MDR Providers in Australia and New Zealand: How to Compare Them in 2026

What to look for in an MDR provider

Ten questions. Ask all of them, in writing, and compare the answers side by side. The ones providers answer vaguely are the ones that matter most.

1 - Is the security operations centre genuinely 24/7, and where are the analysts?

"24/7 monitoring" sometimes means a platform runs continuously while humans work business hours. Ask directly: at 3am on a Sunday in Sydney or Auckland, who reads the alert, where are they sitting, and what are they authorised to do without waking you up?

Ask for the follow-the-sun model in detail. Ask how many analysts are on shift. Ask whether the overnight shift is the same organisation or a subcontracted partner SOC, because several providers in this market run a hybrid model where local oversight is layered over an offshore partner SOC.

2 - Does the service contain threats, or only tell you about them?

This is the single biggest difference between MDR offerings sold at similar prices. Some tiers are notification only. You get told an endpoint is compromised and it is your problem from there. Others include triage, false positive review and active containment such as isolating a device or disabling an account.

Get the response authority in writing. Which actions can the provider take unilaterally? Which need your sign-off? What happens at 3am when nobody answers the phone?

3 - Does it work with what you already own?

Most organisations in Australia and New Zealand already run Microsoft Defender and Microsoft 365, and many have Sentinel. A provider that requires you to rip that out and deploy their preferred endpoint agent is selling you a platform migration, not a service. Confirm compatibility in writing before signing, because some providers are tied tightly to a single endpoint vendor.

4 - Where is your data stored, and under whose jurisdiction?

Ask where telemetry and logs are stored, for how long, and under which country's law. For Australian organisations subject to the Privacy Act 1988 or the Security of Critical Infrastructure Act, and New Zealand organisations working to the NZ Privacy Act 2020 or the New Zealand Information Security Manual, this is a governance question your board will eventually be asked about. Get the answer before that happens.

Retention length matters more than people expect. If an intrusion is discovered six months after initial access, ninety days of log retention means you cannot reconstruct what happened.

5 - What are the response time commitments, and what happens when they are missed?

Ask for the time to acknowledge, the time to triage, and the time to contain, as separate numbers. A single blended "response SLA" tells you very little. Then ask what the remedy is when the commitment is missed. If there is no remedy, it is a target, not a service level.

6 - How will the provider handle the Essential Eight transition?

This is the question almost nobody is asking yet, and it will matter to every Australian organisation buying MDR in 2026.

But if you are signing a three-year MDR contract whose entire compliance reporting story is built on Essential Eight maturity levels, you are buying reporting that will need to be re-mapped inside that contract term.

Ask the provider: how are you tracking the Essentials series consultation, and what is your plan for re-mapping our reporting when the new chapters publish? A provider who has not thought about it is selling you a dashboard, not a compliance capability.

For New Zealand organisations, the equivalent question is how the provider maps reporting to the New Zealand Information Security Manual and NZ Privacy Act 2020 obligations rather than treating New Zealand as an afterthought on an Australian service. More detail on the framework itself is on our Essential Eight page.

7 - Who actually reads the reports, and can they brief a board?

Detection and response generates technical output. Boards and audit committees need something else entirely: what risk are we carrying, is it moving, and what are we doing about it.

Ask whether the provider can produce board-level reporting and, more importantly, whether there is a senior person who can sit in the room and explain it. This is where most pure-play MDR services stop. The service ends at the alert queue and the translation to business risk is left to you.

8 - What happens during a real incident?

Ask for the incident response pathway. Not the marketing version, the actual runbook. Who declares an incident? Who contacts you and how? At what point does forensic capability get involved, and is that in scope or a separate engagement at day rates?

Ask whether they have handled a real containment in an organisation like yours, and ask them to talk you through it. Anonymised is fine. Vagueness is not.

9 - Does the reporting hold up to your obligations?

Australian organisations with turnover above the relevant threshold now have ransomware payment reporting obligations, and notifiable data breach obligations apply under the Privacy Act 1988. New Zealand organisations have notification obligations under the NZ Privacy Act 2020. Financial services entities in Australia carry APRA CPS 234 and CPS 230 obligations. Aged care and residential care providers carry obligations under the Aged Care Act 2024 alongside ACQSC oversight.

The practical question: when you have to notify a regulator inside a tight window, will the provider's output give you the timeline, scope and evidence you need? Ask to see a redacted example.

10 - What are the contract terms and the exit?

Month-to-month and no lock-in arrangements are increasingly common in this market. Longer terms are not automatically bad, but they should buy you something. Ask what happens to your historical log data if you leave, whether you can export it, and in what format.