Where this offering fits
MDR Prevent concerns managed prevention and the operating policies that restrict risk. It differs from alert review because a preventive action can affect access or service availability. Define protected surfaces and the customer approvals needed for policy changes.
Architecture and rollout decisions
Map relevant identities, systems and control integrations. Confirm the service’s current capabilities and prerequisites. Pilot a bounded policy with legitimate workflows and an approved denied case. Establish exception, rollback and emergency change procedures. The statement of work should identify which controls the provider operates and what remains with the customer.
An evaluation scenario for this offering
Choose a low-risk test control within the confirmed MDR Prevent service scope and agree the policy objective with its owner. Demonstrate an authorised preventive change, then validate a legitimate business action and a prohibited test case. Introduce a deliberately unsuitable recommendation for reviewer discussion rather than applying it to production. Check who can approve, reverse and document the change under the actual service agreement. Retain policy versions, business validation and customer-versus-provider authority. Acceptance should show controlled prevention for the chosen scenario without implying that the service can change any connected system or eliminate all incident risk.
Evidence to request for this scope
- Agree protected surfaces and prevention authority.
- Validate permitted business activity and exceptions.
- Test rollback and change attribution.