Use it when
Use this list when one part of your environment needs managed monitoring or response coverage.
Coverage area
Identity & Access Monitoring
Providers covering Identity & Access. Confirm whether coverage means monitoring, investigation, or response.
38 providers
Arctic Wolf
24/7 MDR through Arctic Wolf's Aurora platform, Concierge Security Team guidance and supported Active Response containment workflows
SMB / Mid-Market · Endpoints
Service MDR
Handles Contain threats
Price AWS Marketplace public offer plus quote-based tiers
CrowdStrike Falcon Complete
24/7 triage, managed threat hunting and remote containment by CrowdStrike on the Falcon platform
Enterprise / Mid-Market · Endpoints
Service MDR
Handles Contain threats
Price ~$25-45/endpoint/month*
Huntress
Managed endpoint, identity, and SIEM monitoring with human SOC investigation, incident reports, and supported containment actions inside the Huntress platform.
SMB / MSP/MSSP · Endpoints
Service MDR
Handles Contain threats
Price Quote-based pricing tied to endpoints, identities, data sources, and learners
Red Canary
24/7 MDR that investigates supported security telemetry and can run response playbooks through existing tools
Mid-Market / Enterprise · Endpoints
Service MDR
Handles Contain threats
Price Quote-based. Public reviews mention roughly $100/device/year*
Sophos MDR
24/7 managed detection, investigation, threat hunting and response through Sophos Central and supported integrations
SMB / Mid-Market · Endpoints
Service MDR
Handles Contain threats
Price AWS Marketplace: $239.64/user/year and $390.72/server/year*
Adlumin
A co-managed security operations platform that combines SIEM-style log collection, UEBA, SOAR automation, compliance reporting and 24/7 MDR support
SMB / Mid-Market · Endpoints
Service MDR
Handles Co-manage the SOC
Price Quote-based
Alert Logic
24/7 MDR over Alert Logic's own platform, with exposure management, log collection, SOC triage and optional Managed WAF coverage
SMB / Mid-Market · Endpoints
Service MDR
Handles Investigate and advise
Price Quote-based
Barracuda Managed XDR
24/7 Managed XDR across selected Barracuda and third-party security controls, with SOC triage and scope-dependent automated response
SMB / Mid-Market · Endpoints
Service XDR
Handles Contain threats
Price Quote-based; per-user and per-device units
Binary Defense Co-Management
Binary Defense engineers and analysts help operate customer-owned SIEM, XDR and endpoint tools with 24/7 monitoring, detection tuning, alert triage, investigation, threat hunting context and response guidance.
Mid-Market / Enterprise · Endpoints
Service Co-managed SOC
Handles Co-manage the SOC
Price Quote-based through direct, partner or AWS Marketplace private offer
Bitdefender MDR
24/7 SOC investigation, threat hunting, reporting and pre-approved containment through Bitdefender GravityZone
SMB / Mid-Market · Endpoints
Service MDR
Handles Contain threats
Price Quote-based with no official public MDR list price found
Blackpoint Cyber
24/7 managed detection and response through Blackpoint's CompassOne platform, with SOC investigation, endpoint and cloud coverage, active containment, MSP workflow integrations and optional posture, logging and application-control modules.
MSP/MSSP / SMB · Endpoints
Service MDR
Handles Contain threats
Price Quote-based MSP/channel pricing
BlueVoyant MDR
24/7 MDR and co-managed SOC support with alert triage, investigation, detection content, threat intelligence, approved response actions, portal visibility and Microsoft or Splunk operating support
Mid-Market / Enterprise · Endpoints
Service Co-managed SOC
Handles Co-manage the SOC
Price AWS Marketplace Splunk MDR listing starts at $73,872 per 12 months
Blumira
Managed detections, cloud SIEM visibility, guided findings and edition-based containment actions in Blumira's own platform
SMB / Mid-Market · Endpoints
Service XDR
Handles Contain threats
Price Public pricing from $12-$21/employee/month
Bridewell Security Operations Center
Hybrid or fully outsourced SOC operation with 24/7 monitoring, alert investigation, threat hunting, threat intelligence, SIEM and SOAR enhancement, incident response leadership and detection improvement across agreed environments.
Mid-Market / Enterprise · Endpoints
Service SOCaaS
Handles Run the SOC
Price Public G-Cloud references by user, server and scope
BT Managed Sentinel
24x7 managed Microsoft Sentinel monitoring, rule tuning, SOC investigation, incident reporting and buyer guidance
Enterprise / Mid-Market · Network
Service MSSP
Handles Investigate and advise
Price Public G-Cloud price from £6,275 per instance
Critical Start
24x7 MDR monitoring, investigation, false-positive reduction, alert resolution workflow, scoped response actions, coverage-gap visibility and SOC collaboration through CORR and MOBILESOC.
Mid-Market / Enterprise · Endpoints
Service MDR
Handles Contain threats
Price Quote-based tiered MDR with AWS Marketplace private-offer procurement
Cyderes MDR
24/7 MDR with analyst investigation, AI-assisted correlation, identity and asset context through Meridian, customer-specific detection and response paths, optional tool management and approved containment actions.
Mid-Market / Enterprise · Endpoints
Service Co-managed SOC
Handles Co-manage the SOC
Price Quote-based subscription by environment size and service level
Darktrace Managed Detection and Response
24/7 SOC monitoring of the buyer's Darktrace environment, alert triage, investigations, containment-action escalation, analyst questions, monthly service reports, service-ready checks and optimization reviews.
Mid-Market / Enterprise · Network
Service MDR
Handles Co-manage the SOC
Price Quote-based; AWS Marketplace supports private offers but does not expose a reliable public service rate.
Datadog Cloud SIEM
Cloud SIEM detection rules, security signals, notifications, cases, dashboards, threat intelligence context and workflow hooks inside Datadog
Enterprise / Mid-Market · Cloud Workloads
Service SOCaaS
Handles Monitor and notify
Price Published from $5 per 1M analyzed events/month
Deepwatch Guardian MDR Platform
24/7 co-managed MDR with alert validation, investigation, threat hunting, detection engineering, response workflow support, named experts and a shared Security Center layered over supported buyer tools.
Mid-Market / Enterprise · Endpoints
Service Co-managed SOC
Handles Co-manage the SOC
Price Quote-based through direct or marketplace scoping
eSentire
24/7 MDR monitoring, threat hunting, alert validation, investigation, multi-signal correlation, containment actions, incident handling and reporting through eSentire Atlas XDR and eSentire's SOC team.
SMB / Mid-Market · Endpoints
Service MDR
Handles Contain threats
Price Quote-based Atlas Essentials, Advanced and Complete MDR packages
Expel MDR
24/7 SOC monitoring, analyst investigation, Workbench visibility, cross-product correlation, remediation recommendations and pre-approved auto-remediation through supported tools.
Mid-Market / Enterprise · Endpoints
Service MDR
Handles Contain threats
Price Quote-based Starter, Select and Premium MDR packages
Field Effect MDR
24/7 MDR over Field Effect's endpoint, cloud and network telemetry, with AROs and policy-bound active response
SMB / MSP/MSSP · Endpoints
Service MDR
Handles Contain threats
Price Quote-based per-user pricing
Kaseya MDR
24/7 SOC monitoring, analyst investigation, phone or email escalation and covered containment actions for licensed endpoints, Microsoft 365 and firewall signals
MSP/MSSP / SMB · Endpoints
Service MDR
Handles Contain threats
Price Quote-based, licensed by endpoint and Microsoft 365 coverage
Mandiant Managed Defense
24/7 Mandiant MDR with alert triage, investigation, threat hunting, curated detections, investigation reports, supported technology integrations and scoped response actions through Google SecOps and partner tools.
Mid-Market / Enterprise · Endpoints
Service MDR
Handles Contain threats
Price CDW reseller listing shows $53.99 for one Managed Defense subscription license SKU
Microsoft Defender Experts for Hunting
24/7/365 Microsoft-managed threat hunting across eligible Defender telemetry, Defender Experts Notifications, Ask Defender Experts credits, reporting and remediation guidance for an existing SOC.
Mid-Market / Enterprise · Endpoints
Service XDR
Handles Investigate and advise
Price Quote-based Microsoft commercial licensing; no public standalone list price found.
Microsoft Defender Experts for XDR
24/7 Microsoft-managed triage, investigation, proactive hunting, managed response recommendations and scoped remediation actions for eligible Microsoft Defender XDR incidents.
Mid-Market / Enterprise · Endpoints
Service XDR
Handles Contain threats
Price Microsoft sales-led pricing with a Defender Experts Suite 1,500-seat minimum in Product Terms
Netsurion Managed Open XDR
Co-managed Open XDR with managed SIEM, 24/7 SOC monitoring, workflow automation, threat hunting, log retention, compliance reporting and package-dependent endpoint, vulnerability and incident-support options.
SMB / Mid-Market · Endpoints
Service Co-managed SOC
Handles Co-manage the SOC
Price Quote-based, with pay-as-you-grow packaging referenced for MSP buyers
Ontinue ION MXDR
24/7 Microsoft-focused MXDR with ION automation, Sentinel and Defender operations, Cyber Defender investigation, threat hunting, Teams collaboration and Cyber Advisor posture work
Mid-Market / Enterprise · Endpoints
Service Co-managed SOC
Handles Co-manage the SOC
Price Quote-based, licensed per Ontinue Unit
Orange Cyberdefense Managed Threat Detection and Response
24/7 managed detection, triage, investigation and contracted response through Orange Cyberdefense CyberSOCs, Core Fusion and supported EDR, NDR, SIEM, cloud and OT telemetry
Mid-Market / Enterprise · Endpoints
Service MDR
Handles Contain threats
Price Quote-based, private-offer signals
Pondurance
Outsourced SOC coverage with managed SIEM, MDR, threat hunting, triage and scoped containment across existing tools
Mid-Market / SMB · Endpoints
Service SOCaaS
Handles Run the SOC
Price Quote-based, scoped MDR/SOC quote
Proficio ProSOC MDR
24/7 SOC monitoring, analyst investigation, hosted or customer-owned SIEM operations, threat hunting, case management, guided remediation and optional Active Defense containment across supported tools.
Mid-Market / Enterprise · Endpoints
Service Co-managed SOC
Handles Co-manage the SOC
Price Quote-based direct, partner or marketplace private offer
Rapid7 Managed Threat Complete
24/7 SOC monitoring, alert validation, investigation, exposure-informed prioritization, threat hunting, incident-response support, Rapid7 SIEM visibility, unlimited log ingestion in published packages, 13-month retention and configured Active Response containment.
Enterprise / Mid-Market · Endpoints
Service MDR
Handles Contain threats
Price AWS Marketplace lists Managed Threat Complete Essential at $73,000 for a 12-month contract starting at 300 assets; Rapid7 also supports private offers and custom quotes.
ReliaQuest GreyMatter
GreyMatter connects to enterprise security tools, normalizes alerts, supports investigation and hunting, runs approved response playbooks and gives the buyer a shared operating surface with ReliaQuest analysts and engineers.
Enterprise / Mid-Market · Endpoints
Service Co-managed SOC
Handles Co-manage the SOC
Price AWS Marketplace lists a 12-month GreyMatter SIEM Integration Plus package at $226,000*
SecurityHQ Managed SOC
24/7 managed SOC coverage with monitoring, triage, investigation, threat hunting, containment playbooks, reporting, SHQ Response collaboration and optional managed protection or risk services
Mid-Market / Enterprise · Endpoints
Service SOCaaS
Handles Run the SOC
Price G-Cloud examples from £30,664.70 to £297,154 per year*
SentinelOne Wayfinder MDR
24/7 SentinelOne-native MDR with alert monitoring, triage, investigation, managed response, threat hunting signals, analyst documentation, and containment or mitigation actions inside the contracted Singularity scope.
Mid-Market / Enterprise · Endpoints
Service MDR
Handles Contain threats
Price Quote-based with reseller SKU pages routing to request pricing
Todyl MXDR
24/7 MXDR over Todyl's managed SIEM and security stack, with transparent cases, live analyst access and a dedicated DRAM
MSP/MSSP / SMB · Endpoints
Service Co-managed SOC
Handles Co-manage the SOC
Price Quote-based Essentials, Advanced and Complete packages
Verizon Managed SIEM
24/7 SOC monitoring, SIEM alert investigation, incident classification and escalation for a SIEM the buyer already owns
Enterprise / Mid-Market · Network
Service MSSP
Handles Investigate and advise
Price Quote-based, per SIEM serviced device
How to use this list
Do not assume
Coverage does not always mean action. Some providers monitor a source but cannot contain threats there.
Ask before shortlisting
- Confirm which telemetry sources are included by default.
- Ask whether response actions work on this surface or only alerting is included.
- Check whether reporting and detection tuning are part of the managed service.
Category background
These SOC providers monitor your identity and access systems — Active Directory, Azure AD/Entra, Okta, Duo, and other IAM platforms. With 80%+ of breaches involving compromised identities, this is the fastest-growing detection category.
Why Identity Monitoring Matters
Stolen credentials don’t trigger endpoint alerts. An attacker logging in with valid credentials from an unusual location at 3 AM looks normal to endpoint tools. Identity monitoring detects impossible travel, credential stuffing, MFA bypass, privilege escalation, and lateral movement across your identity systems — catching the attacks that endpoint-only providers miss.
Questions
What is identity threat detection and response (ITDR)?
ITDR monitors your identity systems — Active Directory, Azure AD/Entra, Okta, Duo — for signs of compromised credentials, unauthorized access, privilege escalation, and lateral movement. Since 80%+ of breaches involve stolen or compromised identities, ITDR has become one of the fastest-growing detection categories. Providers like Huntress, CrowdStrike, and Microsoft offer managed ITDR as part of their SOC services.
Why do I need identity monitoring separate from endpoint monitoring?
Attackers increasingly bypass endpoints entirely by using stolen credentials, phishing for MFA tokens, or exploiting identity provider misconfigurations. An attacker with valid credentials looks like a legitimate user to endpoint tools. Identity monitoring watches for impossible travel, unusual authentication patterns, privilege escalation, and credential abuse across your identity infrastructure — threats that endpoint-only monitoring misses.