Most MDR pitches sound the same. Here are the questions that actually separate vendors:
1. What is your customer-to-analyst ratio? (Target: under 25:1. Above 50:1, your alerts are getting cursory triage.)
2. Will I have a named lead analyst? (If the answer involves 'pod' or 'pool', expect inconsistent quality.)
3. What's your MTTR SLA, and do you put it in the contract with credits for misses? (No SLA = no accountability.)
4. Do you tune detections, or just forward vendor defaults? (Untuned alerts are the #1 cause of MDR fatigue.)
5. Can I see your last 3 incident reports (redacted)? (Real ones, not marketing case studies.)
If a vendor dodges any of these, walk.