SOC Providers.com Security Operations Center providers
Last reviewed: 1 Jun 2026

BlueVoyant MDR

MDR · XDR · Co-Managed SOC

BlueVoyant MDR is a co-managed SOC and MDR service for buyers running Microsoft Sentinel, Defender, Splunk or Cisco XDR. After an alert, BlueVoyant analysts and automation triage, investigate and can take approved containment actions, while the buyer still owns the security stack, rules of engagement, data sources, platform licensing and business remediation.

What they do
Co-manage the SOC
Works with
Your stack
Built for
Mid-Market / Enterprise
Price
AWS Marketplace Splunk MDR listing starts at $73,872 per 12 months
Best for
Microsoft-first teams that want Sentinel and Defender monitored, tuned and operated with outside SOC capacity

They cover

  • Endpoints
  • Cloud Workloads
  • Identity & Access
  • Email
  • Network
  • SaaS Applications

Your team still owns

  • Owning the Microsoft, Splunk, Cisco XDR or supported EDR environment used by the service
  • Maintaining endpoint, identity, cloud and log-source coverage outside the managed scope
  • Defining rules of engagement and approving sensitive response actions
  • Handling business remediation, recovery, user communication and IT changes outside MDR tooling
  • Confirming whether DFIR support, extra engineering, assessments or optimization work is included or separately quoted

Pricing

Line Figure
Published price AWS Marketplace Splunk MDR listing starts at $73,872 per 12 months
Billing model Per-endpoint, Tiered, Custom
Contract Not published
Onboarding Not published

Tradeoffs

Works well

  • Clear fit for buyers that want MDR around Microsoft or Splunk rather than a full tool replacement
  • Public materials describe both security monitoring and platform management responsibilities
  • SOC locations in North America, Ireland and the UK support regional coverage needs for many buyers
  • AWS Marketplace gives a public pricing signal for the Splunk Enterprise MDR offer

Watch out for

  • Pricing is mostly quote-based outside the AWS Marketplace Splunk listing
  • Buyers still own Microsoft, Splunk, Cisco or EDR licensing and the quality of connected data sources
  • DFIR, assessments, accelerator work and continuous optimization can be separate from base MDR scope
  • Public review depth is useful but thinner than larger MDR providers with hundreds of reviews

What buyers say

Alert noise

Not assessed

Transparency

Not assessed

Customers like

  • Gartner review excerpts mention actionable alert context and investigation notes
  • Reddit discussion includes recommendations for Microsoft-first buyers considering BlueVoyant
  • Buyers can inspect marketplace packaging for Splunk MDR rather than relying only on a sales page

Watch out for

  • G2 shows one review from a researcher who had not used the service, so it should not drive sentiment
  • Reddit comments are sparse and include a caveat about Sentinel detection rules
  • Gartner public review volume is 7 ratings, far below the largest MDR providers

Reputation reads from public reviews, not vendor-published numbers.

Sources
Gartner Peer InsightsG2 BlueVoyant reviewsReddit MSSP discussion

Ask before buying

  1. Which actions can BlueVoyant take immediately under our rules of engagement, and which actions wait for approval?
  2. Does our quote include Microsoft or Splunk deployment work, ongoing platform engineering, DFIR support and third-party EDR coverage?
  3. How will pricing change with endpoint count, data sources, Sentinel or Splunk consumption, ITSM integration and contract term?

Integrations

Microsoft SentinelSplunk Enterprise SecuritySplunk Cloud PlatformMicrosoft Defender for EndpointMicrosoft Defender XDRSupported EDR partnersMicrosoft AzureMicrosoft Defender for CloudAWSHybrid cloud environmentsCisco XDRMicrosoft 365ITSM ticketing integration through the Wavelength portal when configured

Editorial notes

Why co-managed SOC

BlueVoyant's MDR pages and marketplace listings describe 24/7 monitoring, triage, investigation, threat response, platform care, detection content and management inside customer-owned Microsoft or Splunk environments. That is broader than advice-only MDR, but buyers still own the stack, scope, licensing and business remediation.

Containment boundary

Official endpoint material supports quarantine, deletion, allowlisting, blocklisting and remote response activities after investigation. The profile does not treat BlueVoyant as owning every recovery step because response depends on the subscribed service, connected tooling and agreed rules of engagement.

Stack fit

BlueVoyant is most specific around Microsoft Sentinel, Defender, Splunk and Cisco XDR. Buyers using a different SIEM or endpoint stack should verify whether BlueVoyant will operate that tooling directly or require a migration, integration project or partner-supported scope.

Pricing boundary

The AWS Marketplace Splunk MDR listing gives a useful public floor for one packaged service, while Microsoft and general MDR pages remain quote-based. The public price signal should stay tied to Splunk MDR and should not be used as a universal BlueVoyant MDR rate.

Questions

Does BlueVoyant MDR run the SOC for the buyer?
This profile classifies BlueVoyant MDR as Co-manage the SOC. BlueVoyant can operate supported monitoring, investigation, platform and response workflows, but the buyer still owns the security stack, licensing, data-source coverage, rules of engagement and business remediation.
Can BlueVoyant MDR contain threats?
Yes, inside supported tools and agreed scope. Official endpoint material supports actions such as quarantine, deletion, allowlisting, blocklisting and remote response activities after investigation. Buyers should confirm which actions are pre-approved for their environment.
Is BlueVoyant MDR pricing public?
Partly. BlueVoyant does not publish universal MDR list pricing. AWS Marketplace lists MDR for Splunk Enterprise at $73,872 for a 12-month contract, while broader MDR and Microsoft offers remain quote-based.