Small Business MDR: Managed Detection and Response in Central MA

TL;DR: Small business MDR, or managed detection and response, is a service, not a product: people and tools that watch your systems and act when something looks wrong. Antivirus blocks known malware and a SIEM collects logs; MDR adds someone who reads them and responds. Before you sign, get response times and after-hours terms in writing.

What small business MDR actually covers is a question I hear more often from owners around Worcester. The term gets used loosely, so here is what it means, what a good service watches, who acts at 3am, and what drives the cost.

Short version up front: buy the response, not the dashboard.

What is managed detection and response, and how is it different from antivirus or a SIEM?

Antivirus is software on each device. NIST defines it as "a program that monitors a computer or network to identify all major types of malware and prevent or contain malware incidents." (NIST glossary, from SP 800-83) It is good at stopping things it recognizes. It does not phone anyone.

Endpoint detection and response (EDR) is the next step up on the device. Instead of only matching known malware, it records what programs do and flags behavior that looks like an attack, such as a word processor suddenly starting to encrypt files. Somebody still has to read what it flags.

A SIEM collects the records. NIST describes a SIEM tool as an application that can "gather security data from information system components and present that data as actionable information via a single interface." (NIST glossary, from SP 800-128) Actionable, once a person acts.

MDR is the people. It is a service where a team watches those signals for you and does something about them. Massachusetts' own grant program describes the MDR service it funds as "24/7 monitoring of endpoints, threat insights, proactive notifications, consultations on handling threats and false positives, and threat response," plus active threat hunting. (MassCyberCenter, NOFO 2026-Cyber-01, amended July 28, 2026)

Put them side by side. Antivirus is the lock. EDR and a SIEM are the cameras and the recorder. MDR is the person watching the screen who can also lock the door.

The NIST Cybersecurity Framework splits the job the same way. Detect: "Possible cybersecurity attacks and compromises are found and analyzed." Respond: "Actions regarding a detected cybersecurity incident are taken." (NIST CSF 2.0, February 2024) Every small business MDR offer covers the first sentence. How much of the second one it covers is the thing you are actually buying.

Does a small business need managed detection and response?

Not on day one, but the reasons to consider small business MDR are specific.

Verizon's 2026 Data Breach Investigations Report counts any organization under 1,000 employees as small, and of the ransomware cases where it knew the victim's size, "about 96% of Ransomware victims were SMBs." The same section says it is less about the victim's industry or revenue than the fact that victims had "credentials that were compromised (38%) or unpatched vulnerabilities in edge devices (29%)." (Verizon 2026 DBIR, small and medium-sized businesses) Attackers are not choosing you for your revenue. They are choosing a password that leaked or a firewall nobody updated.

The second reason is who finds the problem. IBM's 2026 Cost of a Data Breach study, run with the Ponemon Institute across 602 breached organizations, found that 17% learned about their breach from the attacker. Those breaches were the costliest, averaging $5.12 million, and took 268 days on average to identify and contain, against 209 days when the organization's own team found it. (IBM, Cost of a Data Breach Report 2026) Those are global averages across all sizes, so ignore the dollars. The pattern holds: whoever finds it first sets the clock.

NIST's small business guide is plain about the option. Under Detect, it says to "prioritize engaging a service provider to monitor computers and networks for suspicious activity if you don't have the resources to do it internally." (NIST SP 1300, Small Business Quick-Start Guide, February 2024)

Massachusetts adds its own reason. If you hold personal information about Massachusetts residents, 201 CMR 17.04 lists "reasonable monitoring of systems, for unauthorized use of or access to personal information" among the computer security requirements of your written security program. (201 CMR 17.04) The rule does not name MDR, and it scales "reasonable" to your size and resources. Amelia, my wife and Kief Studio's co-founder and CEO, covers the rest of that regulation in her guide to Massachusetts WISP requirements.

When is small business MDR too early? If you do not yet have multi-factor authentication on email, patched firewalls and tested backups, start there. Monitoring an unlocked building just gives you a clearer view of the break-in.

What should a good small business MDR service watch?

The honest answer starts with an inventory: what you run, where it runs, and who can reach it. A small business MDR quote before that is a quote for a product, not your business.

For most small businesses, the signals that matter fall into six places:

• Devices. Laptops, desktops and servers, through EDR.
• Sign-ins. Your email and office suite accounts. A login from a new country at 2am, followed by a new mail forwarding rule, is the kind of pairing worth an alert.
• Email. Phishing that got through, and messages sent from your accounts that your staff did not write.
• The edge. Firewalls, VPNs and remote access tools, the edge devices Verizon names above.
• Your own applications. The booking system, customer portal or line of business software your company actually runs on.
• Backups. Whether they ran, and whether someone changed or deleted them.

Here is the gap I see most. Many small business MDR services watch the laptops well and never look at the applications. If your IT provider covers the office and help desk but nobody watches the system your customers log into, that is a hole worth closing. Our notes on threat detection go deeper on which signals deserve an alert.

Ask about log retention too. CISA and its partners urge organizations to keep their most important logs "for at least six months." (CISA, NSA, FBI and partners, AA22-131A, May 2022) If an incident surfaces months later, the evidence has to still exist.

How should a small business MDR service respond when it finds something?

Logs nobody reads are not detection. And detection with no agreed response is just a well documented bad day.

A good small business MDR service has a written response path for each kind of alert: who acts, what they check, and what they do. For a small business, the questions that matter are about authority:

1. What can they do without calling you? Isolate a laptop from the network? Force a password reset? Disable an account that is sending phishing from your domain?
2. What needs your approval? Shutting down a server, blocking a vendor, taking the website offline.
3. Who do they call at your business, and who is second? Names and cell numbers, not a shared inbox.
4. What do they report afterward? What happened, what they did, what changed so it gets caught sooner next time.

CISA's guidance for customers of managed providers says each customer should make sure "their contract specifies whether the MSP or the customer owns specific responsibilities, such as hardening, detection, and incident response." (CISA AA22-131A, above)

For the play by play, see how incident response works and the first 24 hours after a breach.

Who acts at 3am, and what should the agreement say about response times?

My answer is short: 3am is a retainer, not a default.

The timing is not hypothetical. The FBI and CISA warned of "highly impactful ransomware attacks occurring on holidays and weekends," when offices are normally closed, and recommended "identifying IT security employees to be available and 'on call' during these times." (FBI and CISA, AA21-243A, August 2021)

Many small business MDR offers say "24/7." Read that closely. Software watching around the clock is not the same as a person with authority to act around the clock. Ask these, and get the answers in the contract:

• Which hours have a person watching, and which hours are automated alerts only?
• How fast does a person look at a high severity alert, at 3pm and at 3am?
• How fast is the first containment action after that?
• What counts as high severity, and who decides?
• Is after-hours response included, or billed separately?
• What is the restore target, not just the response target?

Response is how quickly someone starts working. Restore is how quickly the business is back. Amelia wrote a full piece on why response time is not resolution time, and our SLA notes cover how severity levels get set.

If after-hours response is not in writing, assume it is not there.

What drives the cost of small business MDR?

I looked for an independent survey of small business MDR prices and found none; the ranges online come from companies selling the service. Here is what moves the number instead.

• How many devices and users. In my experience, pricing scales with the count of devices, users, or both.
• How many log sources. Laptops only is one tier. Adding sign-ins, email, firewall and cloud apps is another.
• Hours of human coverage. Business hours costs less than a person on call overnight.
• How much response is included. Some services alert you and stop. Others contain the threat. Hands-on cleanup may be billed by the hour.
• Your own applications. Custom systems need custom detections, which take setup time.
• Onboarding and tuning. The first weeks are spent teaching the system what normal looks like for you, so real alerts stand out.
• Retention. Keeping logs longer costs more storage.

For perspective on doing it yourself, the Bureau of Labor Statistics puts the 2025 median pay for information security analysts at $129,180 a year. (BLS Occupational Outlook Handbook) A week has 168 hours. Covering every one of them with 40 hour shifts takes at least 4.2 people before vacations and sick days, which is more than $540,000 a year in median wages alone, by our arithmetic. That is why small business MDR means sharing a team instead of building one. I worked out what managed IT costs per user against an in-house hire.

Whatever you pay for small business MDR, price the response, not just the monitoring.

Can a Massachusetts grant pay for part of small business MDR?

Yes, through one specific program whose terms changed this summer.

The Cyber Resilient Massachusetts Grant Program is run by the MassCyberCenter at the Massachusetts Technology Collaborative. Under the current notice, issued March 18, 2026 and amended July 28, 2026, here is how it works (MassCyberCenter, Notice of Funding Opportunity):

• Who can apply: municipalities, nonprofits and small businesses in Massachusetts. Small businesses must meet the U.S. Small Business Administration's size standards.
• What it pays for: security operations center services, including MDR, from CyberTrust Massachusetts, a nonprofit that works with the MassCyberCenter. The grant funds that provider's services only.
• How much: "up to one-third of the cost of the services provided by CyberTrust Massachusetts plus an onboarding fee (if applicable)," for up to three years. This replaced the earlier fixed maximum award.
• How it is paid: small businesses and nonprofits are reimbursed. Grants only cover expenses incurred after the application is submitted.
• How to apply: you first get a scope of work from CyberTrust Massachusetts, then include it in the application. Applications are reviewed on a rolling basis until the funds run out.

Older pages around the web still show the fixed dollar caps from earlier versions. Go by the amended notice, and check eligibility before you plan a budget around it. The program's background is on the MassCyberCenter's SOC and Range Initiative page.

The state has a reason to care. The Office of Consumer Affairs and Business Regulation received 2,292 data breach submissions in 2024, and its joint analysis with the MassCyberCenter concluded that "the largest exposure continues to arise from gaps in detection, monitoring and attribution capabilities." Additional monitoring was named 143 times among the 471 breaches where companies reported what they fixed afterward. (OCABR and MassCyberCenter, Examining the Impact of Data Breaches in Massachusetts, May 2026) I broke down the 2025 Massachusetts data breach numbers separately.

How should a Central MA small business start?

A small business MDR plan a ten person office in Worcester, Shrewsbury or Westborough can run this month:

1. List what you run. Devices, accounts, applications, and every vendor with remote access. One page is fine.
2. Close the basics. Multi-factor authentication on email, firewall and VPN firmware current, backups tested by actually restoring a file. See vulnerability management for patching.
3. Pick the signals. Start with devices, sign-ins and email. Add your own applications next.
4. Write the authority list. Who can approve isolating a machine or taking a system offline, with a second person for when the first is on a plane.
5. Decide the hours. Business hours only, or an after-hours retainer. Decide on purpose, and get it in writing.
6. Check the grant before you sign anything, since it only covers costs after you apply.
7. Ask for a sample. A real, anonymized alert, what was done about it, and the report you would get.

This article is general information, not legal advice. Kief Studio is not a law firm, and reading it does not create an attorney-client relationship. Laws and regulations change, so check the current text and talk with a licensed Massachusetts attorney about your situation.