Co-managed SOC providers

Advania UK manages Sentinel operations and investigations while sharing incident escalation and response responsibilities.

You still own Incident participation, response decisions and work outside the service scope

Advens mySOC for IT combines SIEM and network analysis with detection engineering and shared incident playbooks.

You still own Monitoring priorities, approvals and work outside agreed playbooks

Almond CWATCH for Sentinel operates detection in the customer's Azure subscriptions and shares incident work with its IT team.

You still own Azure ownership, approvals and recovery beyond the agreed SOC/CERT scope

Atos maintains Microsoft Sentinel and investigates alerts through its optional MDR module.

You still own Control the Microsoft tenant and source access

Binary Defense co-manages SIEM and XDR configuration, detection rules and alert investigation.

You still own Tool licensing, telemetry quality, response authority and business remediation

BlueVoyant co-manages Microsoft security operations, investigates alerts and responds through agreed rules of engagement.

You still own Platform licensing, data-source coverage, response approvals and business remediation

Cipher analysts investigate around the clock and share detection-rule work and case visibility over existing tools.

You still own Tool administration, business context, permissions and remediation

Clearnetwork manages AlienVault USM, investigates detected threats and emails response guidance.

You still own Containment and recovery, Reseller handoffs if applicable

CyberCX operates Microsoft detections, hunts threats and maintains the managed Sentinel and Defender environment.

You still own Platform and data control, permissions and recovery outside scope

CyberProof analysts share incident handling, detection tuning and response workflows through CDC Reveal360.

You still own Action permissions, agreed tool duties and out-of-scope remediation

Cyderes supports shared investigation and response workflows over existing tools. SIEM and EDR management are optional.

You still own Response rules, platform access and out-of-scope remediation

Deepwatch co-manages monitoring, investigations, detection tuning and approved response workflows across your existing SIEM and security tools.

You still own Connected telemetry, response permissions, IT remediation and recovery

DEFEND investigates alerts and operates Microsoft Sentinel through a shared security operations workflow.

You still own Connected systems, response permissions and approved major incident costs

FourNet's co-managed SOC investigates alerts, maintains detections and carries out response steps agreed in runbooks.

You still own Selected containment actions, Estate changes and decisions

Fujitsu operates customer-tenant Sentinel, investigates alerts and coordinates the handoff to resolver teams.

You still own Azure ownership and remediation beyond the agreed handoff

IBM analysts and ATOM share detection, investigation and response workflows across your existing tools.

You still own Detection approvals, action permissions, tool access and out-of-scope recovery

ITrust operates Reveelium detection and shares incident investigation and resolution with the customer's IT team.

You still own System context, assigned response actions and recovery beyond scope

KPMG's US MDR combines analyst incident work with ongoing SIEM, EDR and SOAR engineering.

You still own Tenant control, priorities, response permissions and out-of-scope recovery

24/7 investigations and hunts with shared FusionDetect rules, queries and approved critical-incident response.

You still own Detection choices, source access, response authority and recovery

Lumifi co-manages detections, investigations and response workflows through ShieldVision and supported security tools.

You still own Source access, response authority, internal decisions and recovery outside scope

Shared SOC workflows through the Unified Cyber Platform, with 24/7 investigation and scoped response.

You still own Source access, shared SOC decisions, action permissions and recovery

Novacoast operates the buyer's SIEM, maintains detections and investigates alerts before escalation.

You still own Tenant and source systems, Agreed response duties, An available support contact

Ontinue co-manages Sentinel and Defender, investigating alerts and executing approved containment through Microsoft controls.

You still own Microsoft licensing, log sources, response rules and IT remediation

Optiv manages Google Security Operations health, log configuration and detection rules, then investigates alerts and recommends mitigation.

You still own Source systems and access, Containment and recovery

Performanta shares SIEM monitoring, investigation, detection engineering and incident workflows with your security team.

You still own Internal decisions, access, environment changes and the agreed response split

plusserver operates hosted QRadar and investigates alerts, with incident handling shared through the customer's response process.

You still own Interfaces, incident ownership and response outside the management level

Proficio co-manages hosted or customer SIEM workflows, investigates alerts and adds containment when Active Defense is included.

You still own Connected tools, response approvals, change controls and post-containment remediation

Quorum operates Sentinel health, detections and incidents through containment across scoped Microsoft and third-party sources.

You still own Microsoft licensing, source access, action permissions and recovery

GreyMatter combines automated investigations, response playbooks and ReliaQuest operating support across connected security tools.

You still own Tool licenses, source access, action permissions, escalation decisions and recovery

Secon.SOC shares monitoring, investigation, detection improvement and playbook-led response coordination.

You still own Internal security ownership, decisions and assigned remediation

Sopra Steria SOC Core provides UK monitoring, investigation and ongoing SIEM work alongside the customer's incident team.

You still own Asset context, incident ownership and response tasks outside the selected tier

Telefónica Tech operates the SIEM, maintains detections and investigates alerts before the agreed response handoff.

You still own Monitoring priorities and response beyond the agreed procedures

Thales investigates alerts, tunes detections and administers the platforms assigned in a shared SOC service.

You still own Shared SOC decisions, approvals and work beyond scope

Todyl analysts share SIEM investigations, tune detections and coordinate response with the MSP.

You still own Tenant policy, access, client communication and recovery

Verizon investigates SIEM incidents and implements agreed detection-content changes. Your team owns platform hosting, source health and containment.

You still own SIEM hosting, source health, change approval, containment and recovery

Bridewell's fully outsourced SOC runs daily monitoring, investigation and detection tuning, then leads response within agreed playbooks.

You still own Telemetry, tenant permissions, response approvals, business remediation and recovery