SOC Providers.com Security Operations Center providers
Last reviewed: 1 Jun 2026

Deepwatch Guardian MDR Platform

MDR · Co-Managed SOC · MSSP

Deepwatch Guardian MDR Platform is a Precision MDR and co-managed SOC service that connects to a buyer's SIEM, EDR, cloud, identity and SaaS tools. After an alert, Deepwatch monitors, triages, investigates, hunts and supports active response with named experts, while the buyer still owns tool access, telemetry quality, approval rules and remediation outside agreed workflows.

What they do
Co-manage the SOC
Works with
Your stack
Built for
Mid-Market / Enterprise
Price
Quote-based through direct or marketplace scoping
Best for
Mid-market and enterprise teams that want outside SOC capacity without replacing their SIEM

They cover

  • Endpoints
  • Cloud Workloads
  • Identity & Access
  • Email
  • Network
  • SaaS Applications

Your team still owns

  • Keeping SIEM, EDR, cloud, identity and SaaS telemetry connected and useful
  • Granting the access Deepwatch needs to investigate and run approved workflows
  • Deciding which active response actions are guided, approved or delegated
  • Handling internal IT remediation, recovery, user communication and business-owner decisions
  • Scoping add-ons such as managed EDR, managed firewall, vulnerability management and dark web monitoring

Pricing

Line Figure
Published price Not published
Billing model Custom
Contract Not published
Onboarding Not published

Quote-based. AWS Marketplace and public review text point to subscription scoping around logs, data volume, assets, endpoint monitoring and selected MDR services, but no current public list price was found.

Tradeoffs

Works well

  • Fits buyers that want to keep an existing SIEM while adding operating capacity
  • Public material supports monitoring, investigation, hunting, detection engineering and active response workflow
  • Named expert teams can be a better fit than pooled analyst queues for high-context environments
  • Gartner and G2 provide enough review depth to identify useful buyer checks

Watch out for

  • Buyers need a detailed quote because public list pricing is not available
  • The service depends on supported tools, connected telemetry and agreed access rights
  • Active response needs rules of engagement before buyers can rely on delegated actions
  • Reviews mention price, customer-success continuity and integration or search-performance limits

What buyers say

Alert noise

Not assessed

Transparency

Not assessed

Customers like

  • Gartner reviewers mention named squads, Slack collaboration, custom detection work and reduced internal SOC load
  • G2 reviewers repeatedly cite 24/7 monitoring, analyst responsiveness and false-positive reduction
  • Public reviews describe Deepwatch as useful for buyers that need outside Tier 1 and Tier 2 capacity

Watch out for

  • Gartner includes a visible critique about value compared with similar providers
  • G2 reviewers mention price, communication preferences and integration or Splunk-search limits
  • Reddit discussion is sparse and should be treated as onboarding context, not broad market consensus

Reputation reads from public reviews, not vendor-published numbers.

Sources
Gartner Peer InsightsG2 Deepwatch reviewsAWS Marketplace DeepwatchReddit MDR vendor discussion

Ask before buying

  1. Which response actions can Deepwatch run in our tools without waiting for approval?
  2. Which SIEM, EDR, cloud and identity data sources are included in the quoted MDR scope?
  3. Who owns detection changes, ServiceNow routing, tuning requests and after-hours escalation after onboarding?

Integrations

Splunk EnterpriseSplunk CloudMicrosoft SentinelGoogle Security OperationsSecuronixCrowdStrikeSupported EDR partnersAWSAzureGCPDeepwatch Security CenterNEXA Agentic AI EcosystemServiceNowAWS GuardDutyAWS CloudTrailAWS Security Hub

Editorial notes

Why co-managed SOC

Deepwatch operates across the buyer's existing security stack with 24/7 monitoring, named experts, detection engineering, threat hunting and response workflow support. That is more than advice-only MDR, but the buyer still keeps the tools, access model, telemetry quality and approval boundaries.

Response boundary

Official pages support active response, endpoint isolation, quarantine and guided remediation language. The public profile keeps response framed as approved workflow support because buyers need to confirm which actions Deepwatch can run in their connected tools.

Stack boundary

Deepwatch is best matched to buyers with a supported SIEM such as Splunk, Microsoft Sentinel, Google Security Operations or Securonix. Buyers should verify coverage depth before assuming every EDR, identity, email or SaaS source is equally operated.

Pricing boundary

Deepwatch does not publish current list pricing. AWS Marketplace supports marketplace procurement context, and review text says pricing depends on logs, data volume, assets, endpoint monitoring and MDR service level, so the public profile stays quote-based.

Customer evidence

Gartner and G2 provide enough customer review depth to mention repeated themes. Buyers praise monitoring, named experts, tuning and SOC capacity, while concerns center on pricing, customer-success continuity, communication channels and integration or query performance.

Questions

Does Deepwatch run the SOC?
This profile classifies Deepwatch as Co-manage the SOC. Deepwatch can operate monitoring, investigation, threat hunting, tuning and response workflows across supported tools, but the buyer still owns the stack, access model, telemetry quality, approvals and internal remediation.
Can Deepwatch contain threats?
Yes, when the right tools and rules are in scope. Official material supports active response and endpoint actions such as isolation, quarantine and rollback, but buyers should confirm which actions are guided, pre-approved or handled by their own team.
Is Deepwatch pricing public?
No current public list price was found. Deepwatch is quote-based, and public review text indicates pricing depends on logs, data volume, assets, endpoint monitoring and the selected MDR service level.