detect malicious behaviour and enable response actions. MDR is the service layer on top of EDR (or sometimes SIEM): humans operating the platform 24/7, triaging the alerts the EDR generates, and taking response action. Buying EDR without MDR gives you visibility but no operational coverage. Most UK organisations buying EDR for the first time also need either an in-house SOC or an outsourced MDR provider to operate it.

XDR (Extended Detection and Response) is the next-generation EDR: a unified platform that ingests endpoint, identity, email, cloud workload, and network telemetry into a single detection layer. MDR is the human service that operates a detection platform (EDR, SIEM, or XDR) 24/7 on your behalf. Increasingly the two converge: 'managed XDR' is MDR delivered on an XDR platform rather than EDR. CrowdStrike Falcon Complete, SentinelOne Singularity Complete, and Microsoft Defender XDR + managed services are examples of this convergence.

Not usually. A managed SOC typically includes MDR functions: 24/7 monitoring, threat hunting, endpoint detection, and incident response. MDR is a subset of what a full SOC delivers. The decision is not 'both' but 'which scope': if your primary risk is endpoint compromise (ransomware, malware, insider abuse), MDR is sufficient. If your risk extends to network anomalies, cloud configuration drift, identity attacks, and SaaS account compromise, a managed SOC's broader log ingestion is necessary.

SOAR (Security Orchestration, Automation, and Response) is the workflow layer that sits between detection (SIEM/EDR/XDR) and response. It automates the playbooks an analyst would run manually: isolating an endpoint when a high-severity alert fires, disabling a user account on confirmed compromise, raising tickets, escalating to on-call. SOAR is usually invisible to the buyer of a managed SOC or MDR service: the provider runs it internally to make their analysts faster. You rarely buy SOAR standalone unless you are building your own in-house SOC.

The standard UK mid-market stack in 2026 is: EDR product (Microsoft Defender for Endpoint, CrowdStrike Falcon, or SentinelOne) + managed SOC operating on Microsoft Sentinel or Elastic SIEM, with MDR-style response built into the SOC service. This delivers endpoint coverage, broader log monitoring, and 24/7 human response from a single provider. Pricing typically runs £900 to £5,000 per month depending on endpoint count and log volume.

Precursor delivers managed SOC (broader coverage, all log sources, ISO 27001 / NIS2 / DORA compliance evidence), MDR (endpoint and identity-focused, faster deployment), and managed EDR (operates your existing CrowdStrike, Defender, or SentinelOne licence). We operate Microsoft Sentinel and Elastic as SIEM platforms within these services. We do not sell XDR as a standalone product; XDR functions are delivered as part of our SOC and MDR services using the platforms we operate.