Ritu Sharma Sample
Head of security at a hospital group. Uptime is a patient safety issue. · member since Apr 2026
We cannot hire a night shift in our market. Three postings, nine months, two candidates, both declined. So the question is not really MDR versus in-house, it is MDR versus nothing overnight.
For those who made this decision: what did you actually measure afterwards? I want to avoid buying a feeling of coverage and calling it a result.
Priya Raghunathan Sample
Detection engineering lead. Writes the rules, tunes the noise. · 4 months ago
Measure three things: mean time to acknowledge overnight, the number of overnight escalations that turned out to be real, and how many of those your day team would have caught anyway by morning. The third number is the honest one and most people do not look at it.
Ours said the overnight value was concentrated in a handful of genuinely time-critical cases per year. That was still worth it, but it is a different business case than 'coverage'.
Marcus Feld Sample
One-person security team in an OT-heavy business. · 4 months ago
Add a fourth: how much of your team's day is spent managing the provider. Ours was about a day a week initially, mostly correcting environment context. It drops, but it is not zero and nobody quotes it.
Ritu Sharma Sample
Head of security at a hospital group. Uptime is a patient safety issue. · 3 months ago
Both very useful, thank you. The 'would the day team have caught it anyway' question is exactly the one I was failing to ask.