Who does what
Provider
- Run contracted SOC and SIEM operations
- Investigate alerts and hunt threats
- Contain threats within agreed response authority
Your team
- Maintain asset context and connected sources
- Approve response actions and escalation paths
- Complete IT remediation and recovery
Coverage
- Endpoints
- Network
- Identity & Access
- Cloud Workloads
- SaaS Applications
- IoT
Details
Service scope
Best for Midmarket teams outsourcing daily SOC and SIEM operations
Contracted ownership
This profile selects outsourced Managed SOC with Managed SIEM. Secure is endpoint-focused. Defend adds SIEM. Fortify adds custom logs and advanced network coverage. Team augmentation is a different ownership choice.
Response matrix
Containment depends on agreed authority. Document automatic actions, customer approvals and the remediation work retained by internal IT.
Separate services
Advisory, vulnerability and recovery work need separate scope. Current MDR Assurance lists five DFIR hours per suspected incident, with further entitlement subject to service terms.
Full service analysis
Pondurance Managed SOC with Managed SIEM provides an outsourced operating model for daily log management, threat investigation, hunting and permitted containment. US-based analysts work with Kanati automation. The buyer retains source access, business context, response authority and recovery outside the agreed scope.
- Your team owns
- Approving response authority, escalation contacts and any actions that touch production systems
- Maintaining business context, asset ownership and IT remediation capacity
- Confirming which EDR, identity, cloud, network and application sources are in scope
- Buying separate advisory, retainer or incident response services when the base SOC scope does not include them
Why run-the-SOC lane
Pondurance explicitly describes Managed SOC as either augmenting a team or providing an entirely outsourced SOC, and its Managed SIEM page says it can outsource the SIEM and the entire SOC. That supports Run the SOC more than narrow MDR.
Scope boundary
The current package page separates Secure managed EDR, Defend with Managed SIEM and Fortify with custom logs and advanced network coverage. This profile selects the outsourced SOC operating model with SIEM included. Advisory, vulnerability management and recovery work still need explicit scope.
Response boundary
Official pages support isolation, containment, disruption and automated plus human remediation, but buyers still need a written response matrix that states what Pondurance can do without approval.
Automation and incident support
Kanati investigates, triages and orchestrates permitted response with human oversight. The customer must agree permissions and escalation. Current MDR Assurance lists five DFIR hours per suspected incident. That allowance and any further covered work should be checked against the order rather than treated as unlimited recovery.
Pricing & contract
- Billing
- Custom, Tiered
Current packages are Secure for managed EDR, Defend adding Managed SIEM and Fortify adding custom logs and advanced network coverage. The published model is volume-based with unlimited seats. Obtain a quote for the selected outsourced SOC scope, ingestion, retention, EDR licences, additional integrations and incident-response entitlements.
Tradeoffs & buying questions
Strengths
-
Outsourced daily SOC operations for midmarket teams
Clearer fit for outsourced SOC operations than endpoint-only MDR providers
-
Managed SIEM and MDR through one operating partner
Combines Managed SIEM and MDR, which helps buyers that want one operating partner for logs and response
-
Documented triage, hunting and containment workflows
Public pages explain triage, hunting, disruption, containment and post incident improvement in operational terms
-
Integrates existing endpoint and cloud tools
Works with existing tools rather than forcing a full platform replacement
Considerations
-
Package, log volume and response scope determine cost
Package, log volume and response scope determine the quote
-
Advanced network and custom source coverage require Fortify or an agreed extension
Advanced network monitoring and custom source coverage belong to Fortify or a specifically agreed extension
-
Outsourcing SOC operations does not include every recovery or advisory task
Full SOC operations still leave out-of-scope recovery, advisory and IT changes with their agreed owners
Ask before buying
- Which containment actions can Pondurance execute without waiting for our team?
- Does the order select outsourced SOC with Defend or Fortify, and which EDR licences, log volumes, integrations and DFIR entitlements are included?
- How are after hours escalations, customer approvals and post incident remediation responsibilities documented?
Integrations
Platform / SIEM
- Pondurance Managed SIEM
Endpoint
- CrowdStrike Falcon
- SentinelOne
- Microsoft Defender for Endpoint
Cloud
- AWS
- Azure
- GCP
Other integrations
- Pondurance SCOPE portal
- Kanati agentic SOC
- Palo Alto Networks
2 more integrations
- Microsoft Entra ID
- Google Workspace
Common questions
Is Pondurance MDR or a service that can run your SOC?
This profile selects Pondurance Managed SOC with Managed SIEM in an outsourced operating model. Pondurance also offers endpoint-focused Secure and team augmentation. Defend adds SIEM and Fortify adds custom logs and advanced network coverage, so the order must specify the selected scope.
Does Pondurance take response actions?
Yes, within agreed scope. Public pages describe disruption, containment, isolation and automated plus human remediation. Buyers should still confirm which actions are approved in advance, which require approval and which remain with internal IT.
Is Pondurance pricing public?
Pondurance publishes Secure, Defend and Fortify package boundaries and a volume-based model with unlimited seats. Request a quote that identifies the package, log volume, EDR licensing, retention, integrations and response entitlements. A historical endpoint-only contract is not a price for this outsourced SOC scope.
Company details
- Headquarters
- Indianapolis, Indiana
- Founded
- 2008
- SOC regions
- North America