Who does what
Provider
- Correlate connected-source telemetry
- Validate and explain incidents
- Advise or execute authorized actions
Your team
- Maintain tools and collection access
- Execute or authorize response
- Arrange full incident recovery
Coverage
- Endpoints
- Network
- Cloud Workloads
- Identity & Access
- SaaS Applications
Details
Service scope
Best for Mid-market teams keeping existing tools and choosing their response authority
Passive is the default
Analysts advise the buyer or MSP. Preapproved active actions are optional.
Collection and retention
Network traffic needs a collector and mirror port. Included hot retention is 14 days.
Immediate response boundary
Active containment is bounded. Full forensics and recovery require a separate arrangement.
Full service analysis
Gradient Cyber MXDR analysts validate incidents around the clock and deliver response instructions through Quorum AI. Your team or MSP executes those instructions unless you authorize specific active-response actions, and retains system recovery.
- Your team owns
- Maintain tools, credentials and network mirror configuration
- Execute passive-mode recommendations or authorize selected active actions
- Arrange full incident forensics and system recovery
Passive is the default
Validated incidents become analyst situation reports with evidence and prioritized actions for your team or MSP. Active mode requires advance authorization by action type, with sensitive actions validated by an analyst.
Collection and retention
APIs and logs connect existing tools. Network visibility requires an out-of-band Quorum Collector and a customer-configured mirror port. The current platform includes 14 days of hot data, so longer retention needs explicit confirmation.
Immediate response boundary
Authorized actions can include host isolation, account suspension and firewall changes through connected tools. Full forensics, onsite containment, threat negotiation and system recovery require a separate incident-response arrangement.
Pricing & contract
$44,000/year
Passive, up to 100 endpoints AWS Marketplace 12-month package includes up to 1,000,000 cloud events/day. Passive response only. Indicative pricing from public research, not official provider pricing. Ask the provider for a current quote.
AWS Marketplace example for a 12-month Passive package, up to 100 endpoints and 1,000,000 cloud events/day. Active response requires a separately scoped quote.
- Billing
- Custom
Tradeoffs & buying questions
Strengths
-
Explicit choice between advice and authorized action
-
Works across existing endpoint, network and cloud tools
-
Published marketplace package has defined limits
Considerations
-
Default mode leaves execution with the buyer or MSP
-
Included hot retention is 14 days
-
Full incident recovery requires a separate arrangement
Ask before buying
- Which actions remain passive and which can Gradient execute through our endpoint, identity and firewall tools?
- What changes the quoted endpoint, event, collector, retention and active-response charges?
- Who provides full incident response and recovery, and how will case data reach that team?
Integrations
Platform / SIEM
- Quorum AI
Endpoint
- SentinelOne
- CrowdStrike
- Microsoft Defender
Cloud
- AWS
- Azure
Other integrations
- Active Directory / Entra ID
- Microsoft 365 / Google Workspace
- Network collection through Quorum Collector
Common questions
Will Gradient contain threats automatically by default?
No. Passive is the default. Specific active actions can be authorized before service starts, with sensitive actions validated by analysts.
Does the marketplace price include active response?
The $44,000 annual package is labeled MXDR - Passive, for up to 100 endpoints and 1,000,000 cloud events/day. Confirm an active-response quote separately.