20 questions your MDR hopes you never ask.
Managed detection is bought on trust and renewed on inertia. The renewal is the one moment the upper hand is yours. This guide makes that conversation specific: what to ask your current provider and every alternative, why each question matters, and what a good answer sounds like.
- Four categories, five questions each, with a scoring worksheet.
- Score the service, not the SLA.
- Built to be used on every provider, including 7AI.
Get the MDR Evaluation Guide
What is inside
The four things that separate a service worth keeping from one you staff yourself.
Twenty questions, scored zero to two, for a maximum of forty points per provider. Score only what you saw demonstrated live, on real cases.
Coverage
What share of your alerts get a real investigation, and what happens to the rest.
Escalations
Whether an escalation is a complete investigation or a handoff of work back to you.
Customization
Whether the service learns your environment, or asks your environment to adapt to it.
Transparency
Whether the service shows its work, and what you keep if you decide to leave.
The comparison at the heart of the guide
Two operating models. One question: who does the work?
Traditional managed detection is people-led. A shared bench triages a subset of your alerts against playbooks, and capacity scales by hiring. The agentic model inverts it.
The guide
Bring your hardest alerts and your most skeptical analyst.
That is who we built it for. 7AI agents investigate every alert end to end, across endpoint, identity, cloud, email, and SaaS, with full reasoning one click from every conclusion and humans on the loop. We are prepared to answer all twenty questions, live, on real cases.
Evaluation Guide
What a good answer looks like
A verdict you can inspect, not a score you have to trust.
Question 17 in the guide asks whether you can see the full reasoning behind every verdict, including the ones closed as benign. Here is what that answer looks like from 7AI: a determination, the reason behind it, and the evidence, one click from every conclusion.