What Is Web3 MDR? Managed Detection and Response for Crypto
Quick answer. Web3 MDR is managed detection and response for digital assets: a team watches your contracts, keys and infrastructure around the clock and responds. A monitoring tool produces alerts; MDR supplies the people, the SLA and the response.
Video transcript
Web3 MDR means a team watches your contracts, keys and infrastructure around the clock, and actually responds. Here is how it differs from traditional MDR.
MDR is a service, not a tool. Applied to crypto, it has to watch things traditional providers never see: contracts, admin keys, multisig queues, oracles and bridges.
Onchain, almost everything changes. The data is public to attackers too. The clock is shorter, because funds move instantly. Response needs onchain authority to pause. Signers become the perimeter. And offchain systems still count.
A monitoring tool detects activity and sends alerts. MDR supplies the people who triage every alert, investigate and respond under an agreed SLA. Many teams use both, with the platform feeding the MDR team.
There is no industry standard for response time yet. Guardian Managed Security works to a 15-minute SLA on Critical alerts.
Whatever the number, pin down what starts the clock, what counts as a response, who decides what is Critical, and whether coverage runs around the clock. Then agree who can act, before any incident.
Guardian Managed Security is read-only and backed by a 90-day guarantee: Guardian detects and resolves a high-severity issue in the first 90 days, or you don't pay.
Read the full guide for the provider checklist, or talk to Guardian about an MDR team that knows your protocol.
Managed detection and response (MDR) is an established service in traditional security. An outside team watches your environment around the clock and responds to threats for you.
Applied to crypto, it has to watch things a traditional MDR provider never sees: contracts, admin keys, multisig queues, oracles and bridges.
Vendors use the term differently. In the offerings we reviewed, it covers a platform paired with a response partner, an incident response retainer, and a fully managed service.
MDR Defined
Microsoft calls MDR "a cybersecurity service that helps proactively protect organizations from cyberthreats using advanced detection and rapid incident response".
It combines technology and human expertise to perform threat hunting, monitoring and response.
The word that matters is service. MDR is people acting on detections, not a product that generates them.
Microsoft separates it from its neighbors like this:
| Term | What it is | Responds to threats? |
|---|---|---|
| SIEM | Technology that collects and analyzes data from existing security tools | No human component of its own |
| EDR | A tool that tracks endpoint behavior and responds with rules-based automation | Automatically, within its rules |
| MSSP | A provider that monitors networks and endpoints and sends alerts | Generally not, per Microsoft |
| SOC | A centralized team, internal or outsourced, that monitors, analyzes and responds | Yes |
| MDR | A service that gives you that SOC capability without hiring it | Yes |
What Changes Onchain
The model carries over. Almost everything it is applied to changes.
The data is public
Contracts, balances, roles and transactions are visible to anyone. Detection can run on public chain state without access to your systems.
On chains with a public mempool, Hypernative and BlockSec say they detect attacks before the transactions confirm. Attackers read the same data.
The clock is shorter
Onchain, as Guardian puts it, "the money is right there, it moves instantly, and recourse is minimal".
A detection that arrives after an exploit confirms is a loss report, not a defense. See how fast crypto hacks are detected.
Response needs onchain authority
Containment in a corporate network often means isolating a host or disabling an account. Onchain it means pausing a contract or blocking a transaction.
Each of those needs a key or a role. Decide who holds that authority before the incident, not during it.
Keys and signers are the perimeter
A multisig is only as safe as what its signers approve. An admin key is only as safe as the device it sits on.
So Web3 MDR includes reviewing multisig transactions before signing, and watching signer sets, thresholds, modules and guards.
Offchain still counts
Users reach your contracts through a domain, DNS, a CDN and a frontend bundle. A hijacked registrar never touches a contract.
An MDR service that only watches the chain covers only part of the attack surface.
What It Should Cover
Ask any provider to map its detections to these surfaces:
| Surface | What to watch | Example detections |
|---|---|---|
| Smart contracts | Privileged calls, role and ownership changes, upgrades, large fund movements | An upgrade outside a release; a timelock shortened |
| Keys and multisigs | Signer sets, thresholds, queued transactions, modules and guards | A queued transaction that does not match its stated purpose |
| Dependencies | Oracles, bridges, integrated protocols, libraries and advisories | An oracle source swapped; an advisory matching a package you run |
| Cloud and code | Cloud accounts, CI/CD, code host, secrets | A new cloud admin; a secret pushed to a public repository |
| Domains and frontend | Registrar, DNS, certificates, the served bundle | A DNS record changed; the bundle changed with no deploy |
Generic exploit detectors catch known patterns. Detections built from your own contracts, roles and runbooks catch legitimate powers in the wrong hands.
A good service runs both.
SLAs and Response Authority
What the SLA should say
We know of no industry standard yet, so read the definitions. Guardian Managed Security works to a 15-minute SLA on Critical alerts.
When Cantina and Hypernative announced their joint MDR offering in October 2025, they described "guaranteed response times under 15 minutes".
Whatever the number, pin down:
- What starts the clock: the alert firing, or a human acknowledging it.
- What counts as a response: an engineer investigating, your team paged, or a contract paused.
- Severity: who decides an alert is Critical, and by what criteria.
- Coverage hours: 24/7, including weekends, holidays and your signers' time zones.
Who can act
Write the response authority down before you sign:
- Which actions the provider may take alone, which need your approval, and which only you can take.
- How each action runs: a delegated role, a pre-signed transaction, or a proposal to your multisig.
- Who can unpause, and how a false positive is handled.
- Who the provider escalates to, in what order, and how they reach a signer at 3 AM.
- When outside help comes in, such as SEAL 911 or Safe Harbor from the non-profit Security Alliance.
Rehearse it. A pause path that has never been run on a fork is a hypothesis.
Evaluating Providers
- Coverage: show us your detections mapped to our contracts, signers, cloud and domains.
- People: who responds, where are they, and will they know our system first?
- SLA: what is the response time per severity, and what happens if you miss it?
- Authority: what access do you need, and what can you do read-only?
- Automation: which responses run automatically, and how do you test them?
- Integration: can our existing monitoring tools feed into your team?
- After the incident: do we get a timeline, a root cause and a report for regulators?
- Evidence: can you produce what regulators ask for under DORA, MiCA or the GENIUS Act?
- Portability: do we keep our detection rules if we leave? Defender's shutdown on July 1, 2026 showed why.
For the tools under an MDR service, see Best Smart Contract Monitoring Tools in 2026. Replacing Defender? See OpenZeppelin Defender alternatives.
How Guardian Delivers MDR
Guardian's Managed Security monitors your contracts on every block: privileged calls, role changes, upgrades, multisig transactions and large fund movements.
Monitors are customized to your protocol and run beside out-of-the-box detectors, with custom actions including automated pauses. Offchain, Guardian's Sentry watches domains, DNS, certificates, cloud and code host.
When something fires, a Guardian engineer who knows your system responds. Your existing monitoring streams into the global 24/7 MDR team, with a 15-minute SLA on Critical alerts.
Guardian's security operations team reviews every multisig transaction before it is signed, against a live threat model of every path to your funds.
Managed Security runs on least privilege and is read-only: monitoring and threat models run on public chain state.
It comes with a hosted trust center and the technical evidence regulators ask for under DORA, MiCA, the GENIUS Act, VARA and NYDFS.
It is backed by a 90-day guarantee: Guardian detects and resolves a high-severity issue in the first 90 days, or you don't pay. Watch the walkthrough.
Frequently Asked Questions
What is managed detection and response for crypto?
It is a service in which a provider monitors your contracts, roles, multisigs, cloud and domains around the clock. Its engineers triage alerts and respond, including pausing contracts under authority you agree in advance.
How is Web3 MDR different from traditional MDR?
Traditional MDR watches endpoints, networks and security tool data. Web3 MDR also watches chain state, pending transactions and signing flows, works against a shorter clock, and responds with onchain actions such as pauses.
What is the difference between MDR and a monitoring tool?
A monitoring tool detects and alerts; MDR is people who triage every alert, investigate and respond under an agreed SLA. Many teams use both, with the platform feeding the MDR team.
What response time should a Web3 MDR provider offer?
We know of no industry standard. Guardian Managed Security works to a 15-minute SLA on Critical alerts. Whatever the number, ask what starts the clock and what counts as a response.
Sources
- Microsoft Security: What Is MDR? Managed Detection and Response
- Hypernative: Cantina and Hypernative partner to close the gap between detection and response (October 15, 2025)
- Hypernative: Proactive Onchain Security for Enterprises
- BlockSec: Phalcon Security
- Security Alliance (SEAL): SEAL 911 and Safe Harbor
- OpenZeppelin: Defender Sunset FAQ (June 30, 2025)
- Guardian: Managed Security
- Guardian: Managed Security walkthrough
- Guardian: Guardian Announces Managed Security
Get an MDR team that knows your protocol
Guardian Managed Security watches your contracts, keys and infrastructure around the clock, with a 15-minute SLA on Critical alerts and a 90-day guarantee.