Coverage area

Email Security Monitoring

Lumu Defender

Continuous compromise monitoring from network metadata with incident context, playbooks and buyer-configured response integrations

NetworkEndpointsEmail

What they do Monitor and notify XDR
Market SMBMid-Market
Price Free tier with paid per-asset plans

You still own Deciding which automated response policies and integrations are allowed

24/7/365 Microsoft-managed threat hunting across eligible Defender telemetry, Defender Experts Notifications, Ask Defender Experts credits, reporting and remediation guidance for an existing SOC.

EndpointsCloud WorkloadsIdentity & Access

What they do Investigate and advise XDR
Market Mid-MarketEnterprise
Price Quote-based Microsoft commercial licensing; no public standalone list price found.

You still own Running the SOC workflow after Microsoft sends a notification

Arctic Wolf

24/7 MDR through Arctic Wolf's Aurora platform, Concierge Security Team guidance and supported Active Response containment workflows

EndpointsCloud WorkloadsIdentity & Access

What they do Contain threats MDR
Market SMBMid-Market
Price AWS Marketplace public offer plus quote-based tiers

You still own Choosing the MDR bundle, Concierge tier, add-ons, warranty eligibility and retention scope

Barracuda Managed XDR

24/7 Managed XDR across selected Barracuda and third-party security controls, with SOC triage and scope-dependent automated response

EndpointsCloud WorkloadsIdentity & Access

What they do Contain threats XDR
Market SMBMid-Market
Price Quote-based; per-user and per-device units

You still own Confirming which XDR modules are included and which assets, users or devices are covered

Bitdefender MDR

24/7 SOC investigation, threat hunting, reporting and pre-approved containment through Bitdefender GravityZone

EndpointsCloud WorkloadsIdentity & Access

What they do Contain threats MDR
Market SMBMid-Market
Price Quote-based with no official public MDR list price found

You still own Choosing the MDR or MDR PLUS scope and enabling the required GravityZone coverage

Blackpoint Cyber

24/7 managed detection and response through Blackpoint's CompassOne platform, with SOC investigation, endpoint and cloud coverage, active containment, MSP workflow integrations and optional posture, logging and application-control modules.

EndpointsIdentity & AccessNetwork

What they do Contain threats MDR
Market MSP/MSSPSMB
Price Quote-based MSP/channel pricing

You still own Deploying and maintaining agents, cloud connectors and supported integrations

Blumira

Managed detections, cloud SIEM visibility, guided findings and edition-based containment actions in Blumira's own platform

EndpointsCloud WorkloadsIdentity & Access

What they do Contain threats XDR
Market SMBMid-Market
Price Public pricing from $12-$21/employee/month

You still own Connecting cloud, identity, endpoint, firewall and SaaS sources and keeping permissions current

Critical Start

24x7 MDR monitoring, investigation, false-positive reduction, alert resolution workflow, scoped response actions, coverage-gap visibility and SOC collaboration through CORR and MOBILESOC.

EndpointsCloud WorkloadsIdentity & Access

What they do Contain threats MDR
Market Mid-MarketEnterprise
Price Quote-based tiered MDR with AWS Marketplace private-offer procurement

You still own Licensing, deploying and maintaining the EDR, SIEM, identity, cloud and other tools in scope

eSentire

24/7 MDR monitoring, threat hunting, alert validation, investigation, multi-signal correlation, containment actions, incident handling and reporting through eSentire Atlas XDR and eSentire's SOC team.

EndpointsCloud WorkloadsIdentity & Access

What they do Contain threats MDR
Market SMBMid-Market
Price Quote-based Atlas Essentials, Advanced and Complete MDR packages

You still own Granting and maintaining access to endpoint, identity, cloud, email, SIEM and network tools that eSentire is expected to monitor or use for response

Expel MDR

24/7 SOC monitoring, analyst investigation, Workbench visibility, cross-product correlation, remediation recommendations and pre-approved auto-remediation through supported tools.

EndpointsCloud WorkloadsIdentity & Access

What they do Contain threats MDR
Market Mid-MarketEnterprise
Price Quote-based Starter, Select and Premium MDR packages

You still own Maintaining and licensing the endpoint, identity, cloud, email, SaaS, network and SIEM tools in scope

Field Effect MDR

24/7 MDR over Field Effect's endpoint, cloud and network telemetry, with AROs and policy-bound active response

EndpointsCloud WorkloadsIdentity & Access

What they do Contain threats MDR
Market SMBMSP/MSSP
Price Quote-based per-user pricing

You still own Choosing the Active Response policy and excluding critical systems where downtime risk matters

Huntress

Managed endpoint, identity, and SIEM monitoring with human SOC investigation, incident reports, and supported containment actions inside the Huntress platform.

EndpointsIdentity & AccessEmail

What they do Contain threats MDR
Market SMBMSP/MSSP
Price Quote-based pricing tied to endpoints, identities, data sources, and learners

You still own Deploying agents and configuring Microsoft 365, SIEM, PSA, and ticketing integrations

Kaseya MDR

24/7 SOC monitoring, analyst investigation, phone or email escalation and covered containment actions for licensed endpoints, Microsoft 365 and firewall signals

EndpointsIdentity & AccessEmail

What they do Contain threats MDR
Market MSP/MSSPSMB
Price Quote-based, licensed by endpoint and Microsoft 365 coverage

You still own Licensing every endpoint and Microsoft 365 account that needs MDR coverage

Mandiant Managed Defense

24/7 Mandiant MDR with alert triage, investigation, threat hunting, curated detections, investigation reports, supported technology integrations and scoped response actions through Google SecOps and partner tools.

EndpointsCloud WorkloadsIdentity & Access

What they do Contain threats MDR
Market Mid-MarketEnterprise
Price CDW reseller listing shows $53.99 for one Managed Defense subscription license SKU

You still own Licensing and operating the Google Security Operations environment and required partner technologies

24/7 Microsoft-managed triage, investigation, proactive hunting, managed response recommendations and scoped remediation actions for eligible Microsoft Defender XDR incidents.

EndpointsCloud WorkloadsIdentity & Access

What they do Contain threats XDR
Market Mid-MarketEnterprise
Price Microsoft sales-led pricing with a Defender Experts Suite 1,500-seat minimum in Product Terms

You still own Licensing and actively deploying the eligible Defender and Entra products that define service coverage

Rapid7 Managed Threat Complete

24/7 SOC monitoring, alert validation, investigation, exposure-informed prioritization, threat hunting, incident-response support, Rapid7 SIEM visibility, unlimited log ingestion in published packages, 13-month retention and configured Active Response containment.

EndpointsCloud WorkloadsIdentity & Access

What they do Contain threats MDR
Market EnterpriseMid-Market
Price AWS Marketplace lists Managed Threat Complete Essential at $73,000 for a 12-month contract starting at 300 assets; Rapid7 also supports private offers and custom quotes.

You still own Scoping protected endpoints, servers, networks and third-party event sources

Red Canary

24/7 MDR that investigates supported security telemetry and can run response playbooks through existing tools

EndpointsCloud WorkloadsIdentity & Access

What they do Contain threats MDR
Market Mid-MarketEnterprise
Price Quote-based. Public reviews mention roughly $100/device/year*

You still own Approving which response playbooks can run automatically

Sophos MDR

24/7 managed detection, investigation, threat hunting and response through Sophos Central and supported integrations

EndpointsCloud WorkloadsIdentity & Access

What they do Contain threats MDR
Market SMBMid-Market
Price AWS Marketplace: $239.64/user/year and $390.72/server/year*

You still own Selecting Collaborate, Authorize or Notify Only response mode

Adlumin

A co-managed security operations platform that combines SIEM-style log collection, UEBA, SOAR automation, compliance reporting and 24/7 MDR support

EndpointsCloud WorkloadsIdentity & Access

What they do Co-manage the SOC MDR
Market SMBMid-Market
Price Quote-based

You still own Connecting the right data sources and validating what each source is used for

Binary Defense Co-Management

Binary Defense engineers and analysts help operate customer-owned SIEM, XDR and endpoint tools with 24/7 monitoring, detection tuning, alert triage, investigation, threat hunting context and response guidance.

EndpointsCloud WorkloadsIdentity & Access

What they do Co-manage the SOC Co-managed SOC
Market Mid-MarketEnterprise
Price Quote-based through direct, partner or AWS Marketplace private offer

You still own Owning and licensing the SIEM, XDR, EDR, identity and cloud tools in scope

24/7 SOC monitoring of the buyer's Darktrace environment, alert triage, investigations, containment-action escalation, analyst questions, monthly service reports, service-ready checks and optimization reviews.

NetworkCloud WorkloadsOT/ICS

What they do Co-manage the SOC MDR
Market Mid-MarketEnterprise
Price Quote-based; AWS Marketplace supports private offers but does not expose a reliable public service rate.

You still own Deploying and tuning the relevant Darktrace modules and sensors across the environment

Netsurion Managed Open XDR

Co-managed Open XDR with managed SIEM, 24/7 SOC monitoring, workflow automation, threat hunting, log retention, compliance reporting and package-dependent endpoint, vulnerability and incident-support options.

EndpointsCloud WorkloadsIdentity & Access

What they do Co-manage the SOC Co-managed SOC
Market SMBMid-Market
Price Quote-based, with pay-as-you-grow packaging referenced for MSP buyers

You still own Choosing which endpoints, cloud services, identity systems, network tools and SaaS sources are in scope

Ontinue ION MXDR

24/7 Microsoft-focused MXDR with ION automation, Sentinel and Defender operations, Cyber Defender investigation, threat hunting, Teams collaboration and Cyber Advisor posture work

EndpointsCloud WorkloadsIdentity & Access

What they do Co-manage the SOC Co-managed SOC
Market Mid-MarketEnterprise
Price Quote-based, licensed per Ontinue Unit

You still own Buying and maintaining required Microsoft Sentinel, Log Analytics, Defender and Teams licensing

Proficio ProSOC MDR

24/7 SOC monitoring, analyst investigation, hosted or customer-owned SIEM operations, threat hunting, case management, guided remediation and optional Active Defense containment across supported tools.

EndpointsCloud WorkloadsIdentity & Access

What they do Co-manage the SOC Co-managed SOC
Market Mid-MarketEnterprise
Price Quote-based direct, partner or marketplace private offer

You still own Choosing and licensing the SIEM, EDR, identity, cloud and ticketing tools in scope

ReliaQuest GreyMatter

GreyMatter connects to enterprise security tools, normalizes alerts, supports investigation and hunting, runs approved response playbooks and gives the buyer a shared operating surface with ReliaQuest analysts and engineers.

EndpointsCloud WorkloadsIdentity & Access

What they do Co-manage the SOC Co-managed SOC
Market EnterpriseMid-Market
Price AWS Marketplace lists a 12-month GreyMatter SIEM Integration Plus package at $226,000*

You still own Licensing and administering the SIEM, EDR, cloud, identity, email and network controls in scope

How to use this list

Use it when

  • Use this list when one part of your environment needs managed monitoring or response coverage.

Do not assume

  • Coverage does not always mean action. Some providers monitor a source but cannot contain threats there.

Ask before shortlisting

  1. Confirm which telemetry sources are included by default.
  2. Ask whether response actions work on this surface or only alerting is included.
  3. Check whether reporting and detection tuning are part of the managed service.
Category background

These SOC providers monitor your email systems for phishing, business email compromise (BEC), malicious attachments, and account takeover. Email remains the #1 initial attack vector for most organizations.

Why Email Monitoring Matters

Over 90% of cyber attacks start with email. Phishing, spear-phishing, and BEC schemes bypass traditional spam filters by using social engineering rather than malware. SOC providers that monitor email detect suspicious forwarding rules, inbox manipulation, credential harvesting links, and impersonation patterns — often catching attacks that email gateways alone miss.

Questions

Do SOC providers monitor email?
Many SOC providers include email security monitoring as part of their service. They integrate with email security gateways (Proofpoint, Mimecast), Microsoft 365, and Google Workspace to detect phishing, business email compromise (BEC), malicious attachments, and account takeover. Some providers focus heavily on email while others include it as one of many monitored surfaces.
What is business email compromise and can a SOC provider detect it?
Business email compromise (BEC) is when an attacker impersonates a trusted person — a CEO, vendor, or colleague — to trick employees into transferring money or sharing sensitive data. SOC providers with email and identity monitoring can detect signs of BEC including unusual forwarding rules, inbox manipulation, login anomalies, and impersonation patterns. This often requires correlation across email and identity data sources.