Who does what
Provider
- 24/7 triage and investigation
- Included SIEM, EDR and SOAR engineering
- Agreed response workflows
Your team
- Tenant control and assigned access
- Priorities and action permissions
- Out-of-scope remediation and recovery
Coverage
- Endpoints
- Cloud Workloads
Details
Service scope
Best for Teams needing tool engineering and incident support
Service
MDR plus ongoing security-tool engineering.
Platform
Works in the client's environment, with a Microsoft option.
Response
Containment and recovery tasks depend on the contracted scope.
Full service analysis
KPMG's US MDR offer co-manages threat monitoring, investigation and security-tool engineering in the client's environment. Your team retains tenant control, operating priorities, response permissions and work outside the agreed incident scope.
- Your team owns
- Tenant ownership, licenses and access duties assigned to your team.
- Detection priorities, action permissions and business-impacting decisions.
- Recovery and remediation outside the contracted incident scope.
Pricing & contract
- Billing
- Custom
Request a US MDR quote defining monitored sources, licenses, onboarding and recurring SIEM, EDR and SOAR work. Confirm included containment, forensic and recovery tasks and any separate incident fees.
Tradeoffs & buying questions
Strengths
-
Recurring SIEM, EDR and SOAR engineering
Recurring security-tool engineering extends the service beyond alert handling.
-
Client-tenant operating model
Client-tenant operation can preserve control of the working environment.
Considerations
-
Member-firm scope can differ
The US description does not establish identical scope across KPMG member firms.
-
Response and forensic duties need definition
Containment, forensics and recovery responsibilities need explicit contractual boundaries.
Ask before buying
- Which SIEM, EDR and SOAR duties will KPMG operate each day, and what remains with us?
- Which containment, forensic and recovery tasks are included, and which need a separate engagement?
- Which KPMG member firm and delivery locations apply, and are any audit-client restrictions relevant?
Integrations
Other integrations
- Existing SIEM, EDR and SOAR platforms, subject to scoping
Common questions
Does KPMG MDR require Microsoft?
The broader US offer supports existing environments. KPMG also markets a Microsoft-focused option. Confirm the architecture and licenses in the proposal.
Does KPMG own every SOC responsibility?
That is not established by the standard public scope. This profile treats the US offer as co-managed operations, with tenant control, response permissions and out-of-scope work retained by the buyer.