Glossary term
MDR (Managed Detection and Response)
Also: Managed Detection and Response, 24/7 SOC-as-a-service
A service that provides outsourced 24/7 monitoring, detection and response on top of an EDR or XDR platform. MDR replaces the need to staff a full in-house security operations centre while keeping incident ownership internal.
MDR is the dominant answer to the gap between rising threat volume and the limited supply of senior SOC analysts. The provider runs 24/7 monitoring, correlation and initial response on agreed tooling; the customer keeps strategic ownership of the security programme and major incidents.
MDR selection is tightly coupled to EDR or XDR selection because most MDR partners support a limited set of underlying platforms. Picking MDR first and EDR second is often cleaner than the reverse, especially in mid-market enterprises without a mature SOC.
In practice
Dealbreakers in MDR decisions: EU-based SOC with German-speaking analysts where required, response SLA (minutes vs hours to first action), data residency of the telemetry store, and the explicit scope of response authority (contain vs advise).
Related terms
EDR (Endpoint Detection and Response)
A class of endpoint security tools that continuously records endpoint activity and enables detection, investigation and response to threats that evade traditional antivirus. Most enterprise security incidents today are detected or contained at the EDR layer.
XDR (Extended Detection and Response)
A security platform that unifies telemetry across endpoint, network, identity, email and cloud, correlating signals that would otherwise be siloed across point tools. XDR is EDR plus the context to detect multi-stage attacks that a single sensor would miss.
SIEM (Security Information and Event Management)
A platform that centralises security logs, enables long-term retention, runs correlation rules and supports investigation. SIEM is the evidence layer under EDR, XDR and SOC operations and the single largest line item in most security budgets.
MFA
Authentication combining at least two factors from knowledge (password), possession (hardware token, smartphone) and inherence (biometrics). Mandatory under NIS2 Art. 21 (j) and DORA Art. 9.
AI Act Conformity Assessment
Procedure to demonstrate that a high-risk AI system complies with the EU AI Act before being placed on the market or put into service. Mandatory for all Annex III high-risk systems from 2 December 2027 (postponed from the original 2 August 2026 by the Digital Omnibus, Regulation (EU) 2026/1744).
AI Act Risk Categories
Four-tier classification under the EU AI Act: prohibited (Art. 5), high-risk (Annex I/III), limited risk (Art. 50 transparency), minimal risk. Classification is the first duty; it must be documented and defensible.
Audit-ready decision
A decision whose record is structured, evidence-backed and stakeholder-signed to a level that a third-party auditor, a supervisor or a board reviewer can reconstruct the reasoning without interviewing the original team.
BAIT
BaFin circular that concretises IT requirements for credit institutions. Specifies MaRisk AT 7.2 for IT strategy, information security, user permissions, project management, application development, and IT outsourcing.