SOC Providers.com Security Operations Center providers
Last reviewed: 3 Oct 2026

Todyl MXDR

Todyl MXDR analysts investigate shared SIEM cases, tune detections and coordinate response with the MSP. The MSP retains tenant policy, action permissions, client communication and recovery.

Platform
Their platform

Who does what

Provider

  • Monitor, investigate and respond around the clock
  • Tune platform detections and share cases
  • Coordinate incidents through a dedicated manager

Your team

  • Manage tenant access and policy decisions
  • Agree action permissions and handle follow-on work
  • Communicate with clients and restore operations

Coverage

  • Endpoints
  • Identity & Access
  • Network
  • SaaS Applications
  • Cloud Workloads

Details

Service scope

Best for MSPs standardizing security delivery on the Todyl platform across client tenants

  • Shared SOC workflow

    Partners work in the same SIEM as Todyl analysts, with case visibility, detection tuning and incident collaboration.

  • Action authority

    Platform response combines analysts and playbooks. Agree the permitted actions, exceptions and approval rules for each tenant.

  • Package boundaries

    Essentials, Advanced and Complete have different retention, SOAR and network limits. External integrations need their own monitoring and response checks.

Full service analysis

Todyl MXDR shares investigations and response with MSPs through Todyl SIEM, supported by detection tuning and a dedicated account manager. Analysts and enabled playbooks act on threats. The MSP retains tenant access and policy decisions, client communication, follow-on work and business recovery.

Your team owns
  • Tenant access, policy decisions and agreed response permissions
  • Client communication and operational decisions during incidents
  • Follow-on remediation, business recovery and work outside contracted integrations

Shared daily operations

Co-management rests on a shared SIEM, case collaboration and continuing detection tuning, not just an account manager. Todyl manages threats within its platform while the MSP stays involved in tenant decisions and client delivery.

Platform response boundary

Native endpoint playbooks can isolate hosts, quarantine files and control malicious processes. Identity response is another documented surface. Confirm actual permissions and connector coverage; ingesting a third-party alert alone does not establish action authority.

AI and analyst roles

Janus provides in-case investigation context, summaries and recommended steps. Todyl describes it as supporting collaboration with its MXDR experts. That does not establish independent AI authority to make every response decision.

Retention and exit

The published packages offer 30-day, 90-day or one-year forensic retention. Retention is separate from export rights and offboarding. Confirm case and log export before removing tenant resources or ending the service.

Pricing & contract
Billing
Tiered, Custom

All published packages include the platform and MXDR. Essentials has 30-day retention and 5 SOAR playbooks, Advanced 90 days, and Complete one-year forensic retention and unlimited playbooks. Confirm billing units, minimums and network scope in the quote.

Tradeoffs & buying questions

Strengths

  • Shared cases and direct analyst collaboration

    Partners can inspect cases and collaborate directly with analysts.

  • Ongoing detection tuning across the platform

    Todyl detection engineers maintain and tune platform rules.

  • Published retention and playbook package limits

    Published package details make retention and playbook limits comparable.

Considerations

  • Operations depend on the Todyl platform

    The normal workflow centers on Todyl SIEM and its platform.

  • Tenant action permissions need explicit agreement

    The parties must agree which actions and permissions apply to each tenant.

  • MSP delivery and package affect the final quote

    The final price depends on package and MSP delivery terms.

Ask before buying

  • Which actions can analysts or playbooks execute in each tenant?
  • Who owns tuning, escalation, client communication and recovery?
  • What does our quote include for retention, playbooks, integrations and exit exports?

Customer feedback

Customers value

  • In late-2025 and January-2026 G2 accounts, MSP users value MXDR response help and case visibility; many reviews were seller-invited and incentivized.

Reported concerns

  • Those G2 MXDR users also describe limits in platform dashboards and reporting; this concerns the platform workflow.

Integrations

Platform / SIEM

  • Todyl Managed Cloud SIEM

Endpoint

  • Todyl Endpoint Security

Cloud

  • Azure

Other integrations

  • Todyl SASE
  • Todyl SOAR
  • Slack
3 more integrations
  • Microsoft Teams
  • Microsoft 365
  • Google Workspace

Common questions
Why classify Todyl as co-managed SOC?It shares daily SOC work with the MSP through the same SIEM, detection tuning and case collaboration.

Todyl and the MSP share daily investigations in the same SIEM, with detection tuning, case collaboration and response coordination. The partner retains tenant policy, client communication and follow-on operational work.

Can we keep existing security tools?The service operates on Todyl SIEM. External data ingestion does not establish equivalent monitoring or response permissions.

External tools can feed Todyl SIEM. Confirm the managed detection scope and available actions for each integration. A connection alone does not establish the same response depth as native controls.

How do the packages differ?All three published packages require quotes. Retention ranges from 30 days to one year, with different playbook and network limits.

Essentials lists 30-day retention and five SOAR playbooks. Advanced increases retention to 90 days and adds network capabilities. Complete lists one-year forensic retention and unlimited playbooks. All require a scoped quote.

Company details
Headquarters
Denver, Colorado
Founded
2015