In May 2025, Abu Dhabi’s Department of Health and the UAE Cyber Security Council ran simulated cyberattacks to see how healthcare facilities would respond to threats while keeping medical services running.
It raises a question for hospitals that already have an MDR provider: how do you know the service is actually making you more secure?
Your monthly reports may show that SLAs are being met and alerts are being closed. But has your provider audited your environment properly? Are your critical systems covered? Are the tools configured to catch the right threats, or are gaps going unnoticed while your team assumes security is being handled?
These gaps matter when your hospital must meet compliance requirements and keep patient services running.
This guide walks you through six practical tests to check whether your MDR provider is giving your hospital the visibility, response and protection you’re paying for, and what to fix if it isn’t.
TL; DR
- Check MDR visibility: Confirm your critical hospital systems are monitored and sending security logs to the SOC.
- Verify MTTR: Find out how long threats take to contain, not just how quickly alerts are acknowledged.
- Test incident response: Ensure threats can be contained safely, even when your IT team is unavailable.
- Check ADHICS evidence: Make sure incident records support applicable compliance requirements.
- Review monitoring coverage: Confirm new systems and facilities are included as your hospital's IT environment changes.
- Fix gaps or switch providers: Set deadlines for corrective actions and evaluate alternatives if critical issues persist.
How Can You Tell If Your Hospital's MDR Provider Is Doing Its Job?
Mean Time to Respond (MTTR) sounds like a straightforward measure of how quickly your MDR provider handles threats. But what counts as a response? An analyst acknowledging an alert, escalating it to your IT team or actually containing the threat?
These are different stages of an incident, and reporting them under the same broad response metric can make performance look better than it is.
For example, your provider might report a 20-minute response time even if the compromised account remains active for another 25 minutes. The report may be accurate according to its definition, but it doesn’t tell you how long your hospital was exposed.
That’s why you need to examine the evidence behind your MDR metrics, not just the numbers themselves.
Your monthly report should help you answer four basic questions:
What the report shows
What you should verify
Alerts closed
Were serious threats contained, and was the investigation completed?
24/7 monitoring
Are your EHR, PACS, lab systems and other critical assets covered?
Low MTTR
Does the metric measure acknowledgement, escalation or actual containment?
No critical incidents
Is there evidence of effective detection, or are some systems missing from monitoring?
None of these figures is inherently misleading. The problem arises when a hospital treats them as proof of protection without examining what they measure.
The goal is to establish what your MDR provider can see, what it does when something goes wrong and how it proves the response was effective.
Also Read – Your First 30 Days with MDR Services: What to Expect
How Can You Test Whether Your Hospital's MDR Provider Is Effective?
Abu Dhabi’s ADHICS V2 standard calls for healthcare organizations to test their incident response capabilities, assess the results and address gaps they uncover.
For your hospital, that means going beyond a provider’s SLA and asking for proof.
The first test starts with the foundation of any effective response: visibility into your hospital’s critical systems.
1. Can Your MDR Provider See All Your Hospital's Critical Systems?
Your MDR provider monitors hundreds of endpoints. But if suspicious activity starts on a radiology workstation, would anyone notice?
The gap: MDR coverage doesn’t automatically extend to every system in your hospital. Medical devices may not support conventional security agents, and some systems may not send logs to your provider. Your dashboard could look healthy while critical assets remain outside its view.
What to verify:
- Are your EHR, PACS, lab systems and medical devices covered?
- Which systems are missing security telemetry?
- Who monitors the gaps?
Evidence to request: An asset coverage report listing monitored systems, telemetry sources and exclusions, with an assigned owner for each critical gap.
2. Does Your MDR Provider's MTTR Measure How Quickly a Threat Is Contained?
At 2 AM, your MDR provider detects suspicious activity on a hospital administrator’s account. An analyst investigates and escalates the alert within eight minutes. The report records an eight-minute response time.
But the account stays active for another 35 minutes.
The eight-minute figure may be accurate. What matters is what it measures. How long did it take your provider to respond, and how long did it take to contain the threat?
Ask your provider to define its MTTR metric and show the timeline for a real incident, from detection through investigation to containment. That gives you a clearer picture of how quickly your hospital is actually protected.
The gap: Mean Time to Respond (MTTR) can refer to different stages, from analyst acknowledgement to escalation or containment. Without a clear definition, the number tells you little about how long your hospital was exposed.
What to verify:
- When was the threat detected, investigated and escalated?
- When was access actually revoked or the threat contained?
- Who performed the containment, and how long did it take?
Evidence to request: A timestamped incident timeline covering detection through containment. If your provider reports a 15-minute MTTR but cannot show when the attacker lost access, you still don’t know how long your hospital was exposed.
3. Can Your MDR Provider Contain an Attack Without Disrupting Patient Care?
Your MDR provider detects suspicious activity on a workstation used to access radiology images. Isolating it could stop an attacker spreading through the network, but it could also interrupt clinicians’ access to diagnostic images.
The gap: A containment action that works for an office laptop could disrupt clinical operations. If your provider hasn’t agreed on which systems it can isolate and when it needs approval, the response could stall while the threat remains active.
What to verify:
- Which systems can the SOC isolate without approval?
- What alternatives exist when isolation could disrupt patient care?
- Who authorizes emergency action after hours?
Evidence to request: A clinical-system containment playbook agreed with your IT team, including approval rules, alternative actions and test results. If these procedures haven’t been established, your provider may struggle to contain an attack safely when every minute counts.
4. Can Your MDR Provider Respond When Your IT Team Is Unavailable?
It’s 3 AM on a Friday. Your MDR provider detects ransomware activity on a hospital server. The analyst contacts your IT manager for approval to isolate it. Nobody answers, and the activity continues.
The gap: 24/7 monitoring doesn’t guarantee 24/7 response. If your provider needs approval for every containment action, an unavailable contact could leave a threat active for hours.
What to verify:
- Which containment actions can the SOC take without approval?
- What happens if both primary and backup contacts are unreachable?
- Has the escalation process been tested at night, on weekends and during UAE public holidays?
Evidence to request: An after-hours response test showing contact attempts, escalation timestamps and how containment decisions were handled. If no such test exists, you don’t know whether the response process will work when your team is unavailable.
5. Can Your MDR Provider Supply the Evidence You Need for ADHICS?
Your hospital is preparing for an ADHICS assessment. You ask your MDR provider for incident records. Instead, you receive a monthly report showing alert counts and SLA compliance, with little detail about what analysts actually did.
The gap: Summary metrics don’t show how incidents were investigated, who authorized containment or whether identified weaknesses were fixed. For Abu Dhabi healthcare organizations subject to ADHICS V2, your provider’s records may be needed to support evidence of applicable security controls.
What to verify:
- Are investigations, escalations and containment actions documented?
- Are unresolved findings tracked through to remediation?
- Can the provider map its records to your hospital’s applicable ADHICS V2 requirements?
Evidence to request: A sample incident evidence pack with investigation records, response timestamps and corrective-action status. If the provider can supply only dashboard summaries, you may lack the detail needed to demonstrate how incident response works in practice.
If your MDR provider falls short on several of these tests, the next question is whether those gaps can be fixed or whether it’s time to consider a change.
6. Does Your MDR Provider Update Its Monitoring as Your Hospital's IT Environment Changes?
Your hospital opens a new outpatient facility and introduces a cloud-based patient management system. Your MDR provider continues monitoring the systems covered during initial onboarding, but nobody checks whether the new infrastructure is sending security logs to the SOC.
The gap: Your hospital’s IT environment has changed, but your MDR monitoring scope hasn’t. New systems could remain outside the provider’s visibility without anyone realizing it.
What to verify:
- Does your provider review asset coverage when new facilities, applications or medical equipment are added?
- Are missing security logs identified and detection rules updated?
- Who tracks monitoring gaps and confirms they’re resolved?
Evidence to request: A recent MDR coverage review showing newly added systems, monitoring exclusions, detection updates and unresolved visibility gaps. If the provider cannot show how monitoring evolves with your infrastructure, you may have blind spots in systems your hospital now depends on.
If these gaps keep recurring despite your feedback, it may be time to ask whether your MDR provider can meet your hospital’s needs.
What to Do If Your MDR Provider Fails These Tests
Finding a gap in your MDR coverage doesn’t automatically mean you need a new provider. Some problems can be resolved by changing how your existing service operates. Others may point to limitations in the provider’s capabilities or contractual scope.
The next step depends on what the assessment reveals.
Critical systems aren’t monitored
Review monitoring exclusions and whether additional telemetry can be integrated.
Response SLAs are met, but containment is delayed
Redefine response metrics and establish clear containment responsibilities.
Clinical systems have no approved containment procedure
Develop and test response playbooks with IT and clinical engineering teams.
Incident reports lack investigation details
Require documented findings, response actions and unresolved risks.
After-hours escalation repeatedly fails
Establish alternative contacts and pre-authorized response actions.
The provider cannot close agreed security gaps
Evaluate whether another MDR service can meet your operational requirements.
If the same gaps remain unresolved after repeated reviews, it may be time to evaluate another provider.
For a hospital, that decision needs careful planning. Changing MDR providers can introduce its own monitoring gaps if existing log integrations, detection rules, incident records, and response procedures aren’t transferred properly.
The priority is to maintain continuous protection while improving the areas where your current MDR service falls short.
Also Read – How to Choose an MDR Vendor: 10 Questions Experienced UAE Buyers Ask
Next Steps
Start with a review of your current MDR service. Ask your provider to walk you through a recent incident and show you where monitoring or response could improve.
Write down the gaps, agree on who will fix them and set a deadline to review progress. If critical issues remain unresolved, start comparing other providers before your contract comes up for renewal.
If you’re unsure what to look for, we can help you assess your current MDR setup and identify areas that need attention.
FAQs
How much does MDR cost in the UAE?
MDR pricing depends on the number of endpoints, monitoring requirements, response capabilities and service scope. Hospitals should also check whether onboarding, incident response and additional integrations are included in the quoted price.
How do I choose an MDR provider for a hospital?
Check whether the provider can monitor your critical systems, investigate incidents beyond the initial alert and coordinate containment without unnecessarily disrupting patient care. Ask for sample incident reports and documented response procedures before signing a contract.
Does ADHICS apply to all hospitals in the UAE?
No. ADHICS is Abu Dhabi’s healthcare information and cybersecurity standard. Healthcare organizations should confirm which requirements apply to them based on their regulator and location.
What is the difference between MDR and a SOC?
A Security Operations Centre (SOC) is the team or function that monitors and investigates security threats. Managed Detection and Response (MDR) is a service that combines threat monitoring, investigation and response, often delivered through a managed SOC.
What should an MDR report include?
An MDR report should document detected threats, investigation findings, response actions, containment timelines and any unresolved risks. It should also identify recurring issues and track corrective actions so your hospital can verify whether security gaps are being addressed.
