Find the Right Managed Detection and Response (MDR) Service

Guidance on choosing a managed detection and response (MDR) provider frequently argues that smaller, “right-sized” providers deliver more attentive, higher-quality service than large ones, typically through appeals to intangibles like dedication and communication rather than data. This paper examines what is actually documented about the conditions underlying that argument: SOC analyst alert volume, burnout, and turnover. That data is extensive and describes a genuine, industry-wide crisis. It is not, however, segmented by provider size in any current public dataset, which means the central comparative claim in most size-based MDR guidance, that smaller providers structurally outperform larger ones on these dimensions, is asserted rather than measured.

Introduction

Advice on selecting an MDR provider often centers on a size-based intuition: a smaller, more focused provider will know a client’s environment better, communicate more consistently, and bring a stronger sense of ownership than a large provider managing hundreds of accounts. This is a plausible hypothesis. It is also, in most published versions of the argument, presented without engaging any of the substantial data that exists on the actual operational conditions inside a SOC, conditions that would need to differ systematically by provider size for the argument to hold as stated.

This paper takes the size-based hypothesis seriously enough to look for evidence rather than treat it as self-evident. It examines current data on SOC alert volume and analyst burnout, which is well documented, and then addresses directly why that data doesn’t currently support or refute a provider-size claim either way. It closes by identifying what client-provider fit might more defensibly depend on, given what’s actually measured.

What’s Actually Documented: SOC Alert Volume and Analyst Burnout

The operational strain inside a typical SOC is well established across multiple independent sources. Forrester research, cited across recent industry analysis, finds SOC teams receiving an average of roughly 11,000 alerts per day, against a genuine investigation need of about 22 alerts per analyst per day, a gap of nearly three orders of magnitude between volume and what any individual analyst can meaningfully review.

This volume translates into measurable human cost. The Tines Voice of the SOC Analyst report found 71 percent of SOC analysts report experiencing burnout, and separate industry benchmarks put average annual SOC analyst turnover around 28 percent, with average tenure sitting at 18 to 24 months, among the shortest of any role in the technology industry.

This is a genuine, well-documented crisis, and it’s a far more concrete foundation for evaluating an MDR relationship than the intangible language, dedication, sense of mission, comradery, that size-based guidance typically relies on instead. An MDR provider’s ability to retain experienced analysts and manage alert volume sustainably is, in principle, exactly the kind of operational reality that should determine whether a client gets consistent, high-quality attention over time.

The Provider-Size Question the Data Doesn’t Answer

Here is the central problem with most size-based MDR guidance, including arguments for favoring smaller providers: none of the alert volume, burnout, or turnover data above is publicly segmented by provider size. No widely cited study currently compares analyst caseload, burnout rates, or turnover between boutique MDR providers and large, high-volume ones. The crisis described in Figures 1 and 2 is presented in the available research as an industry-wide condition, not one shown to vary systematically with how many clients a given provider manages.

This means the intuitive case for smaller providers, that a limited client roster reduces the alert volume and account-switching burden on any individual analyst, is structurally plausible but not something this paper, or the source material for the original version of this argument, can actually demonstrate with current evidence. A boutique provider could staff its limited client base thinly enough to reproduce the same alert-volume and burnout conditions documented industry-wide. A large provider could deliberately cap analyst caseload below what the industry-wide averages in Figure 1 suggest. Provider size is a proxy for the variable that actually matters, analyst caseload and retention, not a direct measure of it, and the two are not guaranteed to move together.

What Client-Provider Fit Might Plausibly Still Depend On

None of this means provider size is irrelevant, only that it should be treated as a weak proxy rather than a settled predictor. A more direct and verifiable set of questions follows from the data in Figures 1 and 2 rather than from provider size alone: What is this specific provider’s analyst-to-client ratio, and how does it compare to the roughly 500-to-1 alert-to-capacity gap documented industry-wide? What is this provider’s analyst tenure and turnover, measured directly, rather than inferred from company size? How does the provider structure escalation and account ownership in a way that’s designed to resist the alert-volume pressure that drives burnout industry-wide, regardless of how many other clients the provider serves?

These are harder questions for a prospective client to get answered than “how big is this company,” which is part of why size becomes a stand-in for them. But they’re the questions actually supported by what’s documented about why MDR relationships succeed or fail operationally.

Where Market Consolidation Complicates a Simple Size Story

The MDR and broader managed security services market has continued to consolidate, with acquisition activity concentrating capability inside larger platform providers even as demand for specialized, sector-specific service continues to support smaller firms in parallel. This means the size distribution among available providers is itself shifting, and a framework for evaluating fit needs to hold up regardless of which direction a specific provider is moving, toward scale through acquisition or toward specialization through focus, rather than assuming the market will continue to offer a stable, binary choice between “big” and “boutique.”

Limitations and Open Questions

This paper’s argument has specific limits. First, the absence of provider-size-segmented data is a statement about current public research, not proof that no relationship between size and service quality exists; it may exist and simply be unmeasured, tracked only internally by providers or buyers who haven’t published it. Second, the alert volume and burnout figures in Figures 1 and 2 come from different sources with different methodologies and sample populations, and should be read as directionally consistent evidence of a real, industry-wide condition rather than as a single coherent dataset. Third, this paper does not have data on how many organizations actually use analyst-to-client ratio or measured turnover as stated evaluation criteria when selecting an MDR provider, as opposed to relying on size, brand recognition, or existing vendor relationships, which are almost certainly still the dominant real-world decision factors regardless of what a more rigorous evaluation framework would recommend.

Conclusion

The case for favoring a specific MDR provider, boutique or large, is more defensible when built on the operational conditions documented in Figures 1 and 2, alert volume relative to analyst capacity, and measured burnout and retention, than on size alone or on the kind of intangible, relationship-based language that dominates most current guidance on this topic. Provider size is a reasonable starting heuristic precisely because the more direct evidence, analyst caseload and turnover by provider, isn’t publicly available to check directly. Until it is, any claim that smaller providers systematically outperform larger ones on the dimensions that actually drive MDR relationship quality should be treated as a plausible hypothesis rather than an established finding.

References

1. Forrester, cited in UnderDefense. Alert Fatigue in Cybersecurity: The SOC Playbook to Eliminate It. 2026.
2. Tines. Voice of the SOC Analyst Report.
3. SANS Institute. 2025 SOC Survey.
4. ISC2. 2025 Cybersecurity Workforce Study.
5. Expel. 2026 Annual Threat Report.

Frequently Asked Questions