Who does what
Provider
- Investigate incidents on monitored assets
- Contain and remediate within scope
- Show cases through CyberSight
Your team
- Maintain tools and access
- Agree response permissions
- Own business recovery
Coverage
- Endpoints
- Identity & Access
- Cloud Workloads
- Network
Details
Service scope
Best for Mid-market teams or MSPs seeking incident containment across a defined set of tools
Coverage depends on the tier
Core covers endpoint or email. Elite adds managed SIEM. Packet monitoring is optional.
Response has an asset boundary
Covered-asset response is included. Extended forensic work can require another agreement.
Buy through a partner
Per-endpoint partner quotes need clear onboarding and support responsibilities.
Full service analysis
CyberMaxx MaxxMDR analysts investigate and contain incidents around the clock within contracted endpoint, email or broader telemetry scope. Your team or MSP maintains tool access, agrees response permissions and owns business recovery and work outside that scope.
- Your team owns
- Maintain connected tools, access and supported assets
- Agree containment permissions and escalation contacts
- Own business recovery and arrange out-of-scope forensic work
Coverage depends on the tier
Core covers endpoint or email. Advanced combines them. Elite adds managed SIEM, deception and exposure management. Packet-level network monitoring through MaxxIDS and the offensive testing bundle are optional additions.
Response has an asset boundary
CyberMaxx includes investigation, containment and remediation for compromised assets monitored by its SOC. Extended forensic investigation and documentation can require another statement of work. Confirm action permissions and recovery ownership before onboarding.
Buy through a partner
The current channel page says CyberMaxx transacts through partners and charges per endpoint. Agree which party owns onboarding and support. Its September 2026 Avertium acquisition does not establish that Avertium services are included in MaxxMDR.
Pricing & contract
- Billing
- Per-endpoint, Custom
The current channel page describes per-endpoint pricing. Quote the selected tier, partner services and any additional forensic work separately.
Tradeoffs & buying questions
Strengths
-
SOC performs containment on covered assets
-
Tiers separate narrow coverage from managed SIEM scope
-
Existing supported tools can feed the service
Considerations
-
Response permissions still need a written agreement
-
Extended DFIR has a separate scope
-
Network packet monitoring is an optional Elite addition
Ask before buying
- Which actions can your SOC execute without approval in our connected tools?
- Which tier, sources, endpoint minimums and optional services are included in the partner quote?
- When does an incident require extended DFIR, and who owns recovery and partner escalation?
Customer feedback
Customers value
-
A seller-invited, incentivized July 2026 G2 MDR reviewer reports less alert-triage work and better after-hours coverage.
-
A 2023 Gartner reviewer values contacts who understand their organization
Reported concerns
-
The July 2026 G2 review says custom compliance reports require support tickets and pricing feels high
-
Visible G2 reviews also cover red teaming, so they cannot all be applied to MDR
Integrations
Other integrations
- CyberSight portal
- Supported existing EDR and firewall tools
- Microsoft 365
2 more integrations
- Google Workspace
- Managed SIEM option in Elite
Common questions
Is all forensic work included?
No. Response on monitored assets is included, but extended forensic investigation and documentation can require a separate statement of work.
Can we buy directly?
The current channel page says CyberMaxx transacts through partners. Confirm the contracting partner and support responsibilities in the quote.