From EDR Management to a scalable cybersecurity service: the next step for MSPs

A managed service provider recently approached us with a question that many MSPs are currently wrestling with:

“Our customers increasingly expect us to take responsibility for their cybersecurity. But in practice, we only manage their EDR solution. How can we provide a broader security service when we have such limited visibility?”

It is an important question. Customers no longer see cybersecurity as a collection of individual products. They expect their IT partner to help protect the organisation as a whole. When an incident occurs, they are unlikely to ask which security tool detected it or which supplier was responsible for a particular control.

They will ask their MSP: "What happened, what did you do about it, and are we secure now?". That creates a difficult position for MSPs. They may be held accountable for the customer’s security posture while only having operational control over one part of the security environment.
 

EDR is essential, but it is not the complete picture

Endpoint Detection and Response is a valuable foundation for any managed cybersecurity service. It provides visibility into endpoints, detects suspicious activity and supports the containment of compromised devices. But an attack rarely remains confined to a single endpoint. A phishing email may lead to credential theft. The compromised account may then be used to access a cloud application. The attacker may communicate with malicious infrastructure through the firewall before moving laterally to another system.

An EDR platform may identify part of that activity, but it does not automatically provide the complete context across:

• email security;
• identity and access systems;
• firewalls and network controls;
• cloud environments;
• threat intelligence sources;
• SIEM platforms;
• vulnerability data;
• service desk and ticketing systems.

When these technologies operate independently, the MSP must manually move between portals, interpret separate alerts and determine whether apparently unrelated events are part of the same incident. That approach does not scale. It also makes it difficult to offer clear service levels, consistent response procedures and meaningful reporting to customers.
 

The MSP does not necessarily need more tools

The natural response may be to introduce another security product. However, most customers already have a range of security technologies in place.

The real problem is often not a lack of tools. It is a lack of integration, context and coordinated response. Replacing the customer’s existing security stack can be expensive, disruptive and commercially difficult. It may also result in previous investments being written off before they have delivered their full value. A more effective approach is to connect and orchestrate the technologies the customer already uses. The MSP can then build its cybersecurity service around an integrated operational layer rather than around a single security product. This is where Security Orchestration, Automation and Response — SOAR — becomes strategically important.
 

What does SOAR add to an MSP service?

A SOAR platform connects alerts, intelligence, systems and response actions into structured workflows. Instead of treating every EDR alert as an isolated event, SOAR can enrich it with information from other sources. For example, it can check whether an IP address, domain or file hash is known to be malicious, determine whether the affected device is business-critical and identify related activity elsewhere in the environment. The platform can then initiate an appropriate response workflow.

Depending on the scenario and the customer’s agreed policies, this may include:

• enriching the alert with threat intelligence;
• checking related indicators across other systems;
• creating and updating an incident case;
• notifying the appropriate stakeholders;
• isolating an endpoint;
• blocking a malicious domain or IP address;
• disabling or escalating a compromised account;
• documenting each action for reporting and audit purposes.

Repetitive tasks can be automated, while decisions that require judgement remain with an analyst. This combination is crucial. SOAR is not intended to remove people from the process. It allows analysts to spend less time gathering information and performing routine actions, and more time investigating complex threats and advising customers.
 

From limited visibility to coordinated security operations

For the MSP, the main advantage is not simply automation. It is the ability to create a broader and more consistent service. The EDR platform remains an important part of the solution, but it becomes one source of information within an integrated security operation. By connecting the customer’s existing security stack, the MSP can develop a more complete view of incidents without requiring every customer to adopt exactly the same combination of products. That is an important commercial consideration.

MSPs often serve customers with different firewalls, email platforms, cloud environments and endpoint solutions. A service that depends on replacing all of those technologies will be difficult to sell and expensive to deliver. An orchestration layer allows the MSP to work with the customer’s existing investments and gradually standardise the service processes around them. The value shifts from managing an individual security product to managing the complete incident lifecycle.
 

SOAR also creates a repeatable service model

A scalable cybersecurity service cannot depend entirely on the experience and memory of individual engineers. If every alert is handled differently, service quality becomes inconsistent. Response times vary, knowledge remains with specific employees and it becomes difficult to demonstrate that agreed procedures have been followed. SOAR playbooks allow the MSP to encode response procedures into repeatable workflows.

A playbook can define:

• which information must be collected;
• which systems must be checked;
• how severity is determined;
• which actions can be automated;
• when analyst approval is required;
• when the customer must be informed;
• how the incident must be documented.

This helps the MSP deliver a consistent service across customers and analysts. It also supports onboarding, quality assurance, compliance reporting and continuous improvement. Every action can be recorded, including the alert that triggered the process, the information used to make a decision and the response that followed. For customers, that creates transparency. For the MSP, it creates control.
 

The commercial opportunity for MSPs

An MSP that only manages EDR is primarily delivering a product-centred service. An MSP that combines EDR with integrated monitoring, threat intelligence, automated response and incident management is delivering a cybersecurity outcome. 

That opens the door to higher-value services such as:

• managed detection and response;
• continuous security monitoring;
• threat intelligence services;
• incident response retainers;
• compliance and executive reporting;
• security posture reviews;
• industry-specific threat briefings;
• proactive threat hunting.It also changes the customer conversation.

Instead of discussing licences and endpoint alerts, the MSP can discuss response times, risk reduction, coverage, incident handling and business resilience.
 

Our answer to the MSP

Our response was straightforward: Do not discard the EDR service. Build on it.
Use the EDR platform as a strong detection and response component, but connect it to a wider operational model. Integrate the customer’s existing security controls. Centralise incident handling. Enrich alerts automatically. Use playbooks to make response faster and more consistent. Introduce human expertise where it adds the most value. Most importantly, avoid forcing customers to replace technologies that are already working. A well-designed SOAR approach should help the MSP maximise the value of the customer’s existing security investments, not make them obsolete. WatchEagle SOAR is designed around this principle: connecting threat intelligence, incident management and automated response while working with the security stack already in place.

For MSPs, the opportunity is clear. Customers are already asking them to take greater responsibility for cybersecurity. The question is whether the MSP continues to manage individual tools or develops the integrated capabilities required to manage security outcomes. 

EDR may be the starting point. Integration and orchestration are what turn it into a scalable cybersecurity service.