Why MDR and DFIR providers will converge on the same work
MDR and DFIR providers have traditionally entered an incident at different points. The MDR provider watched the environment and decided whether suspicious activity needed escalation. The DFIR firm entered when detection and response had failed and the attacker was already inside. This division is breaking down. MDR providers want to take investigations further before handing them off, and DFIR firms want recurring work between major incidents. Both are moving towards the same service: continuous investigation built on evidence collected from the affected systems.
MDR buyers expect more than an alert
Forrester advises MDR buyers to test how detection, response and forensics work together, including whether forensic investigation requires a separate hand-off. Its report on the European MDR services market lists investigation among the capabilities buyers should evaluate alongside detection and response. The commercial implication is that a provider able to take an alert further resolves more of the customer’s problem before another team has to be involved.
Taking an alert further requires more than additional telemetry. Logs and alerts are essential to detection, but they are partial records of system activity. Memory-resident tooling, persistence mechanisms and activity conducted with legitimate credentials may leave little distinctive evidence in the monitoring stack. CrowdStrike’s 2026 Global Threat Report found that 82% of detections were malware-free, up from 51% in 2020. The evidence needed to resolve such a case often sits in memory, the process tree, the file system or another endpoint artefact. Detection tells the provider where to look for it, but the investigation has to establish what happened.
DFIR has the opposite growth problem
DFIR firms already have investigative depth. Their problem is that most of their work begins after something has gone badly wrong, which makes revenue episodic and hard to plan around.
But now the same capability used for digital forensics can be applied for good effect earlier. Scheduled compromise assessments, threat hunts, managed investigation, post-remediation validation and readiness work all draw on the skills and tooling a DFIR firm already has. Binalyze’s service-provider proposition is built around this. IR teams can pre-deploy the platform across retainer customers, collect scheduled baselines and enter an incident with evidence already in hand, and the same site positions threat hunting and other proactive services as recurring revenue.
That changes what the firm can deliver and sell. It stays involved between incidents, looks for compromise, tests the customer’s assumptions and turns what it learns into hunt and detection content for the next engagement. The customer buys continuity as well as expertise.
The two models meet in the investigation
An MDR provider has continuous sight of the environment. A DFIR firm has the depth. Imagine a service that combines the two runs as follows. An alert triggers an investigation. The provider frames the likely explanations and collects the evidence that would distinguish between them. Each explanation is then tested against affected systems. Where the evidence leaves a question open, the investigation collects more. The result is confirmed, refuted or inconclusive, with any evidence gap identified.
Neither of the two services typically offered today works this way. Escalation from an MDR service happens because the answer is not in alerts or logs, and forensic collection under an IR retainer usually only starts after a major incident has been declared. This change means moving forensics from a report produced after the event to live evidence that your SOC and IR analysts can also use while the incident is under way
Win/Win through convergence
For an MDR provider, deeper investigation lets you resolve more cases without escalating to an IR team, which is how Binalyze positions AIR for the SOC. If you run a DFIR practice, the same capability gives you recurring work between breaches: threat hunting and compromise assessments inside retainers, or sold as separate managed services. The economics differ, but in either case you end up owning a larger part of the incident lifecycle than before.
The IR boundary still matters – but it is becoming porous.
Convergence does not mean every investigation stays inside a managed service. Formal incident response carries legal, governance and decision-making requirements that differ from routine MDR work. Forrester warns about the MDR-to-IR transition: unclear escalation thresholds cost time and lose context. They also create problems around authority and legal protection.
The boundary therefore needs to be demarcated and formalized. A managed investigation can establish what happened and scope the affected systems while preserving the evidence. Once an incident crosses the agreed threshold into formal IR, who holds authority changes, and legal involvement and response governance change with it. When the same investigative foundation is used on both sides of that threshold, the evidence and context carry across and the customer does not have to start the case again with a new team.
Making forensic depth the default
Forensic investigation used to be expensive because it depended on specialist time and manual collection, and a service built that way cannot run as a routine managed offering. The alternative is tiered collection: lightweight acquisition for routine cases, deeper collection when the evidence warrants it, and full forensic work for incidents that require it. Binalyze AIR is designed around that model. Remote acquisition gives SOC analysts forensic depth without turning every alert into an IR engagement, and IR teams can automate collection and correlation and use the same platform for proactive services.
An MDR firm can add investigative depth with the SOC staff it already has, and a DFIR firm can sell scheduled hunting from the bench it already runs. Both gain the ability to detect a problem, investigate it against evidence and carry the context into response, and the provider that can do that owns more of the customer relationship.
About guest author Oliver Rochford
Oliver has worked in cyber security as a penetration tester, consultant, researcher, and industry analyst for companies like Qualys, Tenable, Verizon and Securonix. He has been interviewed, cited, and quoted by the media, think tanks, and academic institutions, and has written for Securityweek, and CSO Online.
While at Gartner as an analyst, he co-authored the Security Information and Event Management (SIEM) Magic Quadrant and co-named the Security Orchestration, Automation, and Response (SOAR) market. He runs his own tech advisory firm, the Cyberfuturists, and publishes the Curious AI newsletter and aisocnews.com.
Follow Oliver on LinkedIn.