· White Label Cyber
It’s Friday afternoon. A customer rings your service desk about a suspicious sign-in. They ask for an engineer they know by name. Your engineer brings in a security analyst, then promises to call back. At five o’clock the engineer’s shift ends. Who owns that promise now?
When you sell managed detection and response (MDR) under your own brand, that callback is part of the service your customer buys. Before onboarding, put your service desk lead and your delivery partner in the same room and walk through three decisions.
Who investigates?
Ask your engineer to talk through the first handover. Where do they record the customer’s concern? How does the security operations centre acknowledge it? Agree who keeps the case open on the service desk while the analyst investigates. That gives the next engineer somewhere to look if the customer rings again.
Who can authorise action?
Suppose the analyst recommends temporarily suspending the account. It belongs to the person running the customer’s Friday payroll. Who can approve the disruption? Record which actions the customer has authorised in advance, which require a decision on the day and who can make it outside office hours. Try the scenario again with the usual approver unavailable.
Who calls the customer back?
Choose a named contact for the update and a deputy for the shift change. The engineer can bring the analyst onto the call for technical detail while remaining the customer’s point of contact. A useful update tells the customer what you know, what is still being checked and when they will hear from you again.
“I’ve passed this to our security analyst. I’m your contact for the incident and I’ll call you back at half past five, even if the investigation is still open.”
Try it at your next service review
Give both teams the Friday scenario and ask them to write down the investigator, the approver, the caller and the time of the next update. Compare answers. If two people expect the other to call, you’ve found the first thing to fix. Save the agreed handover with the customer’s service record.
For the wider onboarding conversation, use our MDR partner checklist.