SOC providers for SOC 2 requirements

Review the provider’s report scope separately from the evidence it supplies for your organization’s own examination.

Arctic Wolf Aurora MDR

Arctic Wolf's Aurora MDR investigates alerts and contains threats through configured integrations, supported by a named Concierge Security Team.

You still own Connected tools, response permissions and remediation outside configured containment

What they do Contain threats MDR
Price $44,000/year · up to 100 users

Blackpoint Cyber

Blackpoint's CompassOne MDR investigates endpoint and cloud threats, isolating devices or disabling accounts within agreed response authority.

You still own Deployment, response policies, remediation, recovery and MSP client communication

What they do Contain threats MDR

Dell analysts investigate supported XDR alerts and take pre-approved containment actions such as host isolation and file blocking.

You still own Endpoint coverage, platform access and remediation beyond the contracted response scope

What they do Contain threats MDR

eSentire

eSentire MDR investigates and contains threats through supported tools under agreed response rules.

You still own EDR licensing, tool access, response permissions and recovery outside agreed incident support

What they do Contain threats MDR
Price $17/user/mo + $2,500/year

Field Effect MDR

Field Effect supplies an MDR platform and SOC that investigate threats and contain them under buyer-selected response policies.

You still own Agent deployment, response policies, recovery and incident response beyond MDR scope

What they do Contain threats MDR
Price $5–$25/user/mo range

Huntress Managed Security

Huntress analysts investigate endpoint, identity and SIEM alerts, then perform supported containment within enabled modules and permissions.

You still own Deployment, permissions, manual remediation, recovery and client communication

What they do Contain threats MDR
Price EDR: $7.99 USD/endpoint/month

Binary Defense Co-Management

Binary Defense co-manages SIEM and XDR configuration, detection rules and alert investigation.

You still own Tool licensing, telemetry quality, response authority and business remediation

What they do Co-manage the SOC Co-managed SOC

Bridewell's fully outsourced SOC runs daily monitoring, investigation and detection tuning, then leads response within agreed playbooks.

You still own Telemetry, tenant permissions, response approvals, business remediation and recovery

What they do Run the SOC SOCaaS
Price G-Cloud: from £5.25/user/mo + £3.04/server/mo
About this list

Request the relevant SOC 2 report and review its covered system, period and exceptions. Match that scope to the platform and managed service you intend to use.

Then agree what the provider delivers for your own control activities: monitoring records, investigation histories, access evidence or service reports. Confirm the format, retention and audit-support process before onboarding.

Questions

Is a provider’s SOC 2 report enough to evaluate the service?
It is one input. Review the actual service scope, report exceptions and responsibilities assigned to your organization alongside operational testing.
Does buying the service complete our own SOC 2 work?
No. Your organization retains its own controls and examination scope. Agree which provider records your team and auditor need and how they can obtain them.