Detecting an intrusion requires someone looking at alerts at three in the morning. Covering every hour of every week with reasonable handover and leave cover takes a team, not a person, and that team needs to be busy enough to stay sharp. Below a certain size, building this in house produces an expensive rota that is bored most of the time and inexperienced when it matters.
Managed detection and response services provide that coverage as a subscription. They deploy sensors, watch the alerts, and escalate or act when something looks real. The good ones bring pattern recognition across many customers that a single organisation cannot develop alone.
The critical question when evaluating one is what happens after the alert. A service that emails you a notification at three in the morning has moved the problem, not solved it. Ask specifically whether they will isolate a host, disable an account, or block an address on your behalf, and get the boundaries of that authority in writing.
Ask also what data they need and where it goes. Security telemetry contains a great deal about your internal systems and, often, personal data. Under India's data protection framework this is a processing relationship that needs contractual terms, and if the provider stores logs outside India, that decision needs to be a deliberate one.
Coverage gaps are worth probing. Many services cover endpoints well and cloud infrastructure poorly, or watch the network and miss identity attacks that never touch it. Map their coverage against where your systems actually run before signing.
India's CERT-In directions require reporting of specified cyber incidents within six hours of noticing them. Whichever route you choose, the reporting obligation stays with you — so establish in advance who declares an incident and who files, because six hours disappears quickly during an actual event.
