SOC providers for your existing tools

Investigates alerts through read-only queries and hands analysts a documented verdict.

You still own Access, escalation review, containment and recovery.

24/7 analysts validate incidents and advise your team. Optional active response needs advance action permissions.

You still own Passive response execution, tool access and system recovery

NVISO investigates Microsoft alerts and routes actionable incidents to the buyer’s IT team.

You still own Execute containment unless separately assigned

Investigates connected alerts and sends evidence-backed verdicts to your SOC.

You still own Verdict validation, containment, remediation and source-tool operation.

Investigates connected alerts and executes permitted containment through existing tools.

You still own Coverage, approvals, complex escalations and recovery.

Check Point MDR 360° investigation and configured containment across agreed security integrations.

You still own Tool access, response approvals and work outside the agreement

Critical Start MDR investigates alerts from your security tools and can contain threats under agreed rules of engagement.

You still own Tool licensing, telemetry coverage, response approvals, remediation and recovery

Investigates alerts and triggers configured SOAR containment after checking evidence.

You still own Hosting, model access, response permissions, action checks and recovery.

24/7 analysts investigate and contain incidents across the assets covered by your MaxxMDR tier.

You still own Tool access, response permissions and business recovery

Investigates alerts and executes containment through risk-based approval gates.

You still own Autonomy settings, permissions, approvals, incident decisions and recovery.

Investigates alerts and executes permitted containment through connected tools.

You still own Detection tools, response permissions, uncertain cases and recovery.

Expel investigates alerts in existing tools and executes enabled containment after analyst review.

You still own Tool licenses, action permissions, exceptions and recovery

Aegis MDR investigates threats and performs preagreed containment across customer-selected security tools.

You still own Technology ownership, response permissions and wider recovery

Investigates multi-source alerts using forensic evidence and runs configured response actions.

You still own Detection tools, response policies, contested verdicts and recovery.

Mandiant investigates Google SecOps alerts and can contain affected hosts through supported tools under agreed response authority.

You still own Google SecOps and partner licenses, telemetry, permissions, remediation and recovery

Microsoft analysts investigate Defender incidents and execute permitted containment in MDR Plan 1.

You still own Defender licensing, deployment, access, exclusions and out-of-scope remediation

Investigates connected alerts and can execute approved machine quarantine.

You still own Tool coverage, context, action rules and human incident decisions.

Investigates alerts and runs response actions under buyer-selected operating modes.

You still own Mode selection, context, integrations, escalations and recovery.

Systal monitors connected systems, investigates threats and performs contracted incident response.

You still own Scope, response permissions and out-of-contract recovery

Truesec Core investigates threats and executes agreed containment, with human analysts directing AI-assisted work.

You still own Access, incident contacts, response permissions and wider recovery

MAXI agents investigate alerts and 24/7 analysts perform approved containment. Coverage varies by MDR tier.

You still own Tool access, response authority, tier selection and out-of-scope recovery

MSP-delivered investigation and permitted containment using existing endpoint and identity tools.

You still own Tool operation, telemetry, approvals and recovery

Zscaler MDR, formerly Red Canary, investigates connected alerts and executes permitted endpoint, identity and network containment.

You still own Underlying security tools, response approvals and remediation outside the contracted scope

Almond CWATCH for Sentinel operates detection in the customer's Azure subscriptions and shares incident work with its IT team.

You still own Azure ownership, approvals and recovery beyond the agreed SOC/CERT scope

Atos maintains Microsoft Sentinel and investigates alerts through its optional MDR module.

You still own Control the Microsoft tenant and source access

Binary Defense co-manages SIEM and XDR configuration, detection rules and alert investigation.

You still own Tool licensing, telemetry quality, response authority and business remediation

BlueVoyant co-manages Microsoft security operations, investigates alerts and responds through agreed rules of engagement.

You still own Platform licensing, data-source coverage, response approvals and business remediation

BT operates Sentinel detections, implements requested content changes and investigates incidents while your team retains response.

You still own Content decisions, Microsoft prerequisites, log sources, containment and recovery

Cipher analysts investigate around the clock and share detection-rule work and case visibility over existing tools.

You still own Tool administration, business context, permissions and remediation

Claranet operates Sentinel detections, investigates incidents and tunes the service with your team.

You still own Source systems, tuning decisions and remaining response

CyberCX operates Microsoft detections, hunts threats and maintains the managed Sentinel and Defender environment.

You still own Platform and data control, permissions and recovery outside scope

Cyderes supports shared investigation and response workflows over existing tools. SIEM and EDR management are optional.

You still own Response rules, platform access and out-of-scope remediation

Deepwatch co-manages monitoring, investigations, detection tuning and approved response workflows across your existing SIEM and security tools.

You still own Connected telemetry, response permissions, IT remediation and recovery

DEFEND investigates alerts and operates Microsoft Sentinel through a shared security operations workflow.

You still own Connected systems, response permissions and approved major incident costs

FourNet's co-managed SOC investigates alerts, maintains detections and carries out response steps agreed in runbooks.

You still own Selected containment actions, Estate changes and decisions

Fujitsu operates customer-tenant Sentinel, investigates alerts and coordinates the handoff to resolver teams.

You still own Azure ownership and remediation beyond the agreed handoff

IBM analysts and ATOM share detection, investigation and response workflows across your existing tools.

You still own Detection approvals, action permissions, tool access and out-of-scope recovery

KPMG's US MDR combines analyst incident work with ongoing SIEM, EDR and SOAR engineering.

You still own Tenant control, priorities, response permissions and out-of-scope recovery

24/7 investigations and hunts with shared FusionDetect rules, queries and approved critical-incident response.

You still own Detection choices, source access, response authority and recovery

Lumifi co-manages detections, investigations and response workflows through ShieldVision and supported security tools.

You still own Source access, response authority, internal decisions and recovery outside scope

Novacoast operates the buyer's SIEM, maintains detections and investigates alerts before escalation.

You still own Tenant and source systems, Agreed response duties, An available support contact

Ontinue co-manages Sentinel and Defender, investigating alerts and executing approved containment through Microsoft controls.

You still own Microsoft licensing, log sources, response rules and IT remediation

Optiv manages Google Security Operations health, log configuration and detection rules, then investigates alerts and recommends mitigation.

You still own Source systems and access, Containment and recovery

Performanta shares SIEM monitoring, investigation, detection engineering and incident workflows with your security team.

You still own Internal decisions, access, environment changes and the agreed response split

Quorum operates Sentinel health, detections and incidents through containment across scoped Microsoft and third-party sources.

You still own Microsoft licensing, source access, action permissions and recovery

Redcentric shares Sentinel operations, detection maintenance and MXDR incident coordination under an agreed action matrix.

You still own Source systems, endpoint administration, response authority and wider recovery

GreyMatter combines automated investigations, response playbooks and ReliaQuest operating support across connected security tools.

You still own Tool licenses, source access, action permissions, escalation decisions and recovery

Secon.SOC shares monitoring, investigation, detection improvement and playbook-led response coordination.

You still own Internal security ownership, decisions and assigned remediation

Verizon investigates SIEM incidents and implements agreed detection-content changes. Your team owns platform hosting, source health and containment.

You still own SIEM hosting, source health, change approval, containment and recovery

ANS runs Microsoft security tooling, detections, incident investigations and response coordination.

You still own Access, source configuration, incident decisions and assigned remediation

Littlefish runs Sentinel operations, detection maintenance, investigations and authorised incident handling.

You still own Licenses, permissions, business decisions and wider IT remediation