From Castle Walls to 24/7 Guards: Understanding the Journey to Managed Detection and Response (MDR)
April 24, 2026 ·
Cybersecurity has never been about a single tool. Traditionally, organisations have added layers of defence, each designed to address the weaknesses of the last. This journey, from basic endpoint protection to Managed Detection and Response (MDR), can be viewed using a simple but powerful analogy: a castle under attack.
This blog walks through that same progression, explaining why MDR exists, how it builds on endpoint security, and what problems it is designed to solve.
The Castle Analogy: A Simple Way to Think About Cybersecurity
Conwy Castle was built between 1283 and 1287 by King Edward I and in typical fashion included a ditch, moat, high stone walls, gates, towers and inner walls, all protecting the King within the innermost ward. The focus was very much to keep threats out.
Imagine your organisation as a castle.
The castle holds your most valuable assets: data, systems, intellectual property, and operations, and you protect these with firewalls, traditional antivirus, and possibly some basic endpoint tools. If they recognise an attacker trying to gain entry, they will be stopped at the gate.
The problem is that attackers are no longer using traditional methods to try and gain entry. They are constantly probing for weaknesses to circumvent the existing security in place. Modern attackers bypass the walls and helicopter-rappel directly into the Kings ward. They:
- Steal credentials
- Use legitimate tools
- Hide inside encrypted traffic
- Exploit human behaviour
When a threat actor uses a VPN vulnerability or stolen credentials to breach the firewall, they have simply gained control of the keys and walked straight through the castle gates. The walls, the moat, the towers and the ditches no longer help.
Recent findings show that median dwell time has increased to three days and ransomware remains firmly off-hours.
Layer 2: Advanced Endpoint Protection – Installing alarm systems and CCTV
To address this, endpoint protection evolved.
Modern endpoint security doesn't just block known malware; it:
- Analyses behaviour
- Detects suspicious activity
- Correlates actions across devices
In castle terms, this is like adding constant patrols and detection scanning for unusual movement. CCTV cameras and smoke alarms constantly recording. Guard dogs constantly barking at suspicious behaviour. This is a huge improvement, and for many organisations, this is where security investment stops.
But there is still a critical gap. Detection Does Not Equal Response. What if malware gets through?
Advanced endpoint tools are excellent at generating alerts.
However, alerts alone do not:
- Investigate themselves
- Decide whether something is truly malicious
- Take action at 3am on a Sunday
In the castle analogy:
- The watchtower spots movement
- The alarm rings
- But the humans remain asleep or on holiday!
This is where many breaches occur, not because tools failed, but because no one acted in time. Research shows that the overwhelming majority of ransomware happens out of hours. This is because when people are asleep or on the beach, they are not responding to alerts, and by the time they are back in the office it's too late!
Layer 3: Managed Detection and Response – The 24/7 Guard Force with the army on speed-dial
MDR is the moment where cybersecurity becomes operational, not just technical. It's where alerts are acted on in real time, where AI filters out false positives and where there is no such thing as alert-fatigue.
In practical terms, MDR delivers:
- Continuous monitoring by security specialists around the globe
- Expert-led Human validation of alerts (reducing false positives)
- Active threat hunting
- Synchronisation with your existing Cybersecurity vendors (Think Microsoft, Fortinet, Palo Alto, Sophos………….)
- Real-time response, including containment and remediation
Rather than asking:
"Did we get an alert?"
MDR answers:
"Someone investigated it, understood it, and dealt with it."
Why do I need MDR – I can monitor and act on the alerts myself?
When organisations ask us why an MDR solution is preferential to in-house management, the explanation is that one can manage detection and response internally, but very few organisations realistically have the facilities in place to do this.
To replicate MDR in-house, you would need:
- 24/7 staffing
- Highly skilled security analysts who will never leave your organisation
- Deep experience handling real attacks
- Constant training and threat intelligence updates
Even large organisations with dedicated security teams are frequently breached. For small and mid-sized organisations, attempting this internally often costs far more than outsourcing, with worse outcomes.
MDR exists because expert response is the hardest part to scale.
Where Endpoint Protection Fits In
MDR does not replace endpoint protection - it depends on it.
Endpoint tools:
- Collect telemetry
- Detect abnormal behaviour
- Generate high‑fidelity signals
MDR:
- Interprets those signals
- Confirms real threats
- Enables and executes playbook automation without the need for 24/7 inhouse experts, SIEM, or other expensive tools.
Think of endpoint protection as the eyes and ears - MDR is the brain and the hands.
Compliance, Insurance, and Visibility
A recurring theme in the webinar was that strong security is no longer just a technical concern.
MDR supports:
- Compliance: proof of continuous monitoring and measurable security posture are required for the likes of ISO 27001.
- Reducing cyber insurance premiums: insurers favour organisations that can prove active threat management. Some MDR vendors like Sophos will even underwrite breach claims provided they have been correctly set up.
- Governance: dashboards that clearly show risk, posture, and improvement areas
One key stat flagged by the UK government in February 2026 is:
Organisations with Cyber Essentials compliance experience 92% fewer cyber insurance claims than those without it.
MDR helps ensure those compliance controls are not just implemented but actively enforced.
Final Thoughts: Security Is about constantly adapting and preventing threats before they can act.
The key takeaway from the blog is this:
Cybersecurity is not about building higher or thicker walls, it's about knowing when someone is already inside and acting immediately.
MDR represents the natural next step in the evolution of endpoint protection:
- From prevention
- To detection
- To expert-led response
For organisations serious about reducing risk, improving resilience, and gaining real visibility into threats, MDR isn't an upgrade - it's maturity.