WatchGuard launches Open MDR to unify MSP security

WatchGuard has expanded its managed detection and response business with a new service that works across its own products and a range of third-party security tools.

According to the company, WatchGuard Open MDR provides 24/7 monitoring and response for managed service providers that support customers with mixed technology estates. WatchGuard states the service is an option for MSPs that do not want to replace existing security platforms during onboarding or renewal discussions.

Open MDR combines native integrations with third-party environments into a single operational view. The company said the approach reduces onboarding time and standardises service delivery across different customer setups.

Mixed estates

Many MSPs manage customers that use different endpoint, identity, network and cloud security products. Some providers also inherit technology choices after mergers, leadership changes, or procurement cycles. That can leave security teams with several consoles and different alert streams.

WatchGuard framed Open MDR as a response to that complexity. The company said the service validates threats and initiates response actions in under six minutes. It also said the system generates fewer than one false positive per month.

Open MDR includes monitoring through WatchGuard's security operations centre. WatchGuard said it handles threat validation and response workflows. The company said MSPs can offer a round-the-clock service without building or staffing their own SOC.

WatchGuard said Open MDR covers endpoints, identity, network, cloud, and productivity tools. It also said the service supports coordinated response steps that isolate threats and stop attacks from spreading.

Technology coverage

WatchGuard said Open MDR works across WatchGuard Firebox, AuthPoint and EPDR. It also listed support for Microsoft Defender, CrowdStrike Falcon, Okta Workforce Identity, Microsoft 365, AWS, Google, and third-party firewalls.

The company said MSPs retain ownership of the customer relationship while WatchGuard runs the SOC service. It also said the offer includes dedicated Technical Account Managers for escalation, root-cause analysis, and ongoing security guidance.

WatchGuard has built out its MDR portfolio over recent years. The company pointed to the availability of Total MDR and its acquisition of ActZero in 2025 as part of a wider push toward what it described as open, platform-based security services.

"Open MDR represents the culmination of our MDR vision - to provide a complete, single MDR solution," said Andrew Young, Chief Product Officer, WatchGuard. "It allows partners to deliver consistent, high-quality managed security without forcing rip-and-replace decisions or operational complexity."

MSP positioning

MDR has become a competitive segment in the managed services market. Providers have used MDR services to expand beyond traditional firewall and endpoint management. Many MSPs also face pressure from customers that want measurable security outcomes and faster incident response.

WatchGuard said Open MDR targets MSPs that want a single service across several customer environments. The company said the service reduces friction during renewals because customers can keep existing tools. It also said this model supports longer-term customer relationships.

Sonit Systems, an MSP, said the offer would suit organisations that want a managed response service without expanding internal security teams.

"WatchGuard Open MDR enables us to deliver enterprise-grade protection with clarity and confidence, especially for our smaller and mid-size customers," said Don Lawson, Technical Solutions Advisor, Sonit Systems. "It reduces alert fatigue, simplifies operations, and gives our customers peace of mind - backed by a WatchGuard team that supports us well beyond deployment."

WatchGuard said Open MDR is available globally through its network of MSP partners.