Annex II · SLA Register

MDR SLA matrix for 2026.

Published MTTD, MTTA, MTTR by vendor where available. Where the vendor does not publish a target, the cell is marked quote-only and the row is muted.

Direct answer

MDR SLAs typically commit to MTTD under 15 minutes, MTTA under 30 minutes, and MTTR under 1 hour for high-severity alerts. CrowdStrike Falcon Complete and Sophos MDR additionally offer a breach-protection warranty (up to $ 1M each) with stated trigger conditions.

Published SLA targets

Arctic WolfHigh-sev alertMTTD 10 min · MTTA 30 min · MTTR 1 hr[V]

ExpelHigh-sev alertMTTD <30 min · MTTR <30 min[V]

HuntressHigh-sev alertMTTD <10 min target[V]

CrowdStrike Falcon CompleteBreach warranty $1MMTTD 1 min · MTTI 10 min · MTTR 60 min[V]

Sophos MDRBreach Protection Warranty $1MMTTD <1 min · MTTR 38 min median[V]

ReliaQuest GreyMatterCo-managed; SLA per contractQuote-only[I]

Rapid7 MDRHigh-sev alertMTTR 6 hr typical[G]

Breach warranty triggers

Breach warranties pay out only on specific trigger conditions. Read the small print:

Sophos. Up to $ 1M per claim if a Sophos-managed environment suffers a ransomware incident under the Breach Protection Warranty. Limited to customers on MDR Complete who follow Sophos hardening guidance.
CrowdStrike Falcon Complete. Up to $ 1M warranty against breaches that occur while Falcon Complete is monitoring. Excludes environments not fully covered by the agent.

Service-credit clauses

Most MDR contracts include service-credit clauses (typically 5 to 15 percent of monthly fee per SLA miss, capped at 25 to 50 percent of the monthly fee). These are negotiable; they should be tied to the same MTTD / MTTA / MTTR targets as the SLA itself.

Annex cross-references

AnnexRFP templateLock the SLA matrix in the RFP commercial section.AnnexHidden costsThe service credit caps at 25 to 50 percent of monthly fee; not unlimited.AnnexSophos MDR$ 1M Breach Protection Warranty trigger conditions.AnnexFalcon Complete$ 1M warranty; agent-coverage gating.