MDR (Managed Detection and Response) Services Selling to Mid-Market — 60-Min Training

What MDR actually is and why mid-market buys it differently

Managed Detection and Response is an outsourced security operations function: continuous monitoring of endpoint, identity, and cloud telemetry by a staffed analyst team that investigates alerts and takes containment action on the customer's behalf. The distinction that matters for sellers is that the customer is not buying detection logic — most MDR providers run on top of an EDR platform the customer may already own — they are buying analyst hours, escalation discipline, and a service-level commitment to respond at 2 a.m. on a Sunday.

That changes the sales motion in three concrete ways.

First, mid-market security teams are bandwidth-constrained rather than capability-constrained. A company doing $80M–$500M in revenue typically runs a security function of two to six people, often reporting into IT rather than to a standalone CISO. Those people already know what good detection looks like; they cannot staff three shifts to act on it. So a feature-led pitch — more detections, better ML, richer dashboards — lands flat, because the buyer's actual constraint is that nobody is awake to read the dashboard. The pitch that lands is coverage math: hours covered, alerts triaged without human escalation, and who picks up the phone.

Second, the buying committee is wider than the security org. The CIO or VP of IT usually owns the budget line and is comparing MDR against headcount and against the incremental cost of an in-house shift rotation. The CISO or Director of Security owns detection efficacy and cares about which log sources you ingest, what your escalation ladder looks like, and whether you can act — isolate a host, disable an account — or only notify. And increasingly the cyber-insurance broker functions as a third buyer, because carriers maintain vendor expectations and application questionnaires that ask directly about 24/7 monitoring and endpoint coverage. A renewal application that answers "yes, MDR in place, 24/7" prices differently than one that doesn't. Sellers who ignore the broker leave the strongest external forcing function on the table.

Third, the sale is a services sale with a services-sale renewal profile. Nobody churns a firewall mid-contract; plenty of companies churn an MDR provider that ghosted them during an incident. The revenue you book in month one is only real if the operational relationship holds, which means the seller's job doesn't end at signature — it extends to onboarding coverage and the first reporting cycles.

This is also why adjacent service lines sell on nearly the same mechanics. An incident response retainer, a vCISO engagement, a managed SIEM, even a penetration testing program — all four are bought by the same committee, justified with the same insurance and audit pressure, and won or lost on the same question: can you show measured outcomes rather than described capabilities? An AE who learns the MDR motion can carry the rest of the security services portfolio with modest retraining.

The step-by-step process from first meeting to signed pilot

Run the cycle as five gates, not as a stage-by-stage CRM ritual. Each gate has an exit condition; if the exit condition isn't met, you don't advance, you re-work.

Gate 1 — Multi-threaded first meeting. Do not accept a first meeting with only the security manager. Ask for the person who owns the budget and the person who owns detection in the same room. If you can only get one, the meeting still runs, but you treat it as a coach conversation and your explicit next step is an introduction. A first meeting held with a single mid-level contact is the single strongest predictor of a deal that stalls at proposal.

Gate 2 — Structured discovery. Sixty minutes, seven blocks, run in this order. Roleplay it in training with one rep playing the CISO:

1. Incident history (8 min). "Walk me through your last 24 months of real incidents — not the noisy alerts. What happened, who found it, and how long from first signal to containment?" You are listening for whether they can answer at all. Most cannot, which is itself the finding.
2. Coverage baseline (10 min). "What percentage of your endpoints, servers, and cloud workloads are actually reporting into your EDR right now — including contractor laptops and that one legacy subnet?" Uncovered assets are where the incident starts.
3. Detection and response timing (12 min). "What is your median time to detect and median time to respond today, and how do you measure it?" If they have no instrumentation, that becomes a pilot deliverable rather than a discovery answer.
4. Analyst capacity (10 min). "How many people can triage an alert, and what hours do they cover? What happens at 3 a.m.?" Then walk the staffing math out loud — true 24/7 coverage with vacation, attrition, and on-call sustainability requires meaningfully more than three people, and senior SOC analysts are expensive and hard to retain in most mid-market metros.
5. Insurance posture (10 min). "When does your cyber policy renew, who's your broker, and what did last year's application ask you about monitoring?" This surfaces both a deadline and an advocate.
6. Alert handling maturity (5 min). "What share of alerts get closed without a human touching them, and how many reach your team per week?" Alert volume per analyst tells you how burned out the team is.
7. Contract posture (5 min). "What's in place today — incumbent MDR, managed SIEM, nothing — and when does it end?" Renewal dates set your clock.

Gate 3 — Pilot scope workshop. Within seven days of discovery, run a 90-minute working session that produces a written scope: which log sources, which subset of the estate, what duration, what gets measured, who reviews it, and what the success criteria are in numbers. Unwritten pilot criteria are how "successful" pilots fail to convert.

Gate 4 — Pilot execution. Sixty to ninety days against production telemetry. Thirty days is too short to catch a representative incident spread; sandbox pilots prove nothing about the customer's environment. Mid-pilot, deliver a written scorecard: alerts ingested, alerts auto-resolved, escalations raised, time from signal to escalation, and any true positives found. That document is your closing artifact — it converts your claim into their data.

Gate 5 — Joint close. Proposal review with the economic buyer and the security owner together, with the broker invited to the readout when the relationship allows.

Note what is deliberately absent: a "send the deck" step. In this category the deck is a leave-behind, not a sales event. The events that move deals are the discovery, the scorecard, and the readout.

Costs, timelines, and the ranges reps should be able to defend

Reps lose credibility fastest when they cannot discuss the customer's cost structure as fluently as their own pricing. Train the room on four cost conversations.

Cycle length. Mid-market MDR cycles commonly run one to two quarters from first meeting to signature, with pilot-inclusive cycles landing at the longer end simply because the pilot itself consumes 60–90 days. Cycles compress sharply when there is a forcing event: a cyber policy renewal date, an audit or customer security questionnaire, a compliance deadline, or a recent incident at the company or a close peer. Cycles stretch when the buyer is exploring without a deadline, when the security owner has just started and is still assessing, or when there is an unresolved EDR platform decision upstream — you cannot sell response on telemetry the customer hasn't deployed yet.

The in-house comparison. The honest TCO conversation is not "we're cheaper than a SOC." It's a staffing conversation. Continuous coverage means shift rotation, and a rotation that doesn't burn people out needs redundancy on every shift plus coverage for leave and turnover. Layer in tooling, tuning time, and the recruiting cost of a role with high turnover, and the fully-loaded number for a genuine round-the-clock internal capability is well beyond what most mid-market IT budgets carry. Have the CIO do that arithmetic on the whiteboard themselves — a number the buyer computes is a number the buyer believes.

Pricing structure. Per-endpoint or per-asset pricing generally reads as fairer to mid-market buyers than a flat platform fee, because it scales with the fleet and survives headcount changes in both directions. Where per-asset pricing gets contentious is on servers, cloud workloads, and identity-only users — define those units in the proposal, not in the negotiation. Watch for pricing structures that punish the customer for sending more data; a model that penalizes better telemetry coverage works against the outcome you're both trying to buy.

Multi-year and discount discipline. Multi-year commitments are normal in this category and legitimately reduce the provider's cost to serve, so they justify a real discount — but set the ceiling internally before the rep is in the room, and hold it. The failure mode is a rep who trades three years of term for a discount so deep that the account is unprofitable to serve well, which then produces exactly the understaffed service experience that loses the renewal. Also negotiate the ramp: if the customer will double endpoints over the term, price the growth in rather than repricing later.

Time-to-value. Be explicit and conservative about onboarding. Log source integration, tuning to suppress the customer's normal-but-noisy behavior, and escalation runbook agreement take weeks, not days. Overpromising a one-week onboarding creates a customer who feels misled in month two — and in a services business, month-two disappointment is a month-fourteen churn.

Where teams get this wrong

Selling detection instead of response. The "R" is the differentiator and the hardest thing to fake. Ask any provider's reference customer what actually happened during a real escalation. Reps should be able to describe, precisely, what their own service is authorized to do without waiting for the customer: isolate a host, kill a process, disable an account, force a credential reset — and what the customer must approve first. Vague answers here are read by security buyers as an admission that the service is really a notification service.

Letting the pilot be unmeasured. A pilot with no baseline and no written criteria becomes a vibe check, and vibe checks are won by incumbents. Capture the "before" number even when it's ugly and estimated. If the customer genuinely doesn't know their current detection timing, making that visible is itself the strongest argument you'll make all cycle.

Skipping the broker and the questionnaire. The insurance and third-party-risk angle is the most underused lever in this category. Mid-market companies increasingly face security questionnaires from their own enterprise customers, and those questionnaires ask about monitoring coverage in ways that MDR answers cleanly. A deal justified by "we lose deals when we can't answer question 34" moves faster than one justified by risk reduction in the abstract, because it has a revenue number attached.

Running procurement without the security owner. When procurement asks for a solo commercial meeting late in the cycle, that meeting is designed to commoditize you against a competitor's line items. Push for the security owner to stay in the room — not as a stalling tactic, but because service scope differences are invisible on a price comparison sheet and only the security owner can explain why they matter.

Ignoring the incumbent's actual reporting. In competitive replacements, the sharpest question is simply: "what does your current provider report to you every month, and can you show me?" If the incumbent sends a volume dashboard with no outcome metrics, the gap sells itself. If the incumbent's reporting is genuinely excellent, you should know that early and decide whether the deal is worth the discount it will require.

Treating onboarding as someone else's problem. The account executive who disappears at signature and reappears at renewal has no standing at renewal. Stay attached through the first two reporting cycles. That's also where expansion into adjacent services — IR retainer, vulnerability management, identity monitoring, tabletop exercises — gets sold, and expansion in security services is consistently cheaper to win than new logos.

Overweighting analyst rankings in the pitch. Third-party research is useful air cover with a CIO who needs to justify the choice internally, but it does not answer the CISO's question. Lead with your own measured performance in their environment and let the analyst report be the second argument, not the first.

Decision framework: when MDR is the right recommendation

Not every prospect should buy MDR from anyone, and reps who can say so close more of the deals that remain. Train the room on a simple qualification tree.

If the customer has no EDR deployed, MDR is premature — the upstream platform decision has to land first, and trying to sell response before telemetry exists produces a pilot that measures nothing. The right move is to help them get the platform decision right, stay attached, and take the MDR conversation once agents are deployed.

If the customer has a mature internal SOC with genuine 24/7 staffing, full MDR is usually the wrong fit. The better motion is a scoped adjacency: overflow triage for off-hours, a targeted detection engineering engagement, or an incident response retainer that gives them surge capacity without replacing their team. Trying to displace a functioning internal SOC is a losing fight and it damages the relationship for the smaller sale you could have made.

If the customer has EDR deployed but only business-hours human coverage, that is the core MDR profile and the deal should be qualified aggressively.

If the customer has coverage but a contested incumbent, the deciding variable is switching friction: contract end date, integration depth, and whether the incumbent's reporting gives the buyer anything to defend. Time your cycle to the renewal date and use the pilot to produce the comparison the buyer cannot get from a slide.

Layer one more filter on top: forcing function. Rank every qualified opportunity by whether it has a dated external pressure — policy renewal, audit, customer questionnaire, board mandate, recent incident. Deals with a date close; deals without one become the pipeline that looks healthy in the forecast and never converts. That ranking is the single most useful forecasting discipline you can teach in a 60-minute session, and it transfers directly to every other security services line the team carries.

Related questions

How do I qualify an MDR opportunity in the first call?

Confirm three things: EDR is deployed, human coverage is business-hours only, and there is a dated forcing function such as a cyber policy renewal, audit, or customer security questionnaire. All three present means qualify hard. Missing the forcing function means nurture rather than forecast.

What should an MDR pilot actually measure?

Baseline versus pilot performance on alert volume reaching the customer's team, share of alerts resolved without customer involvement, time from first signal to escalation, and true positives surfaced. Document the criteria in writing before the pilot starts, and deliver a mid-pilot scorecard as the closing artifact.

How is selling MDR different from selling EDR?

EDR is a platform sale judged on detection capability and agent footprint; MDR is a services sale judged on response authority, escalation discipline, and coverage hours. EDR buyers compare feature grids. MDR buyers compare what actually happened the last time someone called at 3 a.m.

Should I involve the customer's cyber-insurance broker?

Yes, when the relationship allows. Brokers see the carrier questionnaires and know which controls affect renewal terms, so they often create urgency the security team cannot create internally. Ask who the broker is during discovery, then request a joint readout at pilot close.

What causes MDR deals to stall at proposal?

Usually single-threading — the deal was built with one contact who lacks budget authority — or an unmeasured pilot that gave the buyer nothing to defend internally. Both are preventable at gate one and gate three. Stalls late in the cycle almost always trace to a skipped gate early.

FAQ

How long does a mid-market MDR sales cycle typically run?

Most cycles run one to two quarters from first meeting to signature. Pilot-inclusive cycles land at the longer end because a credible pilot takes 60–90 days on its own. The strongest compression lever is a dated external event — an insurance renewal, audit, or customer questionnaire deadline — so surface that date in discovery and build the cycle backward from it.

Which buyer should the account executive prioritize?

Neither exclusively. The CIO or VP of IT typically controls the budget and evaluates MDR against headcount; the security owner evaluates detection coverage and response authority. Build the business case for the CIO and the technical proof for the security owner, and never let a single-threaded relationship carry the deal past discovery.

How do I compete against an entrenched incumbent?

Ask to see the incumbent's monthly reporting. Volume dashboards without outcome metrics create an opening; genuinely strong reporting tells you to qualify out or prepare for a price fight. Then time your pilot to the incumbent's contract end date so the buyer has fresh comparative data when the renewal decision lands.

Is a pilot always necessary to close?

No, but it materially raises win rates in competitive deals because it replaces claims with the customer's own data. Skip it when there is an urgent incident-driven need and the buyer wants coverage immediately — in that case, sell a short paid onboarding with defined checkpoints instead, which preserves the measurement discipline without the delay.

What qualification framework fits MDR deals?

MEDDPICC maps cleanly here because it forces explicit answers on metrics, economic buyer, decision process, and paper process — all four of which are where mid-market security deals commonly break. The metrics field in particular should hold real detection and response numbers from discovery, not a generic risk-reduction statement.

How should reps handle a prospect with no measured detection timing?

Treat it as the finding, not a dead end. Most mid-market teams cannot answer the question, and saying so plainly — without condescension — establishes credibility. Convert it into a pilot deliverable: the pilot establishes the baseline the customer has never had, which is itself a value the incumbent or in-house status quo has failed to deliver.

Sources

• https://www.cisa.gov/topics/cybersecurity-best-practices
• https://www.nist.gov/cyberframework
• https://csrc.nist.gov/pubs/sp/800/61/r2/final
• https://www.sans.org/white-papers/
• https://www.gartner.com/en/information-technology/glossary/managed-detection-and-response-mdr
• https://www.ncsc.gov.uk/collection/incident-management
• https://www.first.org/education/
• https://attack.mitre.org/
• https://www.verizon.com/business/resources/reports/dbir/

Related on PULSE

• [Endpoint Detection and Response (EDR) Selling to the CISO — 60-Min Training](/knowledge/st394)
• [Managed Security (MSSP) Selling — 60-Min Training](/knowledge/st356)
• [Incident Response (IR) Retainer Selling to the CISO and General Counsel — 60-Min Training](/knowledge/st397)
• [Cybersecurity Incident Response Engagement Selling — 60-Min Training](/knowledge/st367)
• [AI Safety / Red Team Services Selling to the CISO — 60-Min Training](/knowledge/st412)
• [Penetration Testing Services Selling to Tier-1 Enterprises — 60-Min Training](/knowledge/st384)