Companies often don’t really know what they’re actually buying when procuring a cybersecurity subscription. Is it just “an antivirus” or are the added features like MFA, encryption, or… something called Inspect, truly worth the initial investment? And the deeper one goes, the more alien cybersecurity jargon becomes, with each vendor maintaining their own spin on standard nomenclature.
This is a challenge also recorded in ESET’s SMB MDR Research 20261: Only 33% know the term MDR, 31% know the term EDR, and 29% know the term XDR. However, behind every term there are secure outcomes that often get overshadowed by complex language, and while customers might know what they want, they wouldn’t know how to procure it.
To address this, security writer Ben Tudor sat down with ESET Security Monitoring Analyst Mitsuyuki Soto to explain how MDR turns telemetry into context, why human expertise still matters, and what customers gain when they have experienced defenders on call 24/7.
BT: Could you explain a little bit about the work that you do for ESET, and what your role is within the North American team?
MS: I manage the security services team in North America, overseeing a few different tiers of security monitoring analysts ranging anywhere from juniors to more mature experts. Our team focuses on delivering the security services. Customers range from those that are doing the monitoring themselves using our XDR-enabling solution, ESET Inspect, to on-demand support to customers who are utilizing our team to do the monitoring for them proactively; that's ESET MDR Ultimate.
The way I help the team is that, essentially, I provide them with guidance, pointing them in the right direction during difficult incidents. Sometimes I step in directly, offering further analysis and investigation. This, as well as, you know, helping build a team and support them in any way that I can.
How long have you been doing that?
I've been the manager of the team for just under three years. I'd been on the security services team as a team lead for just under three years before becoming manager.
In terms of the services that ESET provides, and the experiences that customers have had in that time, what has changed? Is there a clear drive toward something like MDR, or is it more of a bumpy road to get to the desired outcome?
Obviously, there've been changes in the products and processes. Before, we used to mostly focus on detections. Now, with everything becoming incident-based, investigations inside of Inspect allow us to be more holistic, particular.
So, things are constantly improving, not only for the customers who get a much more focused view, but also on our side.
When we're thinking about MDR, and about endpoint security or EDR, do organizations actually need it? What's the sort of sweet spot that you find where customers really see a huge benefit from going for a service?
I believe that all organizations need some form of MDR. The thing is, just like with endpoint protection, it’s able to help with detecting any kind of malicious files. But attacks can also originate via safe-looking executables from attackers trying to live off the land, and that's where MDR swoops in and helps detect these anomalies in behavior. It’s the experts [behind the service] that make the difference.
What sort of outcomes does that mean for the customer? What outcome are they getting when they go from EDR to MDR?
The outcome is much more focused. It enables them to save time and concentrate on things that are more impactful for their [daily] business. When something is confirmed as a true positive in their environment, the customer is then looped in.
Rather than sifting through noise, conducting investigations themselves, or having to hire and keep an in-house security expert trained, customers can offload that responsibility through MDR. They only need to get involved once something meaningful occurs, and incident response is required on their side.
When talking to MDR analysts, one of the things that often comes up is the amount of noise and sheer volume of stuff that a lot of the security teams need to wade through. Is that right, and if so, how do you guys face this problem?
MDR clearly helps quiet that down: Customers know that if there is a real problem, they will hear about it, but they no longer need to wade through that noise themselves to find the right signal. At the same time, MDR is often seen as a time saver precisely because, when it is doing its job well, the customer may not hear much at all. They might only see the value in retrospect, once they learn that potential attacks were investigated, contained, or stopped before they became incidents.
But then, how do you prove the value of MDR in those quieter months, when nothing appears to have happened because the service worked as intended? Is there a specific activity or reporting process that helps demonstrate that peacetime value?
As far as communicating the value of MDR, sometimes it can be a little bit difficult if things are uneventful. But, you know, the same thing can be said for things like buying car insurance. You have it in case something bad happens, and that's when you can validate its real value.
Some of the ways that we're helping communicate the value of MDR are through regular interactions we're having with customers, mapping their concerns, and generally being there as experts and, above all, humans, who they can reach out to.
Coming in part two: Mr. Soto takes us from quiet protection into active response, explaining what happens when MDR analysts move from monitoring signals to investigating real incidents, supporting customers, and turning a potential breach into a clearer path forward.
Additional references:
[1] ESET SMB MDR Research 2026 (sample size n=2 700 respondents). CAUTION: Combined figures are calculated from the whole-number percentages displayed in our charts; totals may differ slightly from calculations based on unrounded source data.
