Who does what
Provider
- Investigate Elements detections 24/7
- Escalate confirmed incidents
- Run permitted containment and cleanup
Your team
- Deploy sensors and maintain coverage
- Keep contacts available and set permissions
- Handle business impact and out-of-scope recovery
Coverage
- Endpoints
- Identity & Access
Details
Service scope
Best for Teams or MSPs standardizing on WithSecure Elements endpoint security
Endpoint and identity scope
Elements endpoint telemetry is the foundation. Entra ID MDR is an add-on. Broader XDR software features and Elements Infinite are separate scope.
Permission controls
Set defaults and exceptions for workstations, servers and identities. Analysts request approval when response is not preauthorized.
Major incidents
Current service material describes conditional DFIR access. Confirm availability, included hours and activation terms rather than assuming a guaranteed retainer.
Full service analysis
WithSecure Elements Managed Detection and Response investigates endpoint detections 24/7 and performs authorized containment and cleanup. You or your IT partner retain sensor deployment, on-call contacts, permission settings and recovery beyond contracted response.
- Your team owns
- Deploy and maintain Elements endpoint sensors
- Keep designated incident contacts available
- Set response permissions for devices and identities
- Assess business effects of containment and handle out-of-scope recovery
- Agree partner administration, licensing and major-incident terms
Response authority
The administrator guide separates immediate investigation from containment and remediation, which require preauthorization or incident approval. Review the current organization defaults and per-asset exceptions for workstations, servers, users and service principals before activation.
Major-incident terms
The administrator guide describes an included retainer and one prepaid response day. The current service page describes conditional DFIR access subject to availability and a separately available guaranteed retainer. Confirm the signed entitlement, activation process and charges for extended work.
Package and channel
MSP bundle RRPs include one device and one identity and exclude the MSP’s added services. They are not standalone MDR prices or partner wholesale rates. Confirm tenant access, escalation ownership and renewal with the selling partner.
Pricing & contract
- Billing
- Custom
- Onboarding
- Depends on Elements account setup, endpoint sensor deployment, MDR subscription activation and escalation-contact configuration
Request a standalone MDR quote. Published Elements Protect and Proactive bundle RRPs combine device and identity coverage and exclude added MSP services.
Tradeoffs & buying questions
Strengths
-
Documented separation of investigation and response permissions
-
Per-asset exceptions support sensitive servers and identities
-
Fits an existing Elements and IT-partner workflow
Considerations
-
Requires WithSecure endpoint telemetry
-
Identity MDR and broader platform services need separate scope
-
Major-incident DFIR entitlement needs contractual confirmation
Ask before buying
- Which workstation, server and identity actions are preauthorized, and who can change those settings?
- Does our quote include identity MDR, required Elements licenses and guaranteed DFIR access or only conditional escalation?
- For our country, who owns support and renewal, in which language, and where are analysts, endpoint telemetry and case data located?
Integrations
Endpoint
- WithSecure Elements Endpoint Security / EDR
Other integrations
- WithSecure Elements Security Center
- Microsoft Entra ID through MDR for Identities add-on
Common questions
Can WithSecure act without approval?
Analysts investigate without incident-by-incident approval. Containment and cleanup require preauthorization or approval during the incident.
Is identity protection included?
MDR for Identities is an add-on to the endpoint service. Some MSP bundles combine both, so check the named package.
Is major-incident response guaranteed?
The current service page describes conditional DFIR access. Confirm availability, included hours and retainer terms in your contract.
Company details
- Headquarters
- Helsinki, Finland
- Founded
- 1988