Some of what you see here is sample content. While the community forms, part of the members, reviews, ratings and discussions are seeded examples. Every one is badged Sample, and they do count towards the totals on this site. Vendor pages, the security data and the tools are real.
Forums › SIEM & SOC operations

MDR versus building a second shift: how did the numbers work for you?

Question about Arctic Wolf 2 Jul 2026 840 views
Ritu Sharma Sample Head of security at a hospital group. Uptime is a patient safety issue. · member since Apr 2026

We cannot hire a night shift in our market. Three postings, nine months, two candidates, both declined. So the question is not really MDR versus in-house, it is MDR versus nothing overnight.

For those who made this decision: what did you actually measure afterwards? I want to avoid buying a feeling of coverage and calling it a result.

3 replies

Priya Raghunathan Sample Detection engineering lead. Writes the rules, tunes the noise. · 4 months ago

Measure three things: mean time to acknowledge overnight, the number of overnight escalations that turned out to be real, and how many of those your day team would have caught anyway by morning. The third number is the honest one and most people do not look at it.

Ours said the overnight value was concentrated in a handful of genuinely time-critical cases per year. That was still worth it, but it is a different business case than 'coverage'.

Marcus Feld Sample One-person security team in an OT-heavy business. · 4 months ago

Add a fourth: how much of your team's day is spent managing the provider. Ours was about a day a week initially, mostly correcting environment context. It drops, but it is not zero and nobody quotes it.

Ritu Sharma Sample Head of security at a hospital group. Uptime is a patient safety issue. · 3 months ago

Both very useful, thank you. The 'would the day team have caught it anyway' question is exactly the one I was failing to ask.

Sign in or join to reply.