Questions to Ask About Healthcare MDR in 2026

There is an old philosophical puzzle about whether a tree falling in an empty forest makes a sound.

Cybersecurity has its own version: if an alert fires at 2:13 a.m. and nobody investigates it until breakfast, was it really monitored?

Technically, yes. Practically, not so much.

This is the distinction at the heart of managed detection and response, or MDR. Plenty of products can collect alerts. Far fewer services can understand your environment, distinguish suspicious behaviour from the everyday eccentricities of clinical technology, and take sensible action before a security incident becomes a patient-care problem.

For mid-sized healthcare providers, choosing MDR is particularly difficult. The average estate is rarely a pristine collection of modern devices, neatly labelled and serenely awaiting updates. It is more likely to include cloud platforms, remote workers, diagnostic equipment, third-party portals, Microsoft 365, specialist applications and at least one business-critical system that everyone agrees should be replaced but nobody is allowed to switch off.

This does not make the organisation careless. It makes it a healthcare organisation.

The question, then, is not simply: “Do we need managed cybersecurity services for healthcare?”

It is: “Can this provider protect the organisation we actually have?”

Here are the questions worth asking.

1. What exactly will you be able to see?

Every MDR conversation should begin with visibility.

Ask the provider to define which parts of your environment will be monitored:

• End-user devices
• Servers
• Microsoft 365 and cloud identities
• Firewalls and network infrastructure
• Clinical applications
• Medical or diagnostic devices
• Remote-access services
• Third-party connections
• Unsupported or difficult-to-instrument systems

Then ask the slightly less comfortable follow-up: What will you not be able to see?

This is often the more revealing answer.

A provider may have excellent endpoint detection technology but limited visibility into a legacy imaging system, specialist laboratory platform or vendor-controlled medical device. That limitation is not automatically disqualifying. Pretending it does not exist should be.

Good clinical systems monitoring begins with an honest map of the estate, including blind spots, dependencies and owners. NHS England’s current board assurance guidance expects organisations to maintain complete asset inventories, classify assets by their importance to essential functions and record relevant dependencies. It also expects critical log sources to be onboarded and functioning. That makes visibility a governance question, not merely a technical feature. NHS England’s board and executive assurance guidance

2. How do you monitor legacy healthcare IT without disrupting it?

The standard security answer to an old system is “patch it”.

The standard clinical answer may be “we cannot, because the application vendor has not validated the patch, the device is under support restrictions, and taking it offline would cancel tomorrow’s clinics”.

Both answers can be reasonable. This is where grown-up risk management begins.

Ask prospective providers how they handle systems that cannot support a modern security agent or be patched on the usual schedule. A credible response might include network segmentation, restricted connectivity, hardened gateways, external monitoring, tightly controlled vendor access and enhanced logging around the system.

The NCSC recommends treating obsolete systems as untrusted, constraining their access and improving protective monitoring. Its more recent operational technology guidance also highlights segmentation, hardened intermediary systems and monitored access as compensating controls where obsolete devices must remain in service. NCSC guidance on obsolete products, NCSC secure connectivity guidance

MDR cannot sprinkle modernity over an unsupported operating system like parmesan. It can, however, help contain the risk while you pursue a realistic replacement plan.

3. Do you understand clinical criticality, or only technical severity?

Not every technically severe event should trigger the same response in healthcare.

Automatically isolating a compromised laptop in accounts may be entirely sensible. Automatically isolating a workstation controlling a clinical workflow may have consequences that deserve rather more thought.

Ask how the provider distinguishes between:

• Ordinary corporate devices
• Privileged administrative systems
• Patient administration platforms
• Diagnostic or treatment-supporting systems
• Devices required for immediate clinical operations

The MDR provider should work with you to define approved containment actions in advance. Some systems may be isolated automatically. Others may require confirmation from an authorised clinical or operational lead. The key is to make these decisions during a calm meeting, not during a ransomware incident when everyone is attempting to remember a policy document last opened eleven months ago.

Technical urgency matters. So does clinical safety.

4. Who responds at 2:13 a.m., and what are they authorised to do?

“24/7 monitoring” is one of those phrases that can mean almost anything.

It may mean a staffed security operations centre actively investigating alerts. It may mean an automated platform sending an email to an inbox. Somewhere, technically, a clock is involved.

Ask:

• Is the service staffed continuously?
• Are alerts investigated by analysts or simply forwarded?
• What are the response times for critical incidents?
• Can analysts isolate devices, disable accounts or block malicious connections?
• Which actions require your approval?
• Who is called if your usual contact is unavailable?
• Are response and containment included, or charged separately?

You are purchasing a decision-making service, not just an alarm. The contract should clearly state what happens between detecting suspicious activity and containing it.

The NCSC’s guidance for choosing a managed service provider recommends explicit responsibilities, incident-notification arrangements, access controls and service levels. It also stresses that the provider’s own security and recovery arrangements matter. After all, an MDR provider has privileged access to many customers. That makes it helpful, but also rather interesting to attackers. NCSC guidance on choosing an MSP

5. How will you learn what “normal” looks like here?

A private hospital is not a marketing agency wearing a stethoscope.

Its hours, systems, data flows and acceptable behaviour are different. Evening logins may be routine. A large diagnostic-data transfer might be legitimate. A supplier may need scheduled remote access to a clinical device. Conversely, an account viewing hundreds of patient records may warrant attention even if no malware is involved.

Ask how the provider tunes its service to your organisation:

• How is the environment baselined?
• How are clinical workflows documented?
• Who reviews false positives?
• How quickly are new systems and locations added?
• How are exceptions approved and revisited?
• Does the provider detect suspicious identity and data-access behaviour, as well as malware?

A service that never learns will either miss relevant activity or generate so much noise that people gradually stop listening. This is the cybersecurity equivalent of a car alarm on a busy street: energetic, technically functional and largely ignored.

6. What evidence will we receive for DSPT, UK GDPR and board assurance?

Compliance is not the same as security. But good evidence can reveal whether security is being managed with discipline.

The CAF-aligned Data Security and Protection Toolkit now applies to major NHS organisations and, for 2025–26, specified independent providers designated as Operators of Essential Services and nominated genomics organisations. The direction is clear: organisations are expected to demonstrate outcomes, oversight and continual improvement, not merely collect policies with reassuring filenames. DSPT guidance on CAF alignment

Ask what evidence the MDR provider can supply, including:

• Log-source coverage
• Alert and incident histories
• Investigation timelines
• Containment actions
• Monthly service reports
• Trend analysis
• Risk and improvement recommendations
• Evidence of testing
• Records suitable for auditors, commissioners and insurers

The board should receive more than a chart announcing that 46 million events were processed. Large numbers can be impressive, but so can the number of grains of rice in a cupboard. Neither tells you whether dinner is ready.

Useful reporting explains what changed, what remains exposed, what decisions are required and who owns the next action.

7. Will the service help us meet breach-reporting deadlines?

For reportable personal data breaches, the ICO expects notification without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Organisations should also have robust detection, investigation and internal reporting procedures. ICO personal data breach guidance

That clock does not wait for the next monthly service meeting.

Ask whether the provider can rapidly establish:

• What happened
• When it began
• Which systems and accounts were involved
• Whether personal or special-category data was accessed
• What containment action was taken
• What evidence has been preserved
• Who needs to be informed internally

Your provider should support the investigation and evidence-gathering process without pretending to replace your data protection officer, legal advisers or executive decision-makers.

Good healthcare data protection depends on clear handovers between technical, clinical, operational and governance teams.

8. How is your own privileged access protected?

An MDR provider may be given powerful access to identities, endpoints and security controls. Ask how that access is secured.

Look for:

• Multi-factor authentication
• Least-privilege access
• Separate administrative accounts
• Privileged-access monitoring
• Strong joiner, mover and leaver processes
• Time-limited or approval-based access
• Audit trails
• Controls over subcontractors
• Tested plans for an incident affecting the provider itself

Recognised certifications such as Cyber Essentials Plus or ISO 27001 can support due diligence, but check the scope. A framed certificate in reception is pleasant. It is less useful if the service you are buying sits outside the certified environment.

9. How does MDR connect to recovery?

Detection is only one part of resilience.

If a clinical system is encrypted, unavailable or considered unsafe, the organisation still needs to deliver care. Ask how the MDR service connects with incident response, business continuity, backup and disaster recovery.

Can the provider help determine whether backups may have been affected? Are recovery processes tested? Are critical-system dependencies understood? Can the security team work effectively with application suppliers, infrastructure partners and clinical leadership?

A smoke alarm is valuable. A smoke alarm, evacuation plan and functioning fire door are rather better.

MDR should be part of a broader healthcare IT security model that includes secure identity, vulnerability management, recovery testing, staff awareness and an agreed technology roadmap.

10. What happens after the first year?

The right provider should help reduce risk, not simply renew the same collection of alerts forever.

Ask how the service will measure improvement. Will it identify recurring causes? Will it highlight unsupported systems, excessive privileges and missing logs? Will it help prioritise investment? Can it show whether detection and response times are improving?

Most importantly, will it challenge you?

A useful security partner should occasionally say something inconvenient, tactfully and with evidence. That might concern a legacy platform, an unmanaged supplier connection or an executive exception that has somehow celebrated three birthdays.

Comfort is pleasant. Assurance requires a little more honesty.

The best MDR question is a human one

When assessing managed cybersecurity services for healthcare, it is easy to become absorbed by product names, dashboards and promises involving artificial intelligence.

The better question is simpler:

When something ambiguous and potentially serious happens, do we trust these people to understand our organisation and help us make a good decision?

Technology matters enormously. So do coverage, integration and technical competence. But MDR is ultimately a relationship conducted under pressure. The provider must understand that confidentiality, continuity and patient care are connected. It must be candid about blind spots, precise about responsibilities and calm when the situation is anything but.

That is what you are really buying: not the comforting fiction that incidents can always be prevented, but the ability to notice, understand and respond before uncertainty becomes chaos.

Concerned that legacy clinical systems or monitoring gaps are leaving your organisation exposed? Book a black box assessment to get a clear, practical view of your current cybersecurity risk.