Use it when
Use this list when one part of your environment needs managed monitoring or response coverage.
Coverage area
Endpoint Security
Providers covering Endpoints. Confirm whether coverage means monitoring, investigation, or response.
40 providers
Arctic Wolf
24/7 MDR through Arctic Wolf's Aurora platform, Concierge Security Team guidance and supported Active Response containment workflows
SMB / Mid-Market · Endpoints
Service MDR
Handles Contain threats
Price AWS Marketplace public offer plus quote-based tiers
CrowdStrike Falcon Complete
24/7 triage, managed threat hunting and remote containment by CrowdStrike on the Falcon platform
Enterprise / Mid-Market · Endpoints
Service MDR
Handles Contain threats
Price ~$25-45/endpoint/month*
Huntress
Managed endpoint, identity, and SIEM monitoring with human SOC investigation, incident reports, and supported containment actions inside the Huntress platform.
SMB / MSP/MSSP · Endpoints
Service MDR
Handles Contain threats
Price Quote-based pricing tied to endpoints, identities, data sources, and learners
Red Canary
24/7 MDR that investigates supported security telemetry and can run response playbooks through existing tools
Mid-Market / Enterprise · Endpoints
Service MDR
Handles Contain threats
Price Quote-based. Public reviews mention roughly $100/device/year*
Sophos MDR
24/7 managed detection, investigation, threat hunting and response through Sophos Central and supported integrations
SMB / Mid-Market · Endpoints
Service MDR
Handles Contain threats
Price AWS Marketplace: $239.64/user/year and $390.72/server/year*
Adlumin
A co-managed security operations platform that combines SIEM-style log collection, UEBA, SOAR automation, compliance reporting and 24/7 MDR support
SMB / Mid-Market · Endpoints
Service MDR
Handles Co-manage the SOC
Price Quote-based
Alert Logic
24/7 MDR over Alert Logic's own platform, with exposure management, log collection, SOC triage and optional Managed WAF coverage
SMB / Mid-Market · Endpoints
Service MDR
Handles Investigate and advise
Price Quote-based
Armis Managed Threat Service
Threat hunting, suspicious-activity review, alert enrichment, risk-based policy tuning, weekly findings, trend reviews and investigation support around Armis Centrix.
Mid-Market / Enterprise · Endpoints
Service MSSP
Handles Investigate and advise
Price G-Cloud examples from £134,400 per asset block*
Barracuda Managed XDR
24/7 Managed XDR across selected Barracuda and third-party security controls, with SOC triage and scope-dependent automated response
SMB / Mid-Market · Endpoints
Service XDR
Handles Contain threats
Price Quote-based; per-user and per-device units
Binary Defense Co-Management
Binary Defense engineers and analysts help operate customer-owned SIEM, XDR and endpoint tools with 24/7 monitoring, detection tuning, alert triage, investigation, threat hunting context and response guidance.
Mid-Market / Enterprise · Endpoints
Service Co-managed SOC
Handles Co-manage the SOC
Price Quote-based through direct, partner or AWS Marketplace private offer
Bitdefender MDR
24/7 SOC investigation, threat hunting, reporting and pre-approved containment through Bitdefender GravityZone
SMB / Mid-Market · Endpoints
Service MDR
Handles Contain threats
Price Quote-based with no official public MDR list price found
Blackpoint Cyber
24/7 managed detection and response through Blackpoint's CompassOne platform, with SOC investigation, endpoint and cloud coverage, active containment, MSP workflow integrations and optional posture, logging and application-control modules.
MSP/MSSP / SMB · Endpoints
Service MDR
Handles Contain threats
Price Quote-based MSP/channel pricing
BlueVoyant MDR
24/7 MDR and co-managed SOC support with alert triage, investigation, detection content, threat intelligence, approved response actions, portal visibility and Microsoft or Splunk operating support
Mid-Market / Enterprise · Endpoints
Service Co-managed SOC
Handles Co-manage the SOC
Price AWS Marketplace Splunk MDR listing starts at $73,872 per 12 months
Blumira
Managed detections, cloud SIEM visibility, guided findings and edition-based containment actions in Blumira's own platform
SMB / Mid-Market · Endpoints
Service XDR
Handles Contain threats
Price Public pricing from $12-$21/employee/month
Bridewell Security Operations Center
Hybrid or fully outsourced SOC operation with 24/7 monitoring, alert investigation, threat hunting, threat intelligence, SIEM and SOAR enhancement, incident response leadership and detection improvement across agreed environments.
Mid-Market / Enterprise · Endpoints
Service SOCaaS
Handles Run the SOC
Price Public G-Cloud references by user, server and scope
BT Managed Sentinel
24x7 managed Microsoft Sentinel monitoring, rule tuning, SOC investigation, incident reporting and buyer guidance
Enterprise / Mid-Market · Network
Service MSSP
Handles Investigate and advise
Price Public G-Cloud price from £6,275 per instance
Critical Start
24x7 MDR monitoring, investigation, false-positive reduction, alert resolution workflow, scoped response actions, coverage-gap visibility and SOC collaboration through CORR and MOBILESOC.
Mid-Market / Enterprise · Endpoints
Service MDR
Handles Contain threats
Price Quote-based tiered MDR with AWS Marketplace private-offer procurement
Cyderes MDR
24/7 MDR with analyst investigation, AI-assisted correlation, identity and asset context through Meridian, customer-specific detection and response paths, optional tool management and approved containment actions.
Mid-Market / Enterprise · Endpoints
Service Co-managed SOC
Handles Co-manage the SOC
Price Quote-based subscription by environment size and service level
Darktrace Managed Detection and Response
24/7 SOC monitoring of the buyer's Darktrace environment, alert triage, investigations, containment-action escalation, analyst questions, monthly service reports, service-ready checks and optimization reviews.
Mid-Market / Enterprise · Network
Service MDR
Handles Co-manage the SOC
Price Quote-based; AWS Marketplace supports private offers but does not expose a reliable public service rate.
Deepwatch Guardian MDR Platform
24/7 co-managed MDR with alert validation, investigation, threat hunting, detection engineering, response workflow support, named experts and a shared Security Center layered over supported buyer tools.
Mid-Market / Enterprise · Endpoints
Service Co-managed SOC
Handles Co-manage the SOC
Price Quote-based through direct or marketplace scoping
Dell Managed Detection and Response
24/7 Dell SOC monitoring, threat investigation, threat hunting and pre-approved platform response for supported XDR environments
Mid-Market / Enterprise · Endpoints
Service MDR
Handles Contain threats
Price Quote-based, per managed endpoint
eSentire
24/7 MDR monitoring, threat hunting, alert validation, investigation, multi-signal correlation, containment actions, incident handling and reporting through eSentire Atlas XDR and eSentire's SOC team.
SMB / Mid-Market · Endpoints
Service MDR
Handles Contain threats
Price Quote-based Atlas Essentials, Advanced and Complete MDR packages
Expel MDR
24/7 SOC monitoring, analyst investigation, Workbench visibility, cross-product correlation, remediation recommendations and pre-approved auto-remediation through supported tools.
Mid-Market / Enterprise · Endpoints
Service MDR
Handles Contain threats
Price Quote-based Starter, Select and Premium MDR packages
Field Effect MDR
24/7 MDR over Field Effect's endpoint, cloud and network telemetry, with AROs and policy-bound active response
SMB / MSP/MSSP · Endpoints
Service MDR
Handles Contain threats
Price Quote-based per-user pricing
Forescout Assist for Threat Detection & Response
24/7 monitoring of Forescout TDR detections, suspicious-entity triage, incident case investigation, impact classification, customer escalation, proactive threat hunting, log-source monitoring and containment or remediation guidance.
Enterprise / Mid-Market · Endpoints
Service MDR
Handles Investigate and advise
Price Public reseller signal: CDW lists a one-year Forescout Assist F/XDR subscription SKU at $11,771.99; final Assist scope is quote-based.
Kaseya MDR
24/7 SOC monitoring, analyst investigation, phone or email escalation and covered containment actions for licensed endpoints, Microsoft 365 and firewall signals
MSP/MSSP / SMB · Endpoints
Service MDR
Handles Contain threats
Price Quote-based, licensed by endpoint and Microsoft 365 coverage
Lumu Defender
Continuous compromise monitoring from network metadata with incident context, playbooks and buyer-configured response integrations
SMB / Mid-Market · Network
Service XDR
Handles Monitor and notify
Price Free tier with paid per-asset plans
Mandiant Managed Defense
24/7 Mandiant MDR with alert triage, investigation, threat hunting, curated detections, investigation reports, supported technology integrations and scoped response actions through Google SecOps and partner tools.
Mid-Market / Enterprise · Endpoints
Service MDR
Handles Contain threats
Price CDW reseller listing shows $53.99 for one Managed Defense subscription license SKU
Microsoft Defender Experts for Hunting
24/7/365 Microsoft-managed threat hunting across eligible Defender telemetry, Defender Experts Notifications, Ask Defender Experts credits, reporting and remediation guidance for an existing SOC.
Mid-Market / Enterprise · Endpoints
Service XDR
Handles Investigate and advise
Price Quote-based Microsoft commercial licensing; no public standalone list price found.
Microsoft Defender Experts for XDR
24/7 Microsoft-managed triage, investigation, proactive hunting, managed response recommendations and scoped remediation actions for eligible Microsoft Defender XDR incidents.
Mid-Market / Enterprise · Endpoints
Service XDR
Handles Contain threats
Price Microsoft sales-led pricing with a Defender Experts Suite 1,500-seat minimum in Product Terms
Netsurion Managed Open XDR
Co-managed Open XDR with managed SIEM, 24/7 SOC monitoring, workflow automation, threat hunting, log retention, compliance reporting and package-dependent endpoint, vulnerability and incident-support options.
SMB / Mid-Market · Endpoints
Service Co-managed SOC
Handles Co-manage the SOC
Price Quote-based, with pay-as-you-grow packaging referenced for MSP buyers
Ontinue ION MXDR
24/7 Microsoft-focused MXDR with ION automation, Sentinel and Defender operations, Cyber Defender investigation, threat hunting, Teams collaboration and Cyber Advisor posture work
Mid-Market / Enterprise · Endpoints
Service Co-managed SOC
Handles Co-manage the SOC
Price Quote-based, licensed per Ontinue Unit
Orange Cyberdefense Managed Threat Detection and Response
24/7 managed detection, triage, investigation and contracted response through Orange Cyberdefense CyberSOCs, Core Fusion and supported EDR, NDR, SIEM, cloud and OT telemetry
Mid-Market / Enterprise · Endpoints
Service MDR
Handles Contain threats
Price Quote-based, private-offer signals
Pondurance
Outsourced SOC coverage with managed SIEM, MDR, threat hunting, triage and scoped containment across existing tools
Mid-Market / SMB · Endpoints
Service SOCaaS
Handles Run the SOC
Price Quote-based, scoped MDR/SOC quote
Proficio ProSOC MDR
24/7 SOC monitoring, analyst investigation, hosted or customer-owned SIEM operations, threat hunting, case management, guided remediation and optional Active Defense containment across supported tools.
Mid-Market / Enterprise · Endpoints
Service Co-managed SOC
Handles Co-manage the SOC
Price Quote-based direct, partner or marketplace private offer
Rapid7 Managed Threat Complete
24/7 SOC monitoring, alert validation, investigation, exposure-informed prioritization, threat hunting, incident-response support, Rapid7 SIEM visibility, unlimited log ingestion in published packages, 13-month retention and configured Active Response containment.
Enterprise / Mid-Market · Endpoints
Service MDR
Handles Contain threats
Price AWS Marketplace lists Managed Threat Complete Essential at $73,000 for a 12-month contract starting at 300 assets; Rapid7 also supports private offers and custom quotes.
ReliaQuest GreyMatter
GreyMatter connects to enterprise security tools, normalizes alerts, supports investigation and hunting, runs approved response playbooks and gives the buyer a shared operating surface with ReliaQuest analysts and engineers.
Enterprise / Mid-Market · Endpoints
Service Co-managed SOC
Handles Co-manage the SOC
Price AWS Marketplace lists a 12-month GreyMatter SIEM Integration Plus package at $226,000*
SecurityHQ Managed SOC
24/7 managed SOC coverage with monitoring, triage, investigation, threat hunting, containment playbooks, reporting, SHQ Response collaboration and optional managed protection or risk services
Mid-Market / Enterprise · Endpoints
Service SOCaaS
Handles Run the SOC
Price G-Cloud examples from £30,664.70 to £297,154 per year*
SentinelOne Wayfinder MDR
24/7 SentinelOne-native MDR with alert monitoring, triage, investigation, managed response, threat hunting signals, analyst documentation, and containment or mitigation actions inside the contracted Singularity scope.
Mid-Market / Enterprise · Endpoints
Service MDR
Handles Contain threats
Price Quote-based with reseller SKU pages routing to request pricing
Todyl MXDR
24/7 MXDR over Todyl's managed SIEM and security stack, with transparent cases, live analyst access and a dedicated DRAM
MSP/MSSP / SMB · Endpoints
Service Co-managed SOC
Handles Co-manage the SOC
Price Quote-based Essentials, Advanced and Complete packages
How to use this list
Do not assume
Coverage does not always mean action. Some providers monitor a source but cannot contain threats there.
Ask before shortlisting
- Confirm which telemetry sources are included by default.
- Ask whether response actions work on this surface or only alerting is included.
- Check whether reporting and detection tuning are part of the managed service.
Category background
These SOC providers monitor and protect your endpoints — laptops, desktops, and servers — with 24/7 threat detection and response. Endpoints are the most common attack surface and the foundation of most managed security services.
Why Endpoint Monitoring Matters
Endpoints are where most attacks begin — phishing emails land on laptops, ransomware encrypts servers, and attackers move laterally across workstations. An EDR agent on each device combined with 24/7 analyst monitoring catches threats that antivirus misses. Every SOC provider listed here includes endpoint coverage as a core capability.
Questions
What does endpoint security monitoring include?
Endpoint security monitoring means a SOC provider watches your laptops, desktops, and servers 24/7 for threats like malware, ransomware, fileless attacks, and suspicious user behavior. Most providers use EDR (Endpoint Detection and Response) agents that collect telemetry from each device. The provider's analysts investigate alerts, and depending on the service level, either notify you or take containment actions like isolating an infected machine.
Do I need my own EDR tool, or does the SOC provider bring one?
It depends on the provider. Some (like CrowdStrike Falcon Complete or SentinelOne Vigilance) include their own EDR agent as part of the service. Others (like Expel or Red Canary) are vendor-agnostic and work with whatever EDR you already have — CrowdStrike, SentinelOne, Microsoft Defender, etc. If you don't have an EDR tool yet, look for providers that include one in their service.