Managed SOC providers

Armis Managed Threat Services investigates Centrix findings, hunts for threats and tunes detection policies.

You still own Containment, remediation, connected controls and the broader SOC workflow

CGI Protective Monitoring correlates logs, validates suspicious events and sends incident tickets with containment or eradication advice.

You still own Containment and recovery, Incident-response staffing

24/7 investigation and mitigation guidance using CYREBRO's SOC platform and connected security tools.

You still own Integrations, system access, remediation and recovery

National Telecom Thailand's Cyber Security Monitoring service analyzes suspicious events and provides prioritized warnings and advice.

You still own Containment and remediation, An available incident contact

NuSummit's NSE Market-SOC monitors security events and manages incidents with remediation guidance for SEBI-regulated entities.

You still own Remediation execution, Regulatory decisions

24/7 analyst investigation and response guidance using SOCSoter network telemetry and SIEM.

You still own Network feeds, remediation, infrastructure changes and recovery

VectorUSA's Tier 1 Foundational SOC monitors alerts and performs initial triage.

You still own Deeper investigation, Containment and recovery

Investigates connected alerts and executes permitted containment through existing tools.

You still own Coverage, approvals, complex escalations and recovery.

Acronis TRU Advanced MDR executes permitted incident response through Cyber Protect Cloud.

You still own Deployment, critical-device approvals and recovery authorization

Arctic Wolf's Aurora MDR investigates alerts and contains threats through configured integrations, supported by a named Concierge Security Team.

You still own Connected tools, response permissions and remediation outside configured containment

Barracuda Managed XDR investigates alerts and automates containment through purchased modules and supported endpoint, email, identity and firewall integrations.

You still own Connected tools, response permissions and remediation outside automated actions

Bitdefender MDR analysts investigate GravityZone alerts and take pre-approved containment actions within your licensed endpoint and XDR coverage.

You still own Response policy, recovery and systems outside licensed GravityZone coverage

Blackpoint's CompassOne MDR investigates endpoint and cloud threats, isolating devices or disabling accounts within agreed response authority.

You still own Deployment, response policies, remediation, recovery and MSP client communication

Blumira Managed pairs its Automate platform with 24/7 analyst review of high and critical cases and approved containment in Microsoft identity and Blumira-covered endpoints.

You still own Source and agent coverage, low and medium cases, approvals, remediation and recovery

Check Point MDR 360° investigation and configured containment across agreed security integrations.

You still own Tool access, response approvals and work outside the agreement

Cisco analysts investigate supported XDR components and execute containment allowed by the response playbook.

You still own Component health, response authority, remediation and recovery

24/7 analysts investigate endpoint alerts and perform permitted isolation through supported EDR tools.

You still own Agent health, isolation exceptions, client coordination and recovery

Critical Start MDR investigates alerts from your security tools and can contain threats under agreed rules of engagement.

You still own Tool licensing, telemetry coverage, response approvals, remediation and recovery

Investigates alerts and triggers configured SOAR containment after checking evidence.

You still own Hosting, model access, response permissions, action checks and recovery.

Falcon Complete analysts investigate, contain and remediate threats through CrowdStrike's Falcon platform under pre-approved playbooks.

You still own Falcon deployment, response approvals, business exceptions and out-of-scope coverage

Cybereason MDR Complete investigates endpoint threats and performs specified remediation. Host isolation requires written approval.

You still own Endpoint deployment, isolation approval and wider incident response or recovery

24/7 analysts investigate and contain incidents across the assets covered by your MaxxMDR tier.

You still own Tool access, response permissions and business recovery

Investigates alerts and executes containment through risk-based approval gates.

You still own Autonomy settings, permissions, approvals, incident decisions and recovery.

Darktrace investigates Enhanced Monitoring alerts and applies supported containment actions within its platform.

You still own Deployment health, response rules, follow-up analysis and remediation

Dell analysts investigate supported XDR alerts and take pre-approved containment actions such as host isolation and file blocking.

You still own Endpoint coverage, platform access and remediation beyond the contracted response scope

Deloitte investigates and responds through selected enterprise MXDR modules and partner technologies.

You still own Module selection, action permissions and out-of-scope recovery

Investigates alerts and executes permitted containment through connected tools.

You still own Detection tools, response permissions, uncertain cases and recovery.

eSentire MDR investigates and contains threats through supported tools under agreed response rules.

You still own EDR licensing, tool access, response permissions and recovery outside agreed incident support

24/7 ESET endpoint investigation and containment, with configurable restrictions for critical devices.

You still own Software deployment, critical-device permissions and recovery

Exabots triage connected data and execute configured containment workflows.

You still own Source permissions, response controls, difficult incidents and recovery.

Expel investigates alerts in existing tools and executes enabled containment after analyst review.

You still own Tool licenses, action permissions, exceptions and recovery

Field Effect supplies an MDR platform and SOC that investigate threats and contain them under buyer-selected response policies.

You still own Agent deployment, response policies, recovery and incident response beyond MDR scope

Standard MDR investigates FortiEDR alerts and contains endpoint threats under agreed playbooks.

You still own Agent deployment, action permissions and recovery beyond contracted response

Heimdal SOC investigation and containment with response permissions set by module.

You still own Module choices, notification-only response and broader recovery

Huntress analysts investigate endpoint, identity and SIEM alerts, then perform supported containment within enabled modules and permissions.

You still own Deployment, permissions, manual remediation, recovery and client communication

Smart MDR uses operational AI agents to investigate alerts and execute configured containment actions.

You still own Automation permissions, human escalation and work beyond containment

LiveSOC investigates alerts and executes containment through connected tools, with deeper CSIRT duties defined by the engagement.

You still own Action permissions, incident decisions and recovery outside the contract

Aegis MDR investigates threats and performs preagreed containment across customer-selected security tools.

You still own Technology ownership, response permissions and wider recovery

Investigates multi-source alerts using forensic evidence and runs configured response actions.

You still own Detection tools, response policies, contested verdicts and recovery.

Kaseya MDR investigates endpoint, Microsoft 365 and firewall activity and performs configured containment and remediation.

You still own Onboarding, coverage, permissions, response rules and recovery

CrowdStrike-backed MDR with Kroll response operations, incident investigation and scoped remediation.

You still own Deployment access, approvals and business recovery outside scope

Eligible Lumu Defender accounts can enable Autopilot to manage incidents alongside configured blocking. Your team sets policies and handles escalated investigations and recovery.

You still own Activation, response permissions, connected controls, complex investigations and recovery

Mandiant investigates Google SecOps alerts and can contain affected hosts through supported tools under agreed response authority.

You still own Google SecOps and partner licenses, telemetry, permissions, remediation and recovery

Microsoft analysts investigate Defender incidents and execute permitted containment in MDR Plan 1.

You still own Defender licensing, deployment, access, exclusions and out-of-scope remediation

mnemonic investigates threats through Argus and provides containment through contracted response modules.

You still own Deploy agents and connect agreed sources

Guardian xMDR Core combines Cortex monitoring with human investigation and containment playbooks from a Dutch SOC.

You still own Response permissions, source connections and recovery beyond scope

NTT analysts investigate SamurAI alerts and isolate validated endpoint threats through supported EDR.

You still own Source setup, action permissions, remediation and risk closure

Orange's MDR/XDR analysts investigate threats and take agreed containment actions across supported security tools.

You still own Telemetry sources, response approvals and remediation beyond agreed playbooks

Investigates covered Cortex incidents and executes scoped endpoint containment around the clock.

You still own Platform upkeep, action permissions, incident declaration and wider recovery

Investigates connected alerts and can execute approved machine quarantine.

You still own Tool coverage, context, action rules and human incident decisions.

Rapid7 investigates through its SIEM and executes configured containment, with limited enabled remediation.

You still own Agent and source coverage, permissions, excluded detections and recovery

S-RM monitors managed EDR around the clock and provides automated threat response, with Polus attack-surface monitoring included.

You still own Response permissions, coverage gaps, vulnerability fixes and recovery

Wayfinder MDR investigates Singularity alerts and executes approved containment or mitigation through SentinelOne's platform.

You still own Singularity deployment, telemetry coverage, response authorization and business recovery

Investigates alerts and runs response actions under buyer-selected operating modes.

You still own Mode selection, context, integrations, escalations and recovery.

CrowdStrike-based endpoint investigation and initial containment delivered through SonicWall's SOC for MSPs.

You still own Agent deployment, policy upkeep, escalated investigation and recovery

Sophos investigates alerts and contains threats through supported tools and your chosen response mode. MDR Plus adds incident response for eligible Sophos XDR endpoints.

You still own Deployment, permissions, recovery and response beyond the contracted scope

Sophos analysts investigate Taegis cases and execute approved containment actions.

You still own Integration health, action permissions, custom rules and recovery

Systal monitors connected systems, investigates threats and performs contracted incident response.

You still own Scope, response permissions and out-of-contract recovery

T-Systems investigates endpoint threats and executes host, process and file containment through its SOC.

You still own Action permissions, business decisions and wider recovery

ThreatDown Elite endpoint investigation and containment through Nebula or OneView.

You still own Agent deployment, response permissions and broader recovery

Analysts investigate subscribed Trend sources and perform supported containment under your approval settings.

You still own Product deployment, response permissions, endpoint exceptions and wider recovery

Truesec Core investigates threats and executes agreed containment, with human analysts directing AI-assisted work.

You still own Access, incident contacts, response permissions and wider recovery

LevelBlue's Fusion-based MDR investigates alerts and contains endpoint threats under agreed response protocols.

You still own Technology upkeep, approval rules, incident leadership and wider recovery

MAXI agents investigate alerts and 24/7 analysts perform approved containment. Coverage varies by MDR tier.

You still own Tool access, response authority, tier selection and out-of-scope recovery

24/7 investigation, authorized containment and endpoint remediation using Vectra and connected tools.

You still own Tool licenses, action permissions and out-of-scope recovery

MSP-delivered investigation and permitted containment using existing endpoint and identity tools.

You still own Tool operation, telemetry, approvals and recovery

WatchGuard Open MDR investigates supported tools and executes permitted endpoint isolation.

You still own Integrations, isolation exceptions and remaining remediation

Elements MDR analysts investigate and perform authorized endpoint containment. Identity MDR is an add-on.

You still own Sensors, on-call contacts, action permissions and out-of-scope recovery

Zscaler MDR, formerly Red Canary, investigates connected alerts and executes permitted endpoint, identity and network containment.

You still own Underlying security tools, response approvals and remediation outside the contracted scope

Adlumin MDR by N-able investigates and contains threats through a shared XDR and SIEM platform. Your team maintains controls and handles work outside the package.

You still own Connected tools, response permissions, escalation rules and work outside the package

Advania UK manages Sentinel operations and investigations while sharing incident escalation and response responsibilities.

You still own Incident participation, response decisions and work outside the service scope

Advens mySOC for IT combines SIEM and network analysis with detection engineering and shared incident playbooks.

You still own Monitoring priorities, approvals and work outside agreed playbooks

Almond CWATCH for Sentinel operates detection in the customer's Azure subscriptions and shares incident work with its IT team.

You still own Azure ownership, approvals and recovery beyond the agreed SOC/CERT scope

Atos maintains Microsoft Sentinel and investigates alerts through its optional MDR module.

You still own Control the Microsoft tenant and source access

Binary Defense co-manages SIEM and XDR configuration, detection rules and alert investigation.

You still own Tool licensing, telemetry quality, response authority and business remediation

BlueVoyant co-manages Microsoft security operations, investigates alerts and responds through agreed rules of engagement.

You still own Platform licensing, data-source coverage, response approvals and business remediation

BT operates Sentinel detections, implements requested content changes and investigates incidents while your team retains response.

You still own Content decisions, Microsoft prerequisites, log sources, containment and recovery

Cipher analysts investigate around the clock and share detection-rule work and case visibility over existing tools.

You still own Tool administration, business context, permissions and remediation

Claranet operates Sentinel detections, investigates incidents and tunes the service with your team.

You still own Source systems, tuning decisions and remaining response

Clearnetwork manages AlienVault USM, investigates detected threats and emails response guidance.

You still own Containment and recovery, Reseller handoffs if applicable

CyberCX operates Microsoft detections, hunts threats and maintains the managed Sentinel and Defender environment.

You still own Platform and data control, permissions and recovery outside scope

CyberProof analysts share incident handling, detection tuning and response workflows through CDC Reveal360.

You still own Action permissions, agreed tool duties and out-of-scope remediation

Cyderes supports shared investigation and response workflows over existing tools. SIEM and EDR management are optional.

You still own Response rules, platform access and out-of-scope remediation

Deepwatch co-manages monitoring, investigations, detection tuning and approved response workflows across your existing SIEM and security tools.

You still own Connected telemetry, response permissions, IT remediation and recovery

DEFEND investigates alerts and operates Microsoft Sentinel through a shared security operations workflow.

You still own Connected systems, response permissions and approved major incident costs

FourNet's co-managed SOC investigates alerts, maintains detections and carries out response steps agreed in runbooks.

You still own Selected containment actions, Estate changes and decisions

Fujitsu operates customer-tenant Sentinel, investigates alerts and coordinates the handoff to resolver teams.

You still own Azure ownership and remediation beyond the agreed handoff

IBM analysts and ATOM share detection, investigation and response workflows across your existing tools.

You still own Detection approvals, action permissions, tool access and out-of-scope recovery

ITrust operates Reveelium detection and shares incident investigation and resolution with the customer's IT team.

You still own System context, assigned response actions and recovery beyond scope

KPMG's US MDR combines analyst incident work with ongoing SIEM, EDR and SOAR engineering.

You still own Tenant control, priorities, response permissions and out-of-scope recovery

24/7 investigations and hunts with shared FusionDetect rules, queries and approved critical-incident response.

You still own Detection choices, source access, response authority and recovery

LRQA's managed-SIEM SOC service operates detections and investigates incidents in the agreed logging environment.

You still own Estate changes, Response authority and recovery

Lumifi co-manages detections, investigations and response workflows through ShieldVision and supported security tools.

You still own Source access, response authority, internal decisions and recovery outside scope

Shared SOC workflows through the Unified Cyber Platform, with 24/7 investigation and scoped response.

You still own Source access, shared SOC decisions, action permissions and recovery

Novacoast operates the buyer's SIEM, maintains detections and investigates alerts before escalation.

You still own Tenant and source systems, Agreed response duties, An available support contact

Ontinue co-manages Sentinel and Defender, investigating alerts and executing approved containment through Microsoft controls.

You still own Microsoft licensing, log sources, response rules and IT remediation

Optiv manages Google Security Operations health, log configuration and detection rules, then investigates alerts and recommends mitigation.

You still own Source systems and access, Containment and recovery

Performanta shares SIEM monitoring, investigation, detection engineering and incident workflows with your security team.

You still own Internal decisions, access, environment changes and the agreed response split

plusserver operates hosted QRadar and investigates alerts, with incident handling shared through the customer's response process.

You still own Interfaces, incident ownership and response outside the management level

Proficio co-manages hosted or customer SIEM workflows, investigates alerts and adds containment when Active Defense is included.

You still own Connected tools, response approvals, change controls and post-containment remediation

Quorum operates Sentinel health, detections and incidents through containment across scoped Microsoft and third-party sources.

You still own Microsoft licensing, source access, action permissions and recovery

Redcentric shares Sentinel operations, detection maintenance and MXDR incident coordination under an agreed action matrix.

You still own Source systems, endpoint administration, response authority and wider recovery

GreyMatter combines automated investigations, response playbooks and ReliaQuest operating support across connected security tools.

You still own Tool licenses, source access, action permissions, escalation decisions and recovery

Secon.SOC shares monitoring, investigation, detection improvement and playbook-led response coordination.

You still own Internal security ownership, decisions and assigned remediation

Sopra Steria SOC Core provides UK monitoring, investigation and ongoing SIEM work alongside the customer's incident team.

You still own Asset context, incident ownership and response tasks outside the selected tier

Telefónica Tech operates the SIEM, maintains detections and investigates alerts before the agreed response handoff.

You still own Monitoring priorities and response beyond the agreed procedures

Thales investigates alerts, tunes detections and administers the platforms assigned in a shared SOC service.

You still own Shared SOC decisions, approvals and work beyond scope

Todyl analysts share SIEM investigations, tune detections and coordinate response with the MSP.

You still own Tenant policy, access, client communication and recovery

Verizon investigates SIEM incidents and implements agreed detection-content changes. Your team owns platform hosting, source health and containment.

You still own SIEM hosting, source health, change approval, containment and recovery

ANS runs Microsoft security tooling, detections, incident investigations and response coordination.

You still own Access, source configuration, incident decisions and assigned remediation

Bridewell's fully outsourced SOC runs daily monitoring, investigation and detection tuning, then leads response within agreed playbooks.

You still own Telemetry, tenant permissions, response approvals, business remediation and recovery

e2e-assure runs contracted SOC monitoring, investigations, hunting and detection improvement through Cumulo.

You still own Access, configuration changes and wider incident remediation

Littlefish runs Sentinel operations, detection maintenance, investigations and authorised incident handling.

You still own Licenses, permissions, business decisions and wider IT remediation

Lumen operates the contracted Sentinel SOC, incident queue and SIEM health. Full and shared arrangements differ.

You still own Source access, response approvals and out-of-scope recovery

Pondurance Managed SOC with Managed SIEM runs daily monitoring, investigation, hunting and containment within agreed scope.

You still own Response authority, asset context, IT remediation and recovery

Precursor Fully Managed SOC runs daily monitoring, detection engineering and incident investigation, including agreed endpoint containment.

You still own Access and response permissions, Business decisions and recovery

SecurityHQ runs contracted SOC operations, investigating threats and coordinating containment through agreed playbooks and supported security controls.

You still own Source coverage, response approvals, internal remediation and recovery

Socura runs detection tools, rule engineering, investigations and authorised containment for its outsourced SOC model.

You still own Access, response permissions, business decisions and wider recovery