Who does what
Provider
- Investigate alerts through MAXI and analysts
- Escalate with evidence and response options
- Perform approved containment
Your team
- Keep tools and data access working
- Set response authority and approvers
- Handle out-of-scope recovery
Coverage
- Endpoints
- Cloud Workloads
- Identity & Access
- SaaS Applications
Details
Service scope
Best for Small and mid-market teams keeping their existing security tools
AI investigation
Agents collect evidence and challenge verdicts. Current customer connectors are read-only. A human approves containment.
Paid tiers
Standard centers on endpoints. Enhanced extends cloud, SaaS and email coverage. Professional adds co-managed SIEM and SOAR.
Response agreement
Name allowed actions, approvers and response hours. Separate triage, escalation and containment clocks.
Full service analysis
UnderDefense MDR pairs MAXI AI investigation with 24/7 analysts who carry out approved containment across contracted tools. Your team retains tool access, response authority and out-of-scope recovery, while coverage and SIEM work depend on the purchased tier.
- Your team owns
- Maintain connected tools, licenses and data access
- Name human approvers and permitted response actions
- Own business recovery and changes outside the contracted response scope
- Agree tier coverage, partner support and data export terms
Investigation and action are separate
The August 2026 architecture describes agents querying customer systems through read-only connectors, writing incident records and proposing containment. A person approves changes to the environment. Earlier automation material is broader, so agree which actions the SOC executes and which your team must authorize.
Choose the paid service tier
Standard centers on endpoint MDR. Enhanced extends cloud, SaaS and email coverage. Professional adds co-managed SIEM and SOAR work. Free MAXI access is not the paid managed service, and the wider MAXI Compliance platform should not be assumed to be included in full.
Response terms need a precise clock
Public pages use different timing claims for triage, escalation and containment. Treat those as distinct commitments. Specify the event that starts each SLA, coverage hours, approval delays and the incident-response retainer in the signed order.
Channel and tool ownership
UnderDefense markets direct delivery and partner services with white-label and multi-tenant options. The AWS listing combines AWS security and compliance services through private offers. Confirm the seller’s support, administration and renewal duties, plus the rights to export case records.
Pricing & contract
From $11/device/month
annual contract Provider-published starting rate. Plan examples are for organizations with up to 100 employees. Coverage, integrations and additional services can change the quote.
Provider-published starting rate with an annual contract. Plan examples cover up to 100 employees; selected tier, licenses, onboarding and response allowance need a quote.
- Billing
- Per-endpoint, Tiered, Custom
- Minimum term
- 12 months
Tradeoffs & buying questions
Strengths
-
Uses existing security tools
-
Separates AI investigation from human response authority
-
Published starting rate and named MDR tiers
Considerations
-
Cloud, email and managed SIEM scope varies by tier
-
Free MAXI access is not full MDR
-
Response timing and retainer terms require a scoped agreement
Ask before buying
- Who approves host isolation and account actions, who executes them, and what does the response SLA measure?
- Which tier includes our cloud, email, SIEM tuning, paging and incident-response hours, and what changes the starting price?
- Who owns support, tenant access, renewals and case-data export if we buy through a partner?
Customer feedback
Customers value
-
Gartner MDR accounts from 2023–2026 describe responsive support and flexible scope.
-
Gartner and G2 monitoring accounts describe clearer visibility and less alert work; G2 also mixes in other services.
Reported concerns
-
A 2025 Gartner reviewer reported setup-cost, paging and exclusion-review issues
-
A G2 monitoring reviewer described integration setup taking back-and-forth work
-
Some G2 reviews cover penetration testing or other services
Integrations
Platform / SIEM
- Splunk
- Elastic
- Microsoft Sentinel
Endpoint
- CrowdStrike
- Microsoft Defender
- SentinelOne
Cloud
- AWS
- Azure
- Google Cloud
Other integrations
- UnderDefense MAXI
- Slack
- Microsoft Teams
1 more integrations
- Jira / ServiceNow (Professional tier)
Common questions
Can MAXI autonomously contain a threat?
Its current investigation architecture uses read-only customer connectors and proposes containment for human approval. The managed service can execute approved response. Confirm the action and approver matrix.
Does the starting price include managed SIEM?
Managed SIEM and SOAR sit in Professional. Standard centers on endpoint MDR and Enhanced extends coverage. Get the selected tier and response hours in writing.
Does free MAXI access include the 24/7 service?
Free platform access is separate from the paid MDR tiers. Confirm analyst coverage, permitted actions and required tool licenses before relying on it.