Managed detection and response for MSPs: how N-able's security chief explains MDR

Who is doing the explaining

This explainer draws on three N-able documents: a June 13, 2024 blog post, a May 30, 2024 podcast summary, and a May 20, 2021 press release. All three are the vendor's own publications. The ideas come from the company's chief security officer, speaking about a service category his employer sells.

The June 13, 2024 post by Pete Roythorne says it is built on an interview with the company's security chief. The May 30, 2024 podcast page describes the same conversation and names both participants.

MacKinnon's background explains part of his view of response. N-able's May 20, 2021 press release announced his hiring alongside a new general counsel. The release describes the scope of the role as covering the company's own security functions, including incident response. It also puts his career length at more than two decades.

The release says his previous role was at AT&T/WarnerMedia, where his work centered on handling major incidents. The release notes that N-able was formerly known as SolarWinds MSP. In his own statement at the time, MacKinnon framed his goal as a secure-by-design program that helps partners do three things: manage, detect and respond.

What MDR is, in this account

In the June 2024 blog, MDR is presented as a change in how security services work, not as one more tool. The central point is response. In this telling, detection alone is not the service. The provider is also expected to act to contain a problem.

The blog also describes MDR as broader than a single detection product. It says the approach has grown to connect with other technologies and to aim at reducing threats before they cause damage. It then gives a short definition that combines the two halves of the name.

Getting past the acronyms

The blog spends a section on how security categories are marketed. It reports that MacKinnon calls the situation "buzzword bingo." His advice to MSPs, as the blog reports it, is to look at what the service does for customers rather than at its label.

The documents do not set out a technical comparison of EDR, MDR and XDR. The podcast summary says the conversation covered "the differences between MDR and other technologies," but the written pages do not record those differences. The summary also says MacKinnon stressed choosing technology and detecting threats well as part of any MDR program.

What the blog says MSPs gain

The blog lists two benefits for managed service providers: expertise and cost-effectiveness.

On expertise, the blog says MDR gives MSPs at any level of security maturity the means to pull data together and spot threats across all of their clients. It links round-the-clock coverage to what an MSP can offer its own customers.

This benefit applies to the MSP's whole client base, not to one organization. An MSP serves many customers, and the blog's description centers on correlating events across all of them.

The cost of building a SOC

The second benefit is cost. The blog compares MDR with an MSP building its own security operations center. It names both staff and technology as cost drivers, "from hiring and training personnel to investing in the required technology infrastructure." It presents MDR as the alternative to that build-out.

The podcast summary confirms that SOC difficulty was a theme of the conversation. It says MacKinnon "highlights the challenges of building a Security Operations Center (SOC)." It also lists "the cost effectiveness of implementing MDR" among the topics. The documents give no figures for SOC staffing, tooling or MDR pricing. Any cost comparison would need numbers from elsewhere.

From security to resilience

The podcast is titled "Beyond the Horizons,From Security to Resilience with Dave MacKinnon." The documents do not define resilience as a separate discipline. They connect it to MDR in three places.

First, the blog sets MDR apart from the acronym debate because of its effect on how well a business holds up. Second, as quoted in the benefits section, the blog ties 24/7 monitoring and response directly to "enhancing business resilience" for an MSP's customers. Third, the podcast summary puts resilience next to the question of how MSPs explain the service to clients.

Read together, the documents present the shift from security to resilience as a shift toward response. Detection alone tells you a threat exists. Response that contains it keeps the business running. This matches the blog's statement that MDR is about acting "as swiftly as possible" to protect businesses. It also fits MacKinnon's earlier career as the 2021 release describes it, which centered on managing complex incident response events.

The podcast summary says the conversation ended on practical steps for putting MDR in place. The written pages do not describe those steps.

What the documents leave open

The material is short and comes from one source. It defines MDR by its focus on response, lists expertise and cost as the main benefits for MSPs, and ties both to business resilience. It does not give metrics, response times, service-level terms or a detailed comparison with EDR or XDR. A security leader can read it as the stated view of one vendor's CSO on why response, not only detection, is the core of the service MSPs offer their customers.