What happens to your existing EDR agents
The first question is whose software runs on your endpoints. If your current provider is platform-native, its agent has to come off every workstation and server, and the replacement has to go on, usually in a staged rollout with a window where both agents coexist. Plan for conflicts during that window. 2 kernel-level agents on the same host can degrade performance and produce false positives, so most teams migrate in rings and keep a rollback image for the first ring.
If both the old and the new provider are technology-agnostic and monitor an EDR you already own, switching is mostly an integration project. Telemetry gets re-pointed, response permissions get re-granted and the agent estate stays untouched. This is the single biggest structural difference in switching cost, and it was set by the provider type you chose, not by anything in the contract.
Data export and retention at exit
Ask 3 questions before the last invoice: what can you export, in what format, and how long after termination the provider keeps your data readable. Log telemetry, alert history and investigation records usually live in the provider’s platform. Some providers offer full export, others give summaries or nothing at all. Clauses that delete data at termination are common, and they matter both for compliance retention obligations and for any investigation that spans the cutover.
Negotiate a read-only access window of 30 to 90 days after exit and get the export format in writing. If your retention obligation runs longer than the provider’s window, budget the time and storage to pull the data into your own archive before the contract ends.
Detection content you lose
Over the life of a contract a provider accumulates tuned detections, suppression rules, allowlists and custom playbooks specific to your environment. Almost none of it is portable. Detection logic is usually the provider’s intellectual property, and even where it is exportable it rarely translates into another platform’s rule language.
The practical consequence is a detection quality dip in the first 60 to 90 days with the new provider while tuning is rebuilt and false positive rates settle. Ask the incoming provider how it staffs that window. Ask the outgoing provider for a written summary of tuning decisions and suppression logic, which most will provide even when the rules themselves stay behind.
Contract mechanics
The exit terms that bite are auto-renewal with a cancellation window of 30 days or less, early termination fees, offboarding work billed as professional services and per-export fees for historical data. 2 timing details deserve attention: co-termination with your EDR licensing if the provider bundled it, and the 1 to 2 months of overlap where you pay both providers during cutover. Overlap is not waste, it is the safest way to migrate, but it has to be in the budget from the start.
Switching checklist
- Confirm the renewal date and the cancellation notice window in writing
- Inventory every host running the provider’s agent and assign removal ownership
- Export alert history and investigation records before the end date
- Ask for a read-only data access window after termination
- Request a written summary of custom detections and tuning decisions
- Get offboarding, export and early termination fees itemized
- Budget 1 to 2 months of overlapping coverage
- Schedule the cutover outside peak season and change freeze windows
FAQ
How long does switching MDR providers take?
Plan for 60 to 90 days end to end. Agent replacement, telemetry re-pointing, data export and detection tuning run on their own timelines, and the safest migrations keep 1 to 2 months of overlapping coverage.
Do I always have to replace endpoint agents?
Only when a platform-native provider is involved on either side. Between 2 technology-agnostic providers monitoring an EDR you own, the agent estate stays untouched.
Will I lose my historical data?
It depends on the export terms. Get the export format and a post-termination access window in writing before you sign, not when you leave.