XDR providers

Alert Logic's MDR analysts investigate cloud and hybrid alerts, then escalate verified incidents with evidence and recommended actions.

You still own Containment, remediation, connected tools and approval of response workflows

24/7 analysts validate incidents and advise your team. Optional active response needs advance action permissions.

You still own Passive response execution, tool access and system recovery

Arctic Wolf's Aurora MDR investigates alerts and contains threats through configured integrations, supported by a named Concierge Security Team.

You still own Connected tools, response permissions and remediation outside configured containment

Barracuda Managed XDR investigates alerts and automates containment through purchased modules and supported endpoint, email, identity and firewall integrations.

You still own Connected tools, response permissions and remediation outside automated actions

Bitdefender MDR analysts investigate GravityZone alerts and take pre-approved containment actions within your licensed endpoint and XDR coverage.

You still own Response policy, recovery and systems outside licensed GravityZone coverage

Cisco analysts investigate supported XDR components and execute containment allowed by the response playbook.

You still own Component health, response authority, remediation and recovery

Critical Start MDR investigates alerts from your security tools and can contain threats under agreed rules of engagement.

You still own Tool licensing, telemetry coverage, response approvals, remediation and recovery

Falcon Complete analysts investigate, contain and remediate threats through CrowdStrike's Falcon platform under pre-approved playbooks.

You still own Falcon deployment, response approvals, business exceptions and out-of-scope coverage

Dell analysts investigate supported XDR alerts and take pre-approved containment actions such as host isolation and file blocking.

You still own Endpoint coverage, platform access and remediation beyond the contracted response scope

Deloitte investigates and responds through selected enterprise MXDR modules and partner technologies.

You still own Module selection, action permissions and out-of-scope recovery

eSentire MDR investigates and contains threats through supported tools under agreed response rules.

You still own EDR licensing, tool access, response permissions and recovery outside agreed incident support

Heimdal SOC investigation and containment with response permissions set by module.

You still own Module choices, notification-only response and broader recovery

Microsoft analysts investigate Defender incidents and execute permitted containment in MDR Plan 1.

You still own Defender licensing, deployment, access, exclusions and out-of-scope remediation

Guardian xMDR Core combines Cortex monitoring with human investigation and containment playbooks from a Dutch SOC.

You still own Response permissions, source connections and recovery beyond scope

Orange's MDR/XDR analysts investigate threats and take agreed containment actions across supported security tools.

You still own Telemetry sources, response approvals and remediation beyond agreed playbooks

24/7 investigation, authorized containment and endpoint remediation using Vectra and connected tools.

You still own Tool licenses, action permissions and out-of-scope recovery

Adlumin MDR by N-able investigates and contains threats through a shared XDR and SIEM platform. Your team maintains controls and handles work outside the package.

You still own Connected tools, response permissions, escalation rules and work outside the package

BlueVoyant co-manages Microsoft security operations, investigates alerts and responds through agreed rules of engagement.

You still own Platform licensing, data-source coverage, response approvals and business remediation

Cipher analysts investigate around the clock and share detection-rule work and case visibility over existing tools.

You still own Tool administration, business context, permissions and remediation

CyberCX operates Microsoft detections, hunts threats and maintains the managed Sentinel and Defender environment.

You still own Platform and data control, permissions and recovery outside scope

DEFEND investigates alerts and operates Microsoft Sentinel through a shared security operations workflow.

You still own Connected systems, response permissions and approved major incident costs

Shared SOC workflows through the Unified Cyber Platform, with 24/7 investigation and scoped response.

You still own Source access, shared SOC decisions, action permissions and recovery

Ontinue co-manages Sentinel and Defender, investigating alerts and executing approved containment through Microsoft controls.

You still own Microsoft licensing, log sources, response rules and IT remediation

Quorum operates Sentinel health, detections and incidents through containment across scoped Microsoft and third-party sources.

You still own Microsoft licensing, source access, action permissions and recovery