Who does what
Provider
- 24/7 monitoring and investigation
- Threat hunting
- Agreed containment
Your team
- Access and incident contacts
- Response permissions
- Recovery beyond scope
Coverage
- Endpoints
- Network
- Cloud Workloads
Details
Service scope
Best for Small and midmarket teams needing MDR
Service
MDR Core for smaller security teams.
Platform
Integrated with the tools agreed in the onboarding plan.
Response
Analyst decisions with AI-assisted execution and documentation.
Full service analysis
Truesec MDR Core monitors endpoints, networks and cloud services, with analysts investigating threats and executing containment through the connected tools. The buyer maintains access and escalation contacts, agrees action permissions and handles recovery beyond the purchased response scope.
- Your team owns
- Providing access, environment context and tested incident contacts.
- Approving the integration plan and response permissions.
- Business recovery and work outside the selected MDR scope.
Black changes incident response scope
Core provides ongoing monitoring and response. MDR Black is separately sold with included incident response costs for monitored environments. Do not assume the Black package's financial terms apply to Core.
Pricing & contract
- Billing
- Per-endpoint
Truesec describes a fixed service fee based on client computers and servers. Confirm included tools, licenses, retention and the boundary between Core response and additional incident work.
Tradeoffs & buying questions
Strengths
-
The public workflow clearly keeps human analysts responsible for verdicts and response.
-
The onboarding process includes testing communications before service activation.
Considerations
-
A scoped tool and action list is needed before assuming existing coverage transfers.
-
Included incident response costs are a Black package distinction.
Ask before buying
- Which endpoint, network and cloud tools are included in Core, and what changes are required before monitoring starts?
- Which containment actions can analysts take without calling us, and when does a case become separately charged incident response or recovery?
- What does the endpoint-based fee include for licenses, retention and onboarding, and which features require Enterprise or Black?
Common questions
Does agentic MDR mean AI decides how to respond?
Truesec describes AI prioritizing and enriching alerts while analysts validate the findings and determine the response. AI assists execution and documentation. Confirm the permitted action workflow in the service agreement.
Does Core include every Truesec MDR feature?
No. Truesec sells Core, Enterprise and Black, and also describes specialist monitoring modules. Ask for the Core service schedule rather than treating the full portfolio as included.
Company details
- SOC regions
- Europe / UK