Compare providers
Choose at least two providers to compare.
Choose providersScroll across to compare
More details
Investigates connected alerts and executes permitted containment through existing tools.
Contain threats
Coverage, approvals, complex escalations and recovery.
$20 USD/processed alert
Works with your tools
Endpoints, Cloud Workloads, Identity & Access, Email, Network, Data & DLP
Enterprise, MSP/MSSP
Which specific actions can execute automatically and who checks failed or partial actions?
Acronis TRU Advanced MDR executes permitted incident response through Cyber Protect Cloud.
Contain threats
Deployment, critical-device approvals and recovery authorization
Brings its own platform
Endpoints
MSP/MSSP, SMB, Mid-Market
Is this quote for Advanced delivered by Acronis TRU, and which workload and platform licenses are included?
Adlumin MDR by N-able investigates and contains threats through a shared XDR and SIEM platform. Your team maintains controls and handles work outside the package.
Co-manage the SOC
Connected tools, response permissions, escalation rules and work outside the package
Brings its own platform
Endpoints, Cloud Workloads, Identity & Access, Email, Network, SaaS Applications
SMB, Mid-Market, MSP/MSSP
HIPAA, PCI-DSS, NIST
Which Standard or Advanced tier includes our sources, non-API collectors, retention and required response actions?
Advania UK manages Sentinel operations and investigations while sharing incident escalation and response responsibilities.
Co-manage the SOC
Incident participation, response decisions and work outside the service scope
Your tools or its own platform
Endpoints, Network, Cloud Workloads
SMB, Mid-Market, Enterprise, Government
Which SIEM, agent and detection-maintenance tasks are included, and who owns the tenant and content when we leave?
Advens mySOC for IT combines SIEM and network analysis with detection engineering and shared incident playbooks.
Co-manage the SOC
Monitoring priorities, approvals and work outside agreed playbooks
Your tools or its own platform
Network
Mid-Market, Enterprise
Which firewall, proxy and directory actions will mySOC for IT execute, and which need our approval?
Almond CWATCH for Sentinel operates detection in the customer's Azure subscriptions and shares incident work with its IT team.
Co-manage the SOC
Azure ownership, approvals and recovery beyond the agreed SOC/CERT scope
Works with your tools
Cloud Workloads
SMB, Mid-Market, Enterprise
Which incident actions can CWATCH execute automatically, and when must an analyst or our team approve them?
Alert Logic's MDR analysts investigate cloud and hybrid alerts, then escalate verified incidents with evidence and recommended actions.
Investigate and advise
Containment, remediation, connected tools and approval of response workflows
Brings its own platform
Endpoints, Cloud Workloads, Identity & Access, Network, SaaS Applications, Containers & Kubernetes, Code & Applications
SMB, Mid-Market, Enterprise, MSP/MSSP
PCI-DSS
Which assets are covered by Essentials, Professional or Enterprise, and which are unprotected or add-on only?
ANS runs Microsoft security tooling, detections, incident investigations and response coordination.
Run the SOC
Access, source configuration, incident decisions and assigned remediation
Works with your tools
Endpoints, Identity & Access, Cloud Workloads
Mid-Market, Enterprise, Government
Which tools and response actions are in scope, and when can ANS contain a threat before our approval?
Arctic Wolf's Aurora MDR investigates alerts and contains threats through configured integrations, supported by a named Concierge Security Team.
Contain threats
Connected tools, response permissions and remediation outside configured containment
$44,000/year · up to 100 users
Brings its own platform
Endpoints, Cloud Workloads, Identity & Access, Email, Network, SaaS Applications
SMB, Mid-Market, Enterprise, MSP/MSSP
Named or dedicated team
SOC 2, ISO 27001
Which bundle and Concierge tier are in the quote, and what changes between Core, Plus and Total?
Armis Managed Threat Services investigates Centrix findings, hunts for threats and tunes detection policies.
Investigate and advise
Containment, remediation, connected controls and the broader SOC workflow
Brings its own platform
Network, OT/ICS, IoT
Mid-Market, Enterprise, Government
Which findings do analysts investigate and what review cadence applies to our MTS package?
Atos maintains Microsoft Sentinel and investigates alerts through its optional MDR module.
Co-manage the SOC
Control the Microsoft tenant and source access
Works with your tools
Cloud Workloads
Mid-Market, Enterprise
Does our Sentinel order include the MDR module, and which incidents and connector failures does Atos own?
Barracuda Managed XDR investigates alerts and automates containment through purchased modules and supported endpoint, email, identity and firewall integrations.
Contain threats
Connected tools, response permissions and remediation outside automated actions
Brings its own platform
Endpoints, Cloud Workloads, Identity & Access, Email, Network, SaaS Applications
SMB, Mid-Market, MSP/MSSP
Which modules, assets and quantities are included, and which endpoint components are Managed versus Monitor Only?
Binary Defense co-manages SIEM and XDR configuration, detection rules and alert investigation.
Co-manage the SOC
Tool licensing, telemetry quality, response authority and business remediation
Works with your tools
Mid-Market, Enterprise
SOC 2
Which parts of our SIEM or XDR stack will Binary Defense implement, tune and operate day to day?
Bitdefender MDR analysts investigate GravityZone alerts and take pre-approved containment actions within your licensed endpoint and XDR coverage.
Contain threats
Response policy, recovery and systems outside licensed GravityZone coverage
Brings its own platform
Endpoints, Cloud Workloads, Identity & Access, Email, Network, SaaS Applications
SMB, Mid-Market, Enterprise, MSP/MSSP
Which response actions are enabled by default? Which can be disabled or require explicit approval?
Blackpoint's CompassOne MDR investigates endpoint and cloud threats, isolating devices or disabling accounts within agreed response authority.
Contain threats
Deployment, response policies, remediation, recovery and MSP client communication
Brings its own platform
Endpoints, Identity & Access, SaaS Applications, Email
MSP/MSSP, SMB, Mid-Market
SOC 2, HIPAA, GDPR
Which containment actions can Blackpoint run automatically for our tenants or environment?
BlueVoyant co-manages Microsoft security operations, investigates alerts and responds through agreed rules of engagement.
Co-manage the SOC
Platform licensing, data-source coverage, response approvals and business remediation
Works with your tools
Endpoints, Cloud Workloads, Identity & Access
Mid-Market, Enterprise, Government
Which actions can BlueVoyant take immediately under our rules of engagement, and which actions wait for approval?
BT operates Sentinel detections, implements requested content changes and investigates incidents while your team retains response.
Co-manage the SOC
Content decisions, Microsoft prerequisites, log sources, containment and recovery
Works with your tools
Enterprise, Mid-Market
Which tier and response actions are in the order?
Bridewell's fully outsourced SOC runs daily monitoring, investigation and detection tuning, then leads response within agreed playbooks.
Run the SOC
Telemetry, tenant permissions, response approvals, business remediation and recovery
G-Cloud: from £5.25/user/mo + £3.04/server/mo
Your tools or its own platform
Endpoints, Cloud Workloads, Network, OT/ICS
Mid-Market, Enterprise, Government
SOC 2, ISO 27001
Which daily SOC tasks and containment actions are included, and which require our approval?
CGI Protective Monitoring correlates logs, validates suspicious events and sends incident tickets with containment or eradication advice.
Investigate and advise
Containment and recovery, Incident-response staffing
Brings its own platform
Mid-Market, Enterprise
Which monitoring and alerting hours apply to our selected tier?
Blumira Managed pairs its Automate platform with 24/7 analyst review of high and critical cases and approved containment in Microsoft identity and Blumira-covered endpoints.
Contain threats
Source and agent coverage, low and medium cases, approvals, remediation and recovery
Brings its own platform
Endpoints, Cloud Workloads, Identity & Access, Email, Network, SaaS Applications
SMB, Mid-Market, MSP/MSSP
What is the combined Automate and Managed price for our covered users, and what is the contract term?
Check Point MDR 360° investigation and configured containment across agreed security integrations.
Contain threats
Tool access, response approvals and work outside the agreement
Works with your tools
Endpoints, Network, Email
Mid-Market, Enterprise
Which of our tools will MDR 360° monitor, and which containment actions can it execute without our approval?
Cipher analysts investigate around the clock and share detection-rule work and case visibility over existing tools.
Co-manage the SOC
Tool administration, business context, permissions and remediation
Works with your tools
Endpoints, Network
Mid-Market, Enterprise
Which log sources, detection rules and response actions are included in our service tier?
Clearnetwork manages AlienVault USM, investigates detected threats and emails response guidance.
Co-manage the SOC
Containment and recovery, Reseller handoffs if applicable
Your tools or its own platform
Mid-Market, Enterprise
Who acts on a high-severity incident when our team is unavailable?
Investigates alerts through read-only queries and hands analysts a documented verdict.
Investigate and advise
Access, escalation review, containment and recovery.
Works with your tools
Endpoints, Cloud Workloads, Identity & Access, Email, SaaS Applications
Mid-Market, Enterprise
Which source APIs and retention periods limit the investigation you can demonstrate on our data?
Cisco analysts investigate supported XDR components and execute containment allowed by the response playbook.
Contain threats
Component health, response authority, remediation and recovery
Brings its own platform
Endpoints, Identity & Access, Network
Enterprise, Mid-Market
Which components and response actions are covered, and which need approval for every incident?
24/7 analysts investigate endpoint alerts and perform permitted isolation through supported EDR tools.
Contain threats
Agent health, isolation exceptions, client coordination and recovery
Your tools or its own platform
Endpoints
MSP/MSSP
Which EDR licenses, device counts and minimum commitments are included in the quote?
Investigates alerts and triggers configured SOAR containment after checking evidence.
Contain threats
Hosting, model access, response permissions, action checks and recovery.
Works with your tools
Endpoints, Cloud Workloads, Identity & Access, Network
Enterprise, Government
Which permissions, model calls and infrastructure resources are needed for continuous operation?
Critical Start MDR investigates alerts from your security tools and can contain threats under agreed rules of engagement.
Contain threats
Tool licensing, telemetry coverage, response approvals, remediation and recovery
Works with your tools
Endpoints, Cloud Workloads, Identity & Access, Email, Network
Mid-Market, Enterprise, Government
Which response actions can the SOC take directly in our tools, and which require our approval?
Claranet operates Sentinel detections, investigates incidents and tunes the service with your team.
Co-manage the SOC
Source systems, tuning decisions and remaining response
Works with your tools
Endpoints, Network, Identity & Access, Cloud Workloads
Mid-Market, Enterprise
Which actions may the SOC take on live systems, and which containment or recovery steps stay with us?
Falcon Complete analysts investigate, contain and remediate threats through CrowdStrike's Falcon platform under pre-approved playbooks.
Contain threats
Falcon deployment, response approvals, business exceptions and out-of-scope coverage
Brings its own platform
Endpoints, Cloud Workloads, Identity & Access
Enterprise, Mid-Market
Which Falcon modules and Managed NG-SIEM scope are required for endpoint, cloud, identity and third-party telemetry?
CyberCX operates Microsoft detections, hunts threats and maintains the managed Sentinel and Defender environment.
Co-manage the SOC
Platform and data control, permissions and recovery outside scope
Works with your tools
Endpoints, Cloud Workloads
Mid-Market, Enterprise
Which Sentinel and Defender sources, detections and response playbooks will CyberCX operate, and which actions require our approval?
Cybereason MDR Complete investigates endpoint threats and performs specified remediation. Host isolation requires written approval.
Contain threats
Endpoint deployment, isolation approval and wider incident response or recovery
Brings its own platform
Endpoints
Mid-Market, Enterprise
Does the quote retain the Cybereason MDR Complete contract, and who owns delivery, support, renewal and any platform migration?
CyberProof analysts share incident handling, detection tuning and response workflows through CDC Reveal360.
Co-manage the SOC
Action permissions, agreed tool duties and out-of-scope remediation
Your tools or its own platform
Endpoints, Cloud Workloads, Network, SaaS Applications
Mid-Market, Enterprise
Which actions can run without approval, and which require our team?
Cyderes supports shared investigation and response workflows over existing tools. SIEM and EDR management are optional.
Co-manage the SOC
Response rules, platform access and out-of-scope remediation
Works with your tools
Endpoints, Cloud Workloads, Identity & Access, Network
Mid-Market, Enterprise
Which tools will you monitor, administer and execute response actions through, and which only supply context?
24/7 investigation and mitigation guidance using CYREBRO's SOC platform and connected security tools.
Investigate and advise
Integrations, system access, remediation and recovery
Your tools or its own platform
Endpoints, Network
MSP/MSSP, SMB, Mid-Market, Enterprise
Which actions will CYREBRO execute for each connected tool, what approval is required and how many IR hours are included?
Investigates alerts and executes containment through risk-based approval gates.
Contain threats
Autonomy settings, permissions, approvals, incident decisions and recovery.
Works with your tools
Endpoints, Cloud Workloads, Identity & Access, Email, Network
Enterprise, MSP/MSSP
Which host and account actions require explicit approval, and where does a timeout escalate?
Darktrace investigates Enhanced Monitoring alerts and applies supported containment actions within its platform.
Contain threats
Deployment health, response rules, follow-up analysis and remediation
Brings its own platform
Network, Identity & Access, OT/ICS, Endpoints
Mid-Market, Enterprise
Which modules and Enhanced Monitoring models does our order cover, including cloud, identity, OT and endpoints?
Bits Security Analyst queries security data and investigates eligible Cloud SIEM alerts automatically, then supplies findings and suggested next steps.
Investigate and advise
Reviewing findings, handling uncovered alerts, containment and recovery
Brings its own platform
Cloud Workloads, Identity & Access, SaaS Applications
Mid-Market, Enterprise
Which of our rules and log sources are eligible for automatic investigation?
Deepwatch co-manages monitoring, investigations, detection tuning and approved response workflows across your existing SIEM and security tools.
Co-manage the SOC
Connected telemetry, response permissions, IT remediation and recovery
$245,198 / 12 months · 50 GB/day
Works with your tools
Endpoints, Cloud Workloads, Identity & Access, Network
Mid-Market, Enterprise
Which detections and response actions will be enabled in our Response Intent Matrix?
24/7 analysts investigate and contain incidents across the assets covered by your MaxxMDR tier.
Contain threats
Tool access, response permissions and business recovery
Works with your tools
Endpoints, Email, Identity & Access, Cloud Workloads, Network
Mid-Market, MSP/MSSP
Which actions can your SOC execute without approval in our connected tools?
DEFEND investigates alerts and operates Microsoft Sentinel through a shared security operations workflow.
Co-manage the SOC
Connected systems, response permissions and approved major incident costs
Works with your tools
Cloud Workloads, SaaS Applications
Enterprise, Government
Which Sentinel and Defender sources, response playbooks and permissions are included in our Enterprise service schedule?
Investigates alerts and executes permitted containment through connected tools.
Contain threats
Detection tools, response permissions, uncertain cases and recovery.
Works with your tools
Endpoints, Cloud Workloads, Identity & Access, Email, Network, Data & DLP
Enterprise, Mid-Market, MSP/MSSP
Which actions will run automatically, which need approval and how can each be reversed?
Dell analysts investigate supported XDR alerts and take pre-approved containment actions such as host isolation and file blocking.
Contain threats
Endpoint coverage, platform access and remediation beyond the contracted response scope
Your tools or its own platform
Endpoints, Network, Cloud Workloads
Mid-Market, Enterprise
SOC 2
Which endpoint or XDR variant and modules are quoted, and which platform licences must we buy separately?
e2e-assure runs contracted SOC monitoring, investigations, hunting and detection improvement through Cumulo.
Run the SOC
Access, configuration changes and wider incident remediation
Your tools or its own platform
Mid-Market, Enterprise, Government
Which service components and recurring SOC tasks are included, and is our contract fully managed or jointly operated?
Deloitte investigates and responds through selected enterprise MXDR modules and partner technologies.
Contain threats
Module selection, action permissions and out-of-scope recovery
$806,000/year · US example, 2,000 endpoints
Your tools or its own platform
Endpoints, Cloud Workloads, Identity & Access, Network, OT/ICS
Enterprise
Which containment and remediation actions will Deloitte execute, and under which permissions?
eSentire MDR investigates and contains threats through supported tools under agreed response rules.
Contain threats
EDR licensing, tool access, response permissions and recovery outside agreed incident support
$17/user/mo + $2,500/year
Your tools or its own platform
Endpoints, Cloud Workloads, Identity & Access, Email, Network, SaaS Applications
SMB, Mid-Market, Enterprise
PCI-DSS, SOC 2, ISO 27001
Which containment actions can each selected integration execute, and which need approval or Enhanced response orchestration?
24/7 ESET endpoint investigation and containment, with configurable restrictions for critical devices.
Contain threats
Software deployment, critical-device permissions and recovery
Brings its own platform
Endpoints
SMB, Mid-Market, MSP/MSSP
Which critical devices should permit isolation or process termination, and who handles suppressed actions?
Exabots triage connected data and execute configured containment workflows.
Contain threats
Source permissions, response controls, difficult incidents and recovery.
Your tools or its own platform
Endpoints, Cloud Workloads, Identity & Access, Email, SaaS Applications, Code & Applications
Mid-Market, Enterprise
Which actions can run without approval, and what happens when approval times out?
Expel investigates alerts in existing tools and executes enabled containment after analyst review.
Contain threats
Tool licenses, action permissions, exceptions and recovery
Cloud package: $88,800 / 12 months for 500 resources
Works with your tools
Endpoints, Cloud Workloads, Identity & Access, Email, Network, SaaS Applications, Containers & Kubernetes
Mid-Market, Enterprise
Which package covers each attack surface, integration and Workbench API requirement, and which services are separate?
Field Effect supplies an MDR platform and SOC that investigate threats and contain them under buyer-selected response policies.
Contain threats
Agent deployment, response policies, recovery and incident response beyond MDR scope
$5–$25/user/mo range
Brings its own platform
Endpoints, Cloud Workloads, Identity & Access, Email, Network, SaaS Applications
SMB, MSP/MSSP, Mid-Market
SOC 2, ISO 27001
Which package covers our endpoint, network, Microsoft 365, Google Workspace and other cloud-app telemetry?
Forescout Assist investigates eyeAlert detections and escalates confirmed incidents with response guidance.
Investigate and advise
Platform and source health, containment, remediation and recovery
$34,359.99 / 1,000 endpoints / year
Brings its own platform
Network, Endpoints
Enterprise, Mid-Market, Government
Which eyeAlert entitlements, sensors and monitored quantities does this Assist quote require?
Standard MDR investigates FortiEDR alerts and contains endpoint threats under agreed playbooks.
Contain threats
Agent deployment, action permissions and recovery beyond contracted response
Brings its own platform
Endpoints
Mid-Market, Enterprise
Does the quote include Standard MDR, the required FortiEDR licenses and Best Practice Service onboarding for every endpoint?
FourNet's co-managed SOC investigates alerts, maintains detections and carries out response steps agreed in runbooks.
Co-manage the SOC
Selected containment actions, Estate changes and decisions
Works with your tools
Mid-Market, Enterprise
Which actions does FourNet execute without asking, and which stay with us?
Fujitsu operates customer-tenant Sentinel, investigates alerts and coordinates the handoff to resolver teams.
Co-manage the SOC
Azure ownership and remediation beyond the agreed handoff
Works with your tools
Enterprise
Which resolver team takes each incident, and which containment actions may Fujitsu execute without approval?
24/7 analysts validate incidents and advise your team. Optional active response needs advance action permissions.
Investigate and advise
Passive response execution, tool access and system recovery
$44,000/year · Passive, up to 100 endpoints
Works with your tools
Endpoints, Network, Cloud Workloads, Identity & Access, SaaS Applications
Mid-Market
Which actions remain passive and which can Gradient execute through our endpoint, identity and firewall tools?
Heimdal SOC investigation and containment with response permissions set by module.
Contain threats
Module choices, notification-only response and broader recovery
Brings its own platform
Endpoints
SMB, Mid-Market, Enterprise, MSP/MSSP
Which modules and server licenses are included, and what response work does each cover?
Huntress analysts investigate endpoint, identity and SIEM alerts, then perform supported containment within enabled modules and permissions.
Contain threats
Deployment, permissions, manual remediation, recovery and client communication
EDR: $7.99 USD/endpoint/month
Brings its own platform
Endpoints, Identity & Access, Email, Network, SaaS Applications, Cloud Workloads
SMB, MSP/MSSP, Mid-Market
SOC 2
Which modules are included in the quote: EDR, ITDR, SIEM, SAT, and any posture features?
IBM analysts and ATOM share detection, investigation and response workflows across your existing tools.
Co-manage the SOC
Detection approvals, action permissions, tool access and out-of-scope recovery
Works with your tools
Endpoints, Cloud Workloads, Network, OT/ICS
Enterprise, Mid-Market
Which ATOM actions run automatically? Which need an analyst or our approval and who can stop or reverse them?
Smart MDR uses operational AI agents to investigate alerts and execute configured containment actions.
Contain threats
Automation permissions, human escalation and work beyond containment
Enterprise
Which actions are autonomous, which require a human analyst or our approval, and how can we suspend or reverse them?
LiveSOC investigates alerts and executes containment through connected tools, with deeper CSIRT duties defined by the engagement.
Contain threats
Action permissions, incident decisions and recovery outside the contract
Enterprise, Government
Which response actions will LiveSOC execute, with what approval, and which remain with our team?
Aegis MDR investigates threats and performs preagreed containment across customer-selected security tools.
Contain threats
Technology ownership, response permissions and wider recovery
Works with your tools
Endpoints, Cloud Workloads, Network
Mid-Market, Enterprise
Which of our existing tools support action by the SOC, and which isolation, file-blocking or identity actions will be preapproved?
ITrust operates Reveelium detection and shares incident investigation and resolution with the customer's IT team.
Co-manage the SOC
System context, assigned response actions and recovery beyond scope
Brings its own platform
Network
SMB, Mid-Market, Enterprise, Government
Which actions will ITrust execute, which require approval and which will our IT provider perform?
Investigates multi-source alerts using forensic evidence and runs configured response actions.
Contain threats
Detection tools, response policies, contested verdicts and recovery.
Works with your tools
Endpoints, Cloud Workloads, Identity & Access, Email, Network
Enterprise, MSP/MSSP
Which actions can run through your connectors and which require an analyst approval?
Kaseya MDR investigates endpoint, Microsoft 365 and firewall activity and performs configured containment and remediation.
Contain threats
Onboarding, coverage, permissions, response rules and recovery
Brings its own platform
Endpoints, Identity & Access, Email, Network, SaaS Applications
MSP/MSSP, SMB, Mid-Market
Which action permissions, Respond rules and detection-specific automations will be enabled?
CrowdStrike-backed MDR with Kroll response operations, incident investigation and scoped remediation.
Contain threats
Deployment access, approvals and business recovery outside scope
Brings its own platform
Endpoints, Identity & Access, Cloud Workloads
Mid-Market, Enterprise
Which actions are performed by Kroll, CrowdStrike and our team, and what requires approval?
KPMG's US MDR combines analyst incident work with ongoing SIEM, EDR and SOAR engineering.
Co-manage the SOC
Tenant control, priorities, response permissions and out-of-scope recovery
Works with your tools
Endpoints, Cloud Workloads
Enterprise, Mid-Market
Which SIEM, EDR and SOAR duties will KPMG operate each day, and what remains with us?
24/7 investigations and hunts with shared FusionDetect rules, queries and approved critical-incident response.
Co-manage the SOC
Detection choices, source access, response authority and recovery
Works with your tools
Endpoints, Cloud Workloads, Identity & Access, Email, Network, SaaS Applications
Enterprise, Mid-Market
Which sources will you investigate, and which actions can you execute under our preapproved procedures?
Littlefish runs Sentinel operations, detection maintenance, investigations and authorised incident handling.
Run the SOC
Licenses, permissions, business decisions and wider IT remediation
Works with your tools
Endpoints, Network, Cloud Workloads
Mid-Market, Enterprise, Government
Which daily SIEM, detection and incident tasks are included in the fully managed model, and which service components cost extra?
LRQA's managed-SIEM SOC service operates detections and investigates incidents in the agreed logging environment.
Co-manage the SOC
Estate changes, Response authority and recovery
£43,065/year + setup
Mid-Market, Enterprise
Which actions can LRQA execute, and which require our response team?
Lumen operates the contracted Sentinel SOC, incident queue and SIEM health. Full and shared arrangements differ.
Run the SOC
Source access, response approvals and out-of-scope recovery
Your tools or its own platform
Endpoints, Cloud Workloads, Network
Enterprise
Does the order assign the daily SOC to Lumen or only shared shift coverage, and which containment actions can it execute?
Eligible Lumu Defender accounts can enable Autopilot to manage incidents alongside configured blocking. Your team sets policies and handles escalated investigations and recovery.
Contain threats
Activation, response permissions, connected controls, complex investigations and recovery
Brings its own platform
Network, Endpoints
SMB, Mid-Market, Enterprise, MSP/MSSP
Does our Defender subscription include Autopilot eligibility, and what costs or activation steps apply?
Mandiant investigates Google SecOps alerts and can contain affected hosts through supported tools under agreed response authority.
Contain threats
Google SecOps and partner licenses, telemetry, permissions, remediation and recovery
Works with your tools
Endpoints, Identity & Access, Network
Enterprise
Which supported technologies are required for Mandiant to contain hosts or collect files in our environment?
Microsoft analysts investigate Defender incidents and execute permitted containment in MDR Plan 1.
Contain threats
Defender licensing, deployment, access, exclusions and out-of-scope remediation
Works with your tools
Endpoints, Identity & Access, Email, SaaS Applications
Mid-Market, Enterprise
HIPAA, ISO 27001, HITRUST
Which active products and covered assets are included in Plan 1?
Microsoft hunters investigate emerging threats in eligible Defender telemetry and give your SOC remediation guidance.
Investigate and advise
Incident response, containment, recovery and excluded telemetry
Brings its own platform
Endpoints, Cloud Workloads, Identity & Access, Email, SaaS Applications
Mid-Market, Enterprise
Which tenant population and server licensing route are included in our quote?
mnemonic investigates threats through Argus and provides containment through contracted response modules.
Contain threats
Deploy agents and connect agreed sources
Brings its own platform
Endpoints, Network, Cloud Workloads
Mid-Market, Enterprise
Which endpoint, cloud and network modules are included, and which actions can analysts take without another approval?
Shared SOC workflows through the Unified Cyber Platform, with 24/7 investigation and scoped response.
Co-manage the SOC
Source access, shared SOC decisions, action permissions and recovery
G-Cloud: from £1,500/mo ex VAT
Your tools or its own platform
Endpoints, Network, Cloud Workloads, Identity & Access
Mid-Market, Enterprise, Government
Which Microsoft, Splunk, endpoint and network modules are included, and who owns daily detections, cases and service reviews?
Guardian xMDR Core combines Cortex monitoring with human investigation and containment playbooks from a Dutch SOC.
Contain threats
Response permissions, source connections and recovery beyond scope
Brings its own platform
Endpoints, Cloud Workloads, SaaS Applications, Network
Mid-Market, Enterprise
Which containment playbooks are included in Core, and which actions require our approval before the SOC runs them?
Novacoast operates the buyer's SIEM, maintains detections and investigates alerts before escalation.
Co-manage the SOC
Tenant and source systems, Agreed response duties, An available support contact
Works with your tools
Mid-Market, Enterprise
Which team executes containment after an escalation?
Lumifi co-manages detections, investigations and response workflows through ShieldVision and supported security tools.
Co-manage the SOC
Source access, response authority, internal decisions and recovery outside scope
Works with your tools
Endpoints, Network
Mid-Market, Enterprise, MSP/MSSP
Which tools, licenses, log volumes and retention are included in the quote?
National Telecom Thailand's Cyber Security Monitoring service analyzes suspicious events and provides prioritized warnings and advice.
Investigate and advise
Containment and remediation, An available incident contact
Mid-Market, Enterprise
Who acts on a critical warning outside our business hours?
NTT analysts investigate SamurAI alerts and isolate validated endpoint threats through supported EDR.
Contain threats
Source setup, action permissions, remediation and risk closure
Your tools or its own platform
Endpoints, Cloud Workloads, Identity & Access, Network
Mid-Market, Enterprise
Which EDR actions are enabled, and what authorization governs isolation?
NVISO investigates Microsoft alerts and routes actionable incidents to the buyer’s IT team.
Investigate and advise
Execute containment unless separately assigned
Works with your tools
Endpoints, Cloud Workloads, Identity & Access, Email
Mid-Market, Enterprise
Which Microsoft products and licenses are required for our coverage, and who manages the connectors and platform day to day?
NuSummit's NSE Market-SOC monitors security events and manages incidents with remediation guidance for SEBI-regulated entities.
Investigate and advise
Remediation execution, Regulatory decisions
Mid-Market, Enterprise
Who executes containment, and what happens if our contact is unavailable?
Ontinue co-manages Sentinel and Defender, investigating alerts and executing approved containment through Microsoft controls.
Co-manage the SOC
Microsoft licensing, log sources, response rules and IT remediation
Works with your tools
Endpoints, Cloud Workloads, Identity & Access, Email, Network, SaaS Applications
Mid-Market, Enterprise, Government
How are Ontinue Units calculated, and what Microsoft licenses and consumption charges are separate?
Orange's MDR/XDR analysts investigate threats and take agreed containment actions across supported security tools.
Contain threats
Telemetry sources, response approvals and remediation beyond agreed playbooks
€3,300/mo · 300 users
Your tools or its own platform
Endpoints, Network, Cloud Workloads, Identity & Access
Mid-Market, Enterprise
Which endpoint, network and log packages include response and hunting, and which cost extra?
Investigates covered Cortex incidents and executes scoped endpoint containment around the clock.
Contain threats
Platform upkeep, action permissions, incident declaration and wider recovery
Brings its own platform
Endpoints
Mid-Market, Enterprise
Which endpoint or extended-data SKU covers our sources, and which cases created by custom rules are excluded?
Performanta shares SIEM monitoring, investigation, detection engineering and incident workflows with your security team.
Co-manage the SOC
Internal decisions, access, environment changes and the agreed response split
Works with your tools
Mid-Market, Enterprise
Which SIEM administration, use-case, rule and log-source tasks are included, and how are improvements prioritised with our team?
Optiv manages Google Security Operations health, log configuration and detection rules, then investigates alerts and recommends mitigation.
Co-manage the SOC
Source systems and access, Containment and recovery
Works with your tools
Mid-Market, Enterprise
Which containment actions, if any, does Optiv execute under this agreement?
plusserver operates hosted QRadar and investigates alerts, with incident handling shared through the customer's response process.
Co-manage the SOC
Interfaces, incident ownership and response outside the management level
Brings its own platform
Mid-Market, Enterprise
Which incident actions are included in our management level, and which require a separate request or fee?
Pondurance Managed SOC with Managed SIEM runs daily monitoring, investigation, hunting and containment within agreed scope.
Run the SOC
Response authority, asset context, IT remediation and recovery
Your tools or its own platform
Endpoints, Network, Identity & Access, Cloud Workloads, SaaS Applications, IoT
Mid-Market, SMB, Enterprise
Which containment actions can Pondurance execute without waiting for our team?
Precursor Fully Managed SOC runs daily monitoring, detection engineering and incident investigation, including agreed endpoint containment.
Run the SOC
Access and response permissions, Business decisions and recovery
From £900/month
Your tools or its own platform
Mid-Market, Enterprise
Which assets and response actions are included in our fixed monthly price?
Proficio co-manages hosted or customer SIEM workflows, investigates alerts and adds containment when Active Defense is included.
Co-manage the SOC
Connected tools, response approvals, change controls and post-containment remediation
Your tools or its own platform
Endpoints, Cloud Workloads, Identity & Access, Email, Network, SaaS Applications
Mid-Market, Enterprise, MSP/MSSP
Shared SOC
Does the order cover hosted ProSOC MDR, Sentinel, Splunk or another separately scoped service?
Investigates connected alerts and sends evidence-backed verdicts to your SOC.
Investigate and advise
Verdict validation, containment, remediation and source-tool operation.
Works with your tools
Endpoints, Cloud Workloads, Identity & Access, Email, Network
Enterprise, MSP/MSSP
Which exact sources can Qevlar query in your environment and what permissions are required?
Investigates connected alerts and can execute approved machine quarantine.
Contain threats
Tool coverage, context, action rules and human incident decisions.
$50,000 USD/year
Works with your tools
Endpoints, Cloud Workloads, Identity & Access, Email, Network, Data & DLP
Enterprise, Mid-Market
Which quarantine integrations and approval modes are included in your order?
Quorum operates Sentinel health, detections and incidents through containment across scoped Microsoft and third-party sources.
Co-manage the SOC
Microsoft licensing, source access, action permissions and recovery
Works with your tools
Endpoints, Cloud Workloads, Identity & Access
Mid-Market, Enterprise
Which third-party sources and response actions are included, and which actions need approval?
Rapid7 investigates through its SIEM and executes configured containment, with limited enabled remediation.
Contain threats
Agent and source coverage, permissions, excluded detections and recovery
$73,000 / 12 months · 300 assets
Brings its own platform
Endpoints, Cloud Workloads, Identity & Access, Email, Network, SaaS Applications
Enterprise, Mid-Market
Which rules and third-party products will the SOC monitor, and which stay with our analysts?
Zscaler MDR, formerly Red Canary, investigates connected alerts and executes permitted endpoint, identity and network containment.
Contain threats
Underlying security tools, response approvals and remediation outside the contracted scope
$120/endpoint/year · AWS Marketplace
Works with your tools
Endpoints, Cloud Workloads, Identity & Access, Email, Network, SaaS Applications
Mid-Market, Enterprise
ISO 27001
Which data sources are included in the quoted plan, and which are storage-only or context-only?
Redcentric shares Sentinel operations, detection maintenance and MXDR incident coordination under an agreed action matrix.
Co-manage the SOC
Source systems, endpoint administration, response authority and wider recovery
Works with your tools
Endpoints, Network, Cloud Workloads, Email, Identity & Access
Mid-Market, Enterprise, Government
Who operates the SOC under our contract, and which responsibilities sit with Redcentric, its delivery partner and our team?
GreyMatter combines automated investigations, response playbooks and ReliaQuest operating support across connected security tools.
Co-manage the SOC
Tool licenses, source access, action permissions, escalation decisions and recovery
$226,000 / 12 months · up to 2,000 EPS
Works with your tools
Endpoints, Identity & Access
Enterprise, Mid-Market
Which integration packages, detection tuning and provider-run hunts are included?
Secon.SOC shares monitoring, investigation, detection improvement and playbook-led response coordination.
Co-manage the SOC
Internal security ownership, decisions and assigned remediation
Works with your tools
Endpoints, Network, Cloud Workloads
Mid-Market, Enterprise, Government
Which recurring platform, detection and incident tasks will Secon own, and which remain with our team?
S-RM monitors managed EDR around the clock and provides automated threat response, with Polus attack-surface monitoring included.
Contain threats
Response permissions, coverage gaps, vulnerability fixes and recovery
Endpoints
Mid-Market, Enterprise
Which EDR tools, devices and response actions will our contract cover?
Sophos analysts investigate Taegis cases and execute approved containment actions.
Contain threats
Integration health, action permissions, custom rules and recovery
Your tools or its own platform
Endpoints, Cloud Workloads, Network
Enterprise, Mid-Market
Which Taegis actions can your analysts execute in our tools, and which assets must be excluded from pre-authorization?
Wayfinder MDR investigates Singularity alerts and executes approved containment or mitigation through SentinelOne's platform.
Contain threats
Singularity deployment, telemetry coverage, response authorization and business recovery
Brings its own platform
Endpoints, Cloud Workloads, Identity & Access
Mid-Market, Enterprise, Government
Which Singularity licenses and endpoint, cloud and identity sources are included in our Essentials or Elite quote?
SecurityHQ runs contracted SOC operations, investigating threats and coordinating containment through agreed playbooks and supported security controls.
Run the SOC
Source coverage, response approvals, internal remediation and recovery
£30,664.70 / year · 5 GB/day
Your tools or its own platform
Endpoints, Network, Cloud Workloads, Identity & Access, SaaS Applications
Mid-Market, Enterprise, Government
NIST
Which daily SOC tasks does SecurityHQ own versus notify or assign back to our team?
Investigates agreed-source alerts and provides response guidance. Executed containment needs separately scoped services.
Investigate and advise
Collectors, data quality, change approvals and direct remediation
Your tools or its own platform
Endpoints, Network
Mid-Market, Enterprise
Which response actions can SilverSky execute under our exact MEDR or Network Protect attachments, and which stay with us?
Investigates alerts and runs response actions under buyer-selected operating modes.
Contain threats
Mode selection, context, integrations, escalations and recovery.
$10,000 USD/year per 1,000 alerts
Works with your tools
Endpoints, Cloud Workloads, Identity & Access, Email, Network
Enterprise, MSP/MSSP
Which actions are permitted in each operating mode and how is a failed action detected or reversed?
24/7 analyst investigation and response guidance using SOCSoter network telemetry and SIEM.
Investigate and advise
Network feeds, remediation, infrastructure changes and recovery
Brings its own platform
Network
MSP/MSSP, SMB
Which sites and network segments will the sensor actually see, and who restores broken packet or log feeds?
Socura runs detection tools, rule engineering, investigations and authorised containment for its outsourced SOC model.
Run the SOC
Access, response permissions, business decisions and wider recovery
Your tools or its own platform
Endpoints, Network, Cloud Workloads
Mid-Market, Enterprise, Government
Which tools, log sources and detection rules will Socura operate throughout the contract, and which tasks stay with our IT team?
CrowdStrike-based endpoint investigation and initial containment delivered through SonicWall's SOC for MSPs.
Contain threats
Agent deployment, policy upkeep, escalated investigation and recovery
Brings its own platform
Endpoints
MSP/MSSP
Which critical threats trigger isolation without a new approval, and what exceptions and release procedure apply to our clients?
Sopra Steria SOC Core provides UK monitoring, investigation and ongoing SIEM work alongside the customer's incident team.
Co-manage the SOC
Asset context, incident ownership and response tasks outside the selected tier
Brings its own platform
Network, Cloud Workloads
Enterprise, Government
What changes between the two response tiers, and which containment actions will your analysts execute?
Systal monitors connected systems, investigates threats and performs contracted incident response.
Contain threats
Scope, response permissions and out-of-contract recovery
Works with your tools
Enterprise
Which containment and remediation actions will Systal execute, and which require our approval?
T-Systems investigates endpoint threats and executes host, process and file containment through its SOC.
Contain threats
Action permissions, business decisions and wider recovery
Brings its own platform
Endpoints
Mid-Market, Enterprise
Which endpoint tooling replaces or works alongside our current protection, and which devices are covered?
Sophos investigates alerts and contains threats through supported tools and your chosen response mode. MDR Plus adds incident response for eligible Sophos XDR endpoints.
Contain threats
Deployment, permissions, recovery and response beyond the contracted scope
Your tools or its own platform
Endpoints, Identity & Access, Email, Network
SMB, Mid-Market, Enterprise
Which current tier and endpoint deployment model does the quote cover?
Telefónica Tech operates the SIEM, maintains detections and investigates alerts before the agreed response handoff.
Co-manage the SOC
Monitoring priorities and response beyond the agreed procedures
Your tools or its own platform
Cloud Workloads
Mid-Market, Enterprise
Which platform, log sources, use cases and retention periods are included, and who approves detection changes?
Thales investigates alerts, tunes detections and administers the platforms assigned in a shared SOC service.
Co-manage the SOC
Shared SOC decisions, approvals and work beyond scope
Your tools or its own platform
Endpoints, Cloud Workloads
Mid-Market, Enterprise, Government
Which detection, platform administration and incident tasks will Thales own, and which stay with our team each day?
ThreatDown Elite endpoint investigation and containment through Nebula or OneView.
Contain threats
Agent deployment, response permissions and broader recovery
Brings its own platform
Endpoints
SMB, Mid-Market, MSP/MSSP
Which actions can analysts take without contacting us, and who handles an unreachable emergency contact?
Todyl analysts share SIEM investigations, tune detections and coordinate response with the MSP.
Co-manage the SOC
Tenant policy, access, client communication and recovery
Brings its own platform
Endpoints, Identity & Access, Network, SaaS Applications, Cloud Workloads
MSP/MSSP, SMB, Mid-Market
Which endpoint and identity actions can analysts or playbooks execute in each tenant, and which require approval?
Analysts investigate subscribed Trend sources and perform supported containment under your approval settings.
Contain threats
Product deployment, response permissions, endpoint exceptions and wider recovery
Brings its own platform
Endpoints, Cloud Workloads, Email, Network
Mid-Market, Enterprise
Which endpoint, workload, email and network MDR subscriptions and underlying XDR licenses are included?
Truesec Core investigates threats and executes agreed containment, with human analysts directing AI-assisted work.
Contain threats
Access, incident contacts, response permissions and wider recovery
Works with your tools
Endpoints, Network, Cloud Workloads
SMB, Mid-Market
Which endpoint, network and cloud tools are included in Core, and what changes are required before monitoring starts?
LevelBlue's Fusion-based MDR investigates alerts and contains endpoint threats under agreed response protocols.
Contain threats
Technology upkeep, approval rules, incident leadership and wider recovery
Your tools or its own platform
Endpoints
Mid-Market, Enterprise
Which endpoint technologies and non-EDR sources are managed for detection, and what event-volume caps or throttling apply?
MAXI agents investigate alerts and 24/7 analysts perform approved containment. Coverage varies by MDR tier.
Contain threats
Tool access, response authority, tier selection and out-of-scope recovery
From $11/device/month · annual contract
Works with your tools
Endpoints, Cloud Workloads, Identity & Access, Email, SaaS Applications
SMB, Mid-Market, Enterprise
Who approves host isolation and account actions, who executes them, and what does the response SLA measure?
VectorUSA's Tier 1 Foundational SOC monitors alerts and performs initial triage.
Investigate and advise
Deeper investigation, Containment and recovery
Mid-Market, Enterprise
Does our Tier 1 contract include staffed 24/7 triage and a response-time commitment?
24/7 investigation, authorized containment and endpoint remediation using Vectra and connected tools.
Contain threats
Tool licenses, action permissions and out-of-scope recovery
Brings its own platform
Endpoints, Network, Identity & Access, Cloud Workloads, SaaS Applications
Mid-Market, Enterprise
Which native and EDR actions can analysts execute, and which require our approval?
Verizon investigates SIEM incidents and implements agreed detection-content changes. Your team owns platform hosting, source health and containment.
Co-manage the SOC
SIEM hosting, source health, change approval, containment and recovery
Works with your tools
Enterprise, Mid-Market
Which SIEM instance and detection content will Verizon maintain, and what content-change ticket allowance and engineering work are included?
MSP-delivered investigation and permitted containment using existing endpoint and identity tools.
Contain threats
Tool operation, telemetry, approvals and recovery
Works with your tools
Endpoints, Identity & Access, Email, SaaS Applications
MSP/MSSP
Which tools and actions will the runbook pre-authorize, and which need an approval before execution?
WatchGuard Open MDR investigates supported tools and executes permitted endpoint isolation.
Contain threats
Integrations, isolation exceptions and remaining remediation
$141.59 / 12-month license
Your tools or its own platform
Endpoints, Network, Identity & Access, SaaS Applications
SMB, Mid-Market, MSP/MSSP
For each connected product, which actions will the SOC execute and which will our MSP perform?
Elements MDR analysts investigate and perform authorized endpoint containment. Identity MDR is an add-on.
Contain threats
Sensors, on-call contacts, action permissions and out-of-scope recovery
Brings its own platform
Endpoints, Identity & Access
Mid-Market, Enterprise, MSP/MSSP
Which workstation, server and identity actions are preauthorized, and who can change those settings?