MDR (Managed Detection and Response) Services Selling to Mid-Market — 60-Min Training

Question

Pulse RevOps · The Machine · Accepted Answer

### Direct Answer

> **MDR (Managed Detection and Response) Services Selling to Mid-Market** is a 60-minute training for enterprise account executives, channel managers, and sales engineers running $90K–$450K ACV cycles against incumbents like **Arctic Wolf**, **Sophos MDR**, **eSentire**, **Red Canary**, **Expel**, **Huntress**, **Rapid7 MDR**, and **CrowdStrike Falcon Complete**. The session teaches sellers to qualify against the **three-buyer reality (CIO, CISO/Director of Security, Cyber-Insurance Broker)**, run a structured discovery on **MTTD/MTTR economics**, demo against the customer's actual EDR telemetry, and trap-set the multi-year renewal at month 14. Built on the **MEDDPICC qualification model**, **Force Management's Command of the Message**, and **Jeb Blount's "Fanatical Prospecting"** outbound cadence.

---

## Section 1 — Why MDR Selling Is Different (5 min)

Open the room by killing the SaaS-seller default. MDR is **not** a pure technology sale — the customer is buying **24/7 staffed SOC analyst hours** wrapped in a platform. The CIO, CISO, and cyber-insurance broker each have different scoreboards.

Set the frame on the whiteboard.

- **Three buyers, three scoreboards.** The CIO funds the line item; the CISO measures detection efficacy; the cyber-insurance broker uses the vendor's vetted-vendor status to lower the customer's premium. **Coalition's 2026 broker survey** shows 47% of mid-market MDR purchases are initiated by the cyber-insurance broker, not the CISO.
- **Insurance carriers are the silent fourth buyer.** Marsh, Aon, Beazley, Coalition, At-Bay, and Resilience all maintain **vetted-vendor lists**. Placement on those lists is worth ~30% lift on inbound pipeline for any MDR vendor.
- **Mid-market is bandwidth-constrained, not capability-constrained.** Most mid-market customers have a 2–6 person security team. MDR is hired to be the SOC, not to augment one. The selling motion is therefore **outcomes-first**, not feature-first.

End the segment with **Jeb Blount's** rule read aloud: *"Mid-market doesn't buy capability. They buy peace-of-mind backed by SLA."*

---

## Section 2 — The 60-Minute Discovery Block (15 min)

The discovery cadence the room must practice — verbatim. Pair AEs and roleplay — one plays the CISO, one plays the seller. The script:

> 1. **Opening (3 min):** "Walk me through your last 24 months of security incidents — not the noisy alerts, the real ones. What was MTTD and MTTR on each?"
> 2. **Coverage baseline (10 min):** "What is your current endpoint coverage by your EDR? **92%+** is best-in-class — anything less is an attacker path. Where are you?"
> 3. **MTTD/MTTR baseline (12 min):** "What is your current median time-to-detect and time-to-respond? **Sub-10 min MTTD and sub-20 min MTTR** are the bars carriers require for ransomware-readiness attestation in 2026. What are your numbers?"
> 4. **Analyst capacity (10 min):** "How many SOC analysts do you have today? Are they 8x5 or 24x7? **Senior SOC analysts cost $185K–$240K loaded** in 2026 US. Walk me through the math on your current SOC."
> 5. **Insurance posture (10 min):** "Is your cyber-insurance broker pushing you toward a vetted MDR? Who is your broker, and what are they recommending?"
> 6. **Auto-triage maturity (5 min):** "What percentage of your alerts auto-close today? **65%+ auto-triage** is best-in-class. Where are you?"
> 7. **Renewal posture (5 min):** "When is your current MDR or SIEM contract up for renewal? What contractual extraction friction would we need to navigate?"

Coach the room on the **one-skill rule** — every AE picks one inspection block per quarter. Force Management's playbook insists on one habit per call.

```mermaid
flowchart TD
    A[AE Schedules 60-Min Discovery] --> B[Send Pre-Brief 24 hrs Prior]
    B --> C{CIO + CISO + Broker Confirmed?}
    C -->|No| D[Reschedule No Exceptions]
    C -->|Yes| E[Opening + Coverage Baseline 13 min]
    E --> F[MTTD MTTR + Analyst Capacity 22 min]
    F --> G[Insurance + Auto-Triage + Renewal 20 min]
    G --> H[Confirm Next Step Pilot Scope Workshop]
    H --> I[Pre-Workshop Brief Sent All 3 Personas]
    I --> J[90-Min Pilot Scope Workshop Within 7 Days]
    J --> K[Pilot Kicked Off Within 14 Days]
```

---

## Section 3 — The Pilot That Wins (15 min)

The pilot is where MDR deals are actually won. Walk the room through the three pilot-failure modes and the three pilot wins.

**Failure modes to ban.**

- **Sandbox-only pilots.** Pilots that run against the vendor's test environment do not convince the CISO of real-world MTTD/MTTR.
- **30-day pilots.** Too short to capture a meaningful range of incidents. Push for **60–90 days minimum**.
- **One-channel pilots.** Pilots that cover only endpoints, not identity logs and cloud workload, fail to convince the buyer of full-estate coverage.

**Wins to coach.**

- **Real production telemetry.** Walk the room through **Expel's and Red Canary's published pilot agendas** — both require the customer to

MDR (Managed Detection and Response) Services Selling to Mid-Market — 60-Min Training

Direct Answer

Section 1 — Why MDR Selling Is Different (5 min)

Section 2 — The 60-Minute Discovery Block (15 min)

Section 3 — The Pilot That Wins (15 min)

Section 4 — Handling the Incumbent Trap (10 min)

Section 5 — Pricing Conversation and Procurement (10 min)

Section 6 — The Trap-Set for Renewal at Month 14 (5 min)

FAQ

Sources

MDR (Managed Detection and Response) Services Selling to Mid-Market — 60-Min Training

Direct Answer

Section 1 — Why MDR Selling Is Different (5 min)

Section 2 — The 60-Minute Discovery Block (15 min)

Section 3 — The Pilot That Wins (15 min)

Section 4 — Handling the Incumbent Trap (10 min)

Section 5 — Pricing Conversation and Procurement (10 min)

Section 6 — The Trap-Set for Renewal at Month 14 (5 min)

FAQ

Sources

What does the score mean?