Who does what
Provider
- 24/7 selected-module operations
- Investigation and threat hunting
- Contracted containment actions
Your team
- Scope, licenses and assigned access
- Response permissions
- Business decisions and recovery
Coverage
- Endpoints
- Cloud Workloads
- Identity & Access
- Network
- OT/ICS
Details
Service scope
Best for Enterprises defining service and technology scope
Service
MXDR modules selected in the engagement.
Platform
Deloitte's service with a chosen partner stack.
Response
Contracted containment. Broader SOC ownership needs explicit terms.
Full service analysis
Deloitte MXDR provides managed investigation and containment across the security modules selected in the engagement. The buyer retains scope decisions, response permissions and recovery outside the contract, so the service should not be assumed to take over every SOC duty.
- Your team owns
- Selecting the modules, sources and operating duties included in the statement of work.
- Authorizing response actions and maintaining assigned tool access and licenses.
- Business decisions, recovery and operations outside the selected modules.
Pricing & contract
$806,000/year
US example, 2,000 endpoints Indicative pricing from public research, not official provider pricing. Ask the provider for a current quote. AWS Marketplace requires a private offer and final scoping. Capabilities, data, region and endpoint count change the actual price.
AWS Marketplace, US customers, 12-month term and 2,000-endpoint dimension. A private offer sets final scope.
- Billing
- Custom
Tradeoffs & buying questions
Strengths
-
Modular scope around selected platforms
Modular scope can align the service with an enterprise's selected security platforms.
-
Visible US marketplace contract basis
The US marketplace listing exposes a contract term and endpoint dimension for procurement discussions.
Considerations
-
Full SOC ownership is not automatic
No single public module list establishes a full SOC handoff for every customer.
-
US price requires final scoping
The listed US price remains subject to private-offer scoping and is not a universal per-endpoint rate.
Ask before buying
- Which containment and remediation actions will Deloitte execute, and under which permissions?
- Which modules, technology licenses, data volume and retention are included in our private offer?
- Which member firm contracts the service, and which team, locations and escalation path deliver it?
Integrations
Endpoint
- Microsoft Defender in the Microsoft delivery option
- CrowdStrike in a selected delivery option
Other integrations
- Microsoft Sentinel
- Palo Alto Networks delivery option
Common questions
Does MXDR include all Deloitte cyber services?
No. Deloitte describes MXDR as modular. Incident response, OT, identity and other work must be named in the engagement. Broader advisory and implementation work is not automatically included.
Does the AWS listing mean MXDR runs on AWS?
No. The listing currently says it is not deployed on AWS. Marketplace procurement and the chosen security platform are separate decisions.