Palo Alto is the mirror image of the endpoint replacement. They leave your Defender agents alone and replace the layer above, which makes this a security data platform decision wearing a managed service label.
Critical Start publishes what nobody else in this market does: a response time with a defined start, a defined stop, and service credits when they miss. Plus the known-good registry that makes resolving every alert economically possible, and the question you should ask about it.
Most MDR evaluations are decided by a demonstration and a reference call, which between them test the vendor sales engineering and their choice of referee. A scorecard you can defend to a board, and a provider-neutral proof-of-value plan that measures what actually comes back.
A managed detection provider inherits your logging gaps on the day they onboard. Establish what your tenant actually produces and retains before you take a single vendor demonstration, so the evaluation compares providers rather than measuring your own instrumentation.
Eight providers, one set of questions, and the answers do not line up the way the marketing suggests they should. Where the real differences sit, which published numbers mean anything, what an E5 organisation ends up paying for twice, and how to run an evaluation that produces a decision.
Red Canary was the reference implementation of vendor-neutral managed detection until Zscaler bought it in August 2025. That transaction turns a straightforward evaluation into a question about what happens when your zero trust enforcement vendor also holds your detection contract.
The purest expression of the operate-your-stack model: no agent, no platform to adopt, judgement sold against the tooling you already run. Expel has also done the best job in this market of writing down what its analysts may do and what happens when it goes wrong.
What does an organisation with Business Premium, no security staff and a few hundred endpoints actually do? Huntress operates the Microsoft licences you already hold rather than selling a replacement for them, and that constraint has produced some of the most practical engineering in this series.
