A cap table explained simply is a ledger of who owns the company, in what form, and what their ownership looks like if every promised share actually existed. “How to read a cap table” means looking past the issued-share column and checking fully diluted ownership: outstanding common and preferred, granted options, the unallocated option pool, and a model for unconverted SAFEs or notes. That fully diluted percentage is the number that usually matters before you take the next round.

You’ll also hear it called a capitalization table, a cap table, or a fully diluted ownership schedule. Same document. If you only look at the shares already issued, you will feel richer than you are. The dilution is already sitting in the other rows.

What a cap table is actually showing you

At a minimum, a cap table lists each holder, the kind of security they have, the number of shares or share equivalents, and their percentage of the company. The two percentage columns that matter are issued (sometimes called outstanding) and fully diluted.

Issued ownership is shares that already exist, divided by shares that already exist. Fully diluted ownership is a holder’s shares, plus anything they’re treated as owning on an as-converted or as-exercised basis, divided by a larger denominator: all those issued shares, plus options and warrants, plus the unallocated option pool, plus, if you’re doing this honestly, a conversion model for open SAFEs and convertible notes.

Preferred stock is usually shown on an as-converted-to-common basis, because that’s how it counts in an ownership discussion. You don’t need to memorize every preferred right to read the ownership math. You do need to know which denominator someone is using when they quote a percentage.

Issued vs fully diluted: the first number founders misread

Here’s a teaching example with made-up round numbers. Two co-founders and a small option pool:

Founder A can look at the issued column and think they own almost 90%. On a fully diluted basis, they own 85%, because the 500,000 reserved but unissued option pool already sits in the denominator. The pool is not a rumor. It’s part of the company you’ve already promised to the future hiring plan.

If 200,000 of those pool shares had already been granted to an early hire, the issued column would change and the fully diluted total would not. Granted or unallocated, those pool shares belong in the fully diluted picture. That’s the first reading habit to build.

The option pool: always ask which denominator

People throw around “a 10% pool” as if everyone means the same thing. They don’t. Ten percent of current fully diluted shares is not the same as ten percent of the company after a new round closes. A term sheet that says the pool will be “refreshed to 10%” is unfinished until it says 10% of what, and whether that increase happens before or after the new money is counted.

There is no official standard size. I’ve seen term sheets ask for different pool figures in different deals, and anyone who tells you “it’s always 10%” or “always 15%” is repeating a habit, not a rule. The job is to get the percentage, the denominator and the timing in writing, then model what that does to your shares.

A pre-money pool refresh is the version that catches founders. The investor wants the pool topped up so that, after they invest, the pool is a set percentage of the post-money company, but the new pool shares are treated as outstanding before their money comes in. Existing holders, mostly founders and early employees, absorb that increase. The new investor does not.

Unconverted SAFEs and notes belong in the picture

A SAFE or convertible note is not a row of shares until it converts. If your cap table software only shows issued stock, that paper can be invisible, which is how founders walk into a priced round thinking they own 60% and walk out owning a lot less than the new money alone would explain.

You don’t have to turn this page into a lesson on the instrument. If you need the difference between the two, that’s the SAFE vs convertible note article. What you do need, when you read a cap table, is a conversion model for every open SAFE and note: the cap, the discount if there is one, and a clear assumption about how it converts in the next priced round.

A simple illustration, again with teaching numbers. A post-money SAFE for $1 million on a $10 million post-money cap is designed to deliver about 10% ownership at conversion. If you ignore it, Founder A’s 85% in the table above looks stable. If you model that 10%, existing holders are sharing a smaller pie before a venture round even shows up. The exact share count depends on the documents and the round, so treat this as a warning light, not a closing spreadsheet. Get the conversion modeled before you quote your percentage to anyone.

What a priced round plus a pre-money pool refresh does to your percentage

This is the math I want every founder to run before they get excited about a term sheet.

Keep the same starting company: Founder A 8,500,000, Founder B 1,000,000, unallocated pool 500,000, fully diluted 10,000,000. A new investor offers $2 million at an $8 million pre-money valuation, which is a $10 million post-money valuation, so they’re buying 20% of the company after the close. The term sheet also says the option pool must be 10% of the fully diluted post-money cap table, and the increase is required on a pre-money basis. These are teaching terms, not a recommendation.

Without any pool refresh, the fully diluted total after the round would be 12,500,000 shares. The new investor would hold 20%, the old pool would shrink to 4%, and Founder A would go from 85% to 68%.

With the pre-money refresh to a 10% post-money pool, the fully diluted total rises to about 13,571,429 shares. The new investor still holds 20%. The pool becomes 10%. Founder A lands at about 62.6%.

The new money cost Founder A 17 points. The pool refresh cost another 5 points, and none of those 5 points went to the new investor. If you only heard “we’re selling 20%,” you missed it. That’s why you read the cap table, and the term sheet’s pool language, together.

What to check before the next round

The starting common split is a different job. If you and a co-founder are still deciding the founder equity split, settle that first. The cap table is what happens after those shares exist, when later promises start stacking on top of them.

Before you negotiate or sign, work through this list:

1. Recompute your percentage on a fully diluted basis, including the unallocated pool, not just issued shares.
2. List every open SAFE, note, warrant and promised grant, and model the conversion or issuance, even if it hasn’t happened yet.
3. Read the pool language in the term sheet. What percentage, of which denominator, and is the refresh pre-money or post-money?
4. Rebuild the post-round cap table yourself (a spreadsheet is enough) and compare it to whoever sent you the model.
5. Don’t treat a hanging promise as a footnote. An offer letter, an advisor grant or a convertible that “we’ll clean up later” is already in the fully diluted story.

This is education, not legal advice, and it’s not a reason to pick any particular cap table product. If the round is real, have startup counsel or an experienced advisor model the close with you before you sign. The point of learning to read the cap table is so you can see the dilution coming, while you still have a chance to negotiate it.

Frequently asked questions

What is a cap table?

A cap table, or capitalization table, is the company’s ownership ledger. It lists each holder, the security they own, the share count and their percentage, on both an issued and a fully diluted basis.

What does fully diluted ownership mean?

Fully diluted ownership is your shares divided by all shares that would exist if options, the unallocated pool, warrants and converted SAFEs or notes were counted. It is usually lower than your issued percentage.

Does the unallocated option pool dilute founders?

Yes, on a fully diluted basis. Reserved but unissued pool shares sit in the denominator, so they reduce founder percentages even before those options are granted or exercised.

How do SAFEs show up on a cap table?

A SAFE is not shares until it converts. You should still model it, using the cap and any discount, so your fully diluted percentage includes the ownership that SAFE is expected to deliver in the next priced round.

What is a pre-money option pool refresh?

It’s a term-sheet requirement that the option pool be increased, usually to a stated percent of the post-money company, with that increase treated as happening before the new money comes in, so existing holders, not the new investor, take the dilution.

How do I read a cap table before a priced round?

Start with fully diluted ownership, add a conversion model for every SAFE or note, then rebuild the post-round table using the term sheet’s valuation and pool language. Compare your model with the investor’s before you sign.

What do investors look for? A founder who genuinely believes every word of the pitch, a story that hits the problem in the first minute, a team that can actually execute, and a clear answer to where every dollar goes. Kevin Harrington, an original shark on Shark Tank, says the passion gets you in the room, but the team and the use of proceeds get you the check.

Kevin has taken thousands of pitches. His official bio credits him with creating the infomercial, pioneering the As Seen on TV brand, launching more than 500 products that produced well over $5 billion in global sales, and building 20 companies that each topped $100 million in revenue.

I wanted the inside advice a lot of entrepreneurs need right now. How do you approach investors, and what really matters when you’re presenting your business idea? Here’s what he told me.

What investors look for in the first 10 seconds

Before you’ve said anything useful, Kevin is already doing what he calls the old 10-second look. How confident are you? How do you present yourself? Are you delivering this in a powerful, passionate way?

Most of all, he wants to know you believe the words coming out of your mouth. “Too many people, someone’s written them a script.” He wants the real deal, not someone reciting a deck they didn’t build.

How to pitch to investors: tease, solve, seize

At one pitch contest, founders had eight minutes each. One guy took seven minutes to even mention his product. Kevin had to tell him straight: if you’re taking eight minutes of all these valuable people’s time, learn to deliver a reasonably good pitch. “You lost us.”

His structure is simple, and he slowed down to make sure I got it:

1. Tease. Open with an attention-getting problem.
2. Solve. Show how you solve it, with demonstrations, “magical transformations,” testimonials and documentation, plus a little competitive analysis.
3. Seize. Close with an irresistible offer.

Kevin points out he hears pitches for a living, but most people you pitch don’t. If you don’t grab their attention with the problem first, you’re probably not going to land, “especially if you’re looking for money.”

Why investors stopped betting on the jockey

I asked Kevin whether he’d ever backed someone on attitude alone. Somebody who walks in with so much certainty that you just want to work with them. His answer surprised me. Not anymore.

He used to bet on the jockey, the entrepreneur. He’s been let down too many times. Plenty of gung-ho founders with all the passion in the world have driven a business into the ground because they couldn’t execute. Maybe they had one skill set, but no finance or operations, and they never surrounded themselves with people who did.

The person, their passion and their belief still weigh very heavily. But if someone wants half a million dollars, Kevin wants to see the right structure, the right team and the right expertise behind them first. “I’ve seen entrepreneurs run through the money real quick and say, ‘Well, sorry, we just didn’t make it.'”

Tony Robbins once told me your business will eat as much money as you throw at it. Kevin agreed. That’s exactly why investors want counterbalances around a passionate founder.

Use of proceeds: the question that kills deals

One of the big questions on Shark Tank was always: what’s the use of proceeds? In plain English, if I write you the check, where does the money go?

Kevin told me about a founder who wanted a quarter of a million dollars. The plan was a down payment on a building, office furniture, a copy machine and printers. That was the whole $250,000. Kevin was out. Where was the marketing plan? The rainy day fund? The budget for public relations, advertising or a launch? “You can tell pretty quickly that they really haven’t thought out how they’re gonna really launch this business.”

A good operations or finance person makes you think through the cost of hiring and the cost of weathering the opening months of cash flow, because cash flow doesn’t come out of the box. It builds.

Then there’s the office. Kevin once visited a company with about five employees in 7,000 square feet of expensive space, complete with a ping pong table and a Skee-Ball machine. “You don’t need a ping pong table until you become Facebook.” I see so many people trying to pimp out their office space. Get the profits coming in first, then deck it out later.

Same goes for the funding announcement. A lot of people celebrate millions in investment, money that isn’t theirs, without a plan for it. Kevin’s point: nobody wants to give you $5 million that’s supposed to last 18 months and see you back in six or eight months asking for more. Unless your numbers have changed dramatically, that second round gets very hard.

Get investor-ready before you ask

Kevin’s biggest early mistake was being a young, cocky entrepreneur who thought he could do it all himself. He started with $25,000 and assumed that once he was successful, people would throw money at him. It doesn’t work like that. He ran out of capital.

So he hired a former bank president who knew how to raise money. The first thing that man asked was, “Where’s your contract file?” Kevin didn’t have one. With 30 products on air and eight or ten contracts per deal, writers, producers, directors, hosts and inventors, they had 300-plus contracts scattered everywhere. A lender wants to see every one of them, and wants to know there are no contingent liabilities like possible lawsuits waiting out there.

They spent 90 days getting ready before they asked anyone for money. Then they raised $3 million, which Kevin says gave them enough capital to grow to $100 million in sales. Whether you’re raising on a SAFE, a convertible note or a priced round, the diligence starts the same way: show me what you’ve signed.

My takeaway? Ignorance isn’t always bliss. And if you don’t have a strength in a certain area, find someone who does. It’s the lesson almost every first-time founder learns the expensive way.

Bring in experts whose track record helps you raise

When Kevin launched a beauty business with the model Kathy Ireland, he admitted beauty wasn’t his world. He does gadgets, fitness and kitchen products. So he brought in an executive who had spent a decade running a major beauty company, first as a consultant and then as president and COO.

That hire did two jobs. The company got real expertise, and Kevin used the executive’s resume to go out and raise capital for the new venture. The right people help you run the business, and they help you get the right money to grow it.

Prove it before you bring investors in

Kevin likes being first to market, but he’s honest that pioneering is riskier. As an investor, he prefers to get in when something is safer and more proven. As an entrepreneur, he expects to fail more than he succeeds, so he tries to fail fast and fail cheap, then get to the big winner.

That’s why he’ll often keep 100% ownership of a new idea until he’s proven it, and only then bring in investors if he needs to raise big money. “I don’t have to write every check, but I’ve proven it out now, so it’s a little safer investment.” To me that’s calculated risk, the same way Richard Branson likes to negotiate the downside before he jumps.

And proof is exactly what investors are looking for. For every company of his that hit $100 million, Kevin says, two or three didn’t succeed. I love that he said it out loud, because it gives people permission to be okay with failing on the way to a win.

Run a dollars-per-minute check on your day

One more habit worth stealing: how you spend your time. Kevin learned it from Home Shopping Network, which schedules tomorrow’s airtime based on today’s sales per minute. If a product was expected to do $2,000 a minute and did $1,000, they’re not happy, and the schedule changes.

He runs his day the same way. If he’s got three things he could do in the next hour, which one has the highest profit potential for the time? Some people waste half their day on things that generate no revenue, then wonder why they’re out of cash. My view: a founder who manages minutes like that will probably manage an investor’s money the same way.

What investors look for: a pre-pitch checklist

1. Can you say the problem in your first 30 seconds?
2. Do you have a demo, a transformation or a testimonial that proves you solve it?
3. Is there a clear, irresistible offer at the end?
4. Who on your team covers finance and operations?
5. Can you show line by line where every dollar goes, including marketing and cash flow?
6. Are all your contracts in one file, with no surprise liabilities?
7. What have you already proven with your own money?

Kevin closed with a quote from Paul J. Meyer that he lives by: “Whatever you vividly imagine, ardently desire, sincerely believe, and enthusiastically act upon, must inevitably come to pass.” I’d add one thing. Knowing what investors want won’t get you funded. Walking in with every answer on this list will.

FAQ

What do investors look for in a startup?

A confident founder who believes in the idea, a team that covers finance and operations, proof the product works, and a clear plan for the money. Shark Tank investor Kevin Harrington says passion alone no longer gets his check without the team to execute.

What do investors look for in a pitch?

Kevin Harrington wants a tease, solve, seize structure: open with an attention-getting problem, solve it with demonstrations, testimonials and competitive analysis, then close with an irresistible offer. Don’t wait seven minutes to say what the product is.

What does use of proceeds mean?

Use of proceeds is exactly where an investor’s money will be spent. Investors want it tied to your business and marketing plan, with room for marketing, hiring and early cash flow, not just buildings, furniture and equipment.

Why do investors bet on the team, not just the founder?

Passionate founders without finance or operations support often burn through capital before the business works. Harrington says he’s been let down too many times betting on the jockey alone, so he backs founders surrounded by people who can execute.

How do you prepare your business to raise money?

Organize every contract in one file, clear up possible liabilities, build a use-of-proceeds plan and bring in experienced help. Harrington’s company spent 90 days getting ready before raising $3 million.

How to build a brand from scratch starts with a blunt question every buyer will ask you: why do I need you? Answer it by going straight to the end customer, earning proof from someone your market already trusts, and treating every no as information. That’s how Joe Foster took Reebok from a secondhand-machinery shoe shop to the world’s biggest sports footwear company, by his account.

Joe co-founded Reebok with his brother Jeff in 1958, and the family’s shoemaking goes back to their grandfather, who pioneered the spiked running shoe in 1895, according to Joe’s official site. His grandfather’s shoes were on the feet of Harold Abrahams, Eric Liddell and Lord Burghley, the athletes immortalized in Chariots of Fire.

A lot of people see the glory, but they don’t hear the story. Most guests give me tip number one, strategy two, principle three. Joe gave me the journey, and the lessons are all through it.

Start by refusing to let the business plateau

Reebok exists because the family company was dying. Joe’s father and uncle had inherited a world-class business and just kept it ticking over. No marketing. No plan. They fought more than they talked. “You need to drive a business forward. It can’t plateau. It will go down if you don’t drive it forward.”

Joe told his dad they had to change. His father’s answer was that when he and Uncle Bill were gone, the company would be theirs to run however they liked. Joe’s reply: “Dad, firstly, we don’t want you to go. But secondly, this business will be gone long before you.” After three years of trying to persuade him, Joe and Jeff walked out and started their own company.

Bootstrap the first version

They didn’t have investors. Before they left, they took evening classes in shoemaking, made friends in the trade and picked up advice. That network let them buy secondhand machinery, which was cheap once the industry’s technology moved on. Joe laughs that even their old machinery was newer than what the family firm had.

If you want to bootstrap a brand, that’s the lesson. Learn the craft, build relationships before you need them, and start with the gear you can afford. They called the company Mercury Sports Footwear and started making money.

Pick a name you can actually own

Eighteen months in, their accountant told Joe to register the name before someone else used it. Too late. A big shoe company had already registered Mercury and would sell it to them for 1,000 pounds. For two brothers who were barely afloat, that was impossible.

The trademark agent said bring me 10 names, not one, so we can test them all at once. Joe went to the Webster’s Dictionary he’d won in a running race as an eight-year-old. He liked the letter R because it felt like a strong start to a word. In the R section he found Reebok, a small South African antelope. Two syllables, strong, and it fit a running shoe company. He put Reebok at the top of the list and told the agent, “We’ve gotta be in love with this. It’s gotta be our passion.”

It was the only name on the list that came back free. Even then it went into part B of the register, because it was an animal’s name. Twenty years later the registrar moved it to part A, because by then everybody knew Reebok was a shoe, not an animal.

Answer the question “Why do I need you?”

This is the part I’d tattoo on every new founder. Joe would walk into sports stores with a bag of shoes and say, “I’m Reebok.” The store owner would say, “Reebok? Who?” Then, “I’ve got Adidas, and I’ve got Dunlop. Why do I need Reebok?”

Joe’s honest answer to himself: you don’t. Their shelves were full. So he realized he was selling to the wrong person. “I should be really selling my shoes to the athlete.” The retailer was just somewhere in between.

The UK’s Amateur Athletic Association had a handbook listing three or four hundred affiliated clubs, with the name and address of every club secretary. Joe wrote to them. He offered a 15% discount from retail, which a club member could keep as an agent or put toward club funds. He got a lot of agents and sold a lot of shoes.

Then the retailers started calling him, asking him to stop selling direct so they’d stock Reebok. He said no, he’d keep selling to clubs, but they could have it at wholesale. Joe says 60 to 70% of them started stocking the shoes anyway. Going direct raised the bar for the brand. “Our brand suddenly became a desirable brand.” Reebok stopped being just another name on a shoe.

What I love here is that Joe moved close to the heartbeat of the market. He went and found the people with influence instead of waiting for permission from the middleman.

Go where your brand can win, then keep showing up

Joe was honest that some doors were already closed. His grandfather once supplied 96 football and rugby clubs, but by the time Reebok started, Adidas owned football. Too expensive and too big to fight. So he looked at America, where every college had a running coach and athletics could get you into university.

His first trip to the big U.S. sporting goods trade show was 1968. People liked the shoes and asked where to buy them. “England.” “Is that New England?” Nobody wanted the hassle of importing. They’d try it when he had a U.S. distributor.

He went every year. He didn’t land his distributor until 1979. “That’s 11 years.” In that time he had at least six failed attempts with different partners.

Earn proof that someone else hands out

The break came from a magazine. Runner’s World was the bible of the U.S. running boom, and it ranked shoes. A number one ranking created demand nobody could supply, so the magazine moved to a star rating, with five stars at the top. Joe saw the opening immediately. “We’re a running company. What we need now is a five-star shoe.”

He designed the Aztec specifically to earn five stars. Kmart wanted 25,000 pairs, but Joe wanted a real distributor. Paul Fireman, who ran a small Boston outdoor goods distributor, was keen, but only if Reebok had a five-star shoe. Joe couldn’t guarantee it. When the shoe issue came out, he called Paul at 7am Boston time and told him to get to the kiosk. The Aztec got five stars. So did the Midas and the Inca. “That was our entry. That was the difference. That was the hook.”

For a new brand, borrowed trust beats anything you can say about yourself. Find the rating, the award, the review or the expert your buyers already believe, and build the product to win it.

Listen to the people closest to the customer

The move that made Reebok huge didn’t come from Joe. Arnold Martinez, a tech rep in Los Angeles, saw his wife coming home buzzing from aerobics classes. He went along and saw instructors and students in running shoes, plimsolls or bare feet. His idea: a soft glove-leather shoe with a cushioned sole.

Paul said no. Running was booming, so why play around with shoes for a dance class? Arnold didn’t take no. He went round the back to the production people and talked them into making 200 pairs, then handed them to instructors. Reebok suddenly became a fitness brand. Jane Fonda wore them in her workout videos. Sigourney Weaver wore Reebok high-tops. The competition called it a phase.

That phase took Reebok from $9 million to $30 million, $90 million, $300 million and then $900 million in successive years, Joe told me. By the time he retired, he says, Reebok was doing $3.8 billion and had overtaken both Adidas and Nike as the number one sports footwear company in the world. Timing helped too. Nike had hit a wall, so Reebok could fill factories in the Far East.

Treat every no as a learning curve

When I asked Joe what aspiring entrepreneurs need to get their head around, he went straight to the nos. “No is not an answer. No is only just a little hiccup on the way. No is something to get round.” Every problem means you’re learning something else. When retailers wouldn’t take him, it forced him to find another way to the customer, and that made the brand stronger.

If you’ve ever let rejection stop you, think about this. Someone once asked me: if you knew for sure all you needed was 10,000 nos to make a billion dollars, would you do it? Most people would say yes, because they’d know a yes was coming. Joe’s version is just as blunt. “An entrepreneur is another name for a risk-taker, because if it’s certain, everybody will do it.” His advice when people ask whether they should go for something? “Just go for it, because you’ll only regret it if you don’t. And if you fail, so what? Get up. Go on again.”

Know who’s the visionary and who’s the integrator

Jeff loved being in the factory and making the shoes. Joe did everything else: design, marketing, sales and all the travel. Joe was the visionary and Jeff was the integrator, and they played strength for strength.

That partnership got tested at the worst moment. Just as the five-star breakthrough hit and the volume problems started, Jeff got sick with stomach cancer and died very quickly. Joe had to do the Far East trip himself and bring in other people to run the factory. They got through it. Know your role, but build a team that can carry the business when life hits.

How to build a brand from scratch: the Reebok checklist

1. Write down the honest answer to “Why do I need you?” before a buyer asks.
2. Find a direct line to your end customer, the way Joe used the club secretaries list.
3. Register a name you love and can own, early.
4. Pick a market where the giants haven’t locked the door.
5. Identify the rating, review or expert your buyers trust, and build to win it.
6. Give your reps and front-line people a way to test ideas small, like 200 pairs.
7. Count your nos as lessons, and keep showing up.

Joe’s parting advice was three words repeated: “Enjoy life. Have fun, fun, and fun.” I’d add one thing. Knowing his story won’t build your brand. Writing those letters, making that call and showing up for the eleventh year will.

FAQ

How do you build a brand from scratch?

Start with a clear answer to why customers need you, then reach your end customer directly, earn trusted third-party proof and keep testing. Reebok co-founder Joe Foster sold to running clubs, built a shoe to win five stars and treated every rejection as a lesson.

How did Reebok get its name?

The brothers’ first name, Mercury, was already registered. Joe Foster searched a Webster’s Dictionary he won in a childhood race and found the reebok, a small South African antelope. It was the only name on his list of 10 that was free to register.

Who founded Reebok?

Brothers Joe and Jeff Foster founded the company in 1958 as Mercury Sports Footwear and renamed it Reebok soon after. Their grandfather, Joseph William Foster, pioneered the spiked running shoe in 1895, according to Joe’s official site.

How do you get retailers to stock a new brand?

Create demand they can’t ignore. Joe Foster sold directly to athletic clubs at a 15% discount, and once customers wanted the shoes, he says 60 to 70% of the retailers who had passed started stocking them at wholesale.

How long does it take to build a brand?

Often longer than founders expect. Joe Foster went to the U.S. trade show every year for 11 years and had at least six failed partnerships before landing a U.S. distributor, then the brand’s growth accelerated quickly.

Picture a growing design studio. Sales are up, new hires join every quarter, and the whole team runs on email, laptops, and cloud apps. Security alerts land in the founder’s inbox and get skimmed between client calls. Nobody is watching at 2 a.m., and that is exactly when an attacker can work undisturbed.

Small companies are not too small to target. In Verizon’s 2025 Data Breach Investigations Report, ransomware appeared in 88% of breaches at small and medium-sized businesses, compared with 39% at larger organizations. The damage from an attack often lasts long after the attack itself, through lost customer trust and recovery costs.

Managed detection and response (MDR) is one way growing businesses close the overnight gap without building a security team. This guide explains what MDR is, what it includes, how it compares with other security options, and what you still own after you sign.

Key Takeaways

MDR is a service, not a tool. It pairs security software with human analysts who monitor, investigate, and respond to threats around the clock.

The basics stay with you. Multi-factor authentication, software updates, tested backups, and staff training remain your job, whatever you outsource.

Response authority matters most. Before signing, agree in writing on what the provider may do without calling you and who receives the urgent call.

What Is Managed Detection and Response (MDR)?

Managed detection and response (MDR) is an outsourced cybersecurity service that monitors your devices, network, and cloud environments 24/7, investigates suspicious activity, and responds to confirmed threats in real time. IBM describes MDR as a service that combines advanced technology with human expertise to deliver threat detection, threat hunting, and threat response.

The human element is what separates MDR from software alone. Security tools generate alerts; MDR analysts decide which ones are real and act on them. In practice, a small business gets access to a security operations center (SOC), the team of analysts that large companies staff in-house. IBM notes that MDR is especially useful for organizations that lack the internal resources or expertise to run security tools such as endpoint detection and response (EDR) on their own.

How MDR Works: Monitor, Investigate, Respond

Monitor. Software on covered devices, and often on cloud accounts, sends activity signals to the provider’s analysts. Coverage is defined in your agreement, so ask for a list of the devices and accounts being watched rather than assuming everything is included.

Investigate. Analysts review flagged activity to decide whether it is a genuine threat or a false alarm.

Respond. Within the limits you have agreed, the provider takes action, such as isolating a device, and then tells you what it did and what to do next.

Here is how that looks in practice. An employee’s laptop starts encrypting files at 2 a.m. The software flags the behavior and an analyst investigates. If it looks like ransomware and your agreement authorizes isolation, the provider cuts the laptop off from the network. Your designated contact gets a call with the findings and next steps. This is an illustrative workflow, not a guaranteed outcome.

MDR Services and Features

Most MDR providers offer a similar core set of services. The details, and what each service tier includes, vary between providers.

Continuous monitoring. Real-time watching of endpoints, networks, and cloud environments for suspicious activity or anomalies.

24/7 coverage. Round-the-clock support, so threats are handled whenever they happen, including nights, weekends, and holidays.

Proactive threat hunting. Human analysts search your systems for signs of attackers that slipped past automated detection, rather than waiting for an alert.

Alert triage and investigation. Analysts sort events by priority, confirm indicators of compromise, and filter out false positives so serious incidents get immediate attention.

Incident response. Containment actions such as isolating affected systems and removing malware, plus guided advice on what your team should do next.

Managed remediation. Some providers restore affected endpoints to a known good state after an incident. Others leave cleanup to you or your IT provider, so confirm which applies to your plan.

MDR Benefits for Small Businesses

Faster detection and response. The longer an attacker goes unnoticed, the more damage they can do. IBM notes that MDR services reduce mean time to detect (MTTD) and mean time to respond (MTTR), the two numbers that measure how quickly a threat is spotted and contained. Speed is also where providers differ most, so ask each one for its figures. ESET, named a Market Leader in the KuppingerCole Leadership Compass 2026, reports a six-minute mean time to respond for its 24/7 human-led MDR service and offers a tier designed for small and mid-sized businesses. Use figures like this as a benchmark when you compare providers, and ask each one how it measures response time.

Security expertise without the hiring battle. Experienced security analysts are hard to find and expensive to keep. MDR gives you access to threat hunters and incident responders without recruiting them yourself.

Lower cost than an in-house SOC. Building a round-the-clock security team means multiple salaries, tools, and training. With MDR, those costs are shared across the provider’s customer base.

Less alert fatigue. When analysts handle triage, your team only hears about incidents that matter, instead of sorting through dozens of notifications a day.

Compliance support. IBM points out that MDR helps organizations show that security controls are in place and working, which matters in regulated industries and during audits.

MDR Versus Other Cybersecurity Offerings

Here is how MDR compares with the options small businesses most often weigh against it.

MDR versus EDR. EDR is software that monitors and responds to threats on individual devices such as laptops and servers, and it relies mainly on automated mechanisms. MDR is a service that adds human analysts and covers endpoints, networks, and cloud environments. Many MDR services use EDR technology under the hood.

MDR versus XDR. Extended detection and response (XDR) is also a tool. It pulls security data from endpoints, networks, and cloud environments into one view. MDR providers often run XDR and EDR technology as part of their service.

MDR versus MSSP. A managed security service provider (MSSP) typically handles alerting, monitoring, and security management, such as firewalls, and often leaves response actions to the customer. MDR focuses specifically on detection and response, including investigation, threat hunting, and containment.

MDR versus managed SIEM. A managed security information and event management (SIEM) service focuses on analyzing logs and event data to spot incidents. MDR adds proactive threat hunting and real-time human response.

MDR versus your IT provider. Your IT provider may manage accounts, devices, and updates without offering after-hours security investigation. Ask directly whether anyone reviews security alerts overnight.

What MDR Does Not Replace

An MDR service watches for attacks that get through. It does not remove the need for basic protections, and a provider only handles the tasks written into your agreement.

The Federal Trade Commission’s cybersecurity basics for small businesses recommend multi-factor authentication, regular software updates, regular backups, staff training on a set schedule, and a plan for responding to a breach. Each of these still needs an owner inside your business.

Protect account access. Turn on multi-factor authentication for critical accounts first, including email, payroll, banking, and customer file storage.

Keep software current. Updates fix known security flaws in operating systems, browsers, and business apps. Buying a monitoring service does not mean someone else is patching your laptops unless the contract says so.

Test your backups. NIST’s guide for the smallest businesses, released on November 2, 2026, recommends keeping multiple backups, including a copy on a medium disconnected from the protected device, and running periodic restoration tests. Pick an important folder this week and confirm you can restore it.

Train the team. New hires should know how to spot a fake invoice or login page and who to report it to.

No MDR service can guarantee it will stop ransomware before any harm occurs. Early isolation can limit damage, and tested backups are what get you running again.

How to Choose an MDR Provider

Providers often advertise similar features. The differences show up in what each plan actually includes, so use these checks before you sign.

Coverage. List the devices and business accounts you depend on and confirm which ones the service monitors, including overnight and on weekends.

Response authority. Decide which actions the provider may take without calling you, such as isolating a laptop or disabling an account, and which need approval. Put those permissions in writing.

Escalation. Name the person who receives urgent calls, plus a backup, and confirm how and when the provider will reach them.

Recovery responsibilities. Clarify what happens after containment. Cleanup, deeper investigation, and restoring data may stay with you or your IT provider unless the agreement says otherwise.

Reporting. Ask for a sample incident report so you can see exactly what a notification includes.

Finally, ask the provider to walk you through an after-hours incident step by step. Confirm who isolates the device, who gets the call, and who restores the files, then record those answers in your incident response plan.

Final Thoughts

For a growing business, the biggest security risk is often not a missing tool but a missing person: nobody watching when an alert fires at 2 a.m. MDR fills that gap with analysts who monitor, investigate, and respond on your behalf. It works best alongside the basics you already own. Choose a provider that is clear about coverage and response authority, write those decisions down, and you will be far better prepared than most businesses your size.

Frequently Asked Questions

Is MDR worth it for a small business?

It is worth considering if you have no one monitoring security alerts after hours and no budget to hire security staff. MDR gives you round-the-clock analyst coverage at a shared cost, rather than the cost of building your own security team.

How is MDR different from antivirus software?

Antivirus software runs on a device and blocks known threats automatically. MDR is a service in which human analysts investigate suspicious activity across your devices, network, and cloud accounts, and take action when a threat is confirmed.

Can MDR stop ransomware?

MDR can detect ransomware behavior early and contain it, for example by isolating an infected laptop, which can limit the damage. No service can guarantee that ransomware will be stopped before any harm occurs, so tested backups and a recovery plan remain essential.

What should I confirm before signing an MDR agreement?

Confirm which devices and accounts are covered, which actions the provider can take without your approval, who receives urgent calls, and who handles cleanup and data recovery after an incident.