Board · 27 providers · rev 2026-11-08

MDR companies, compared on what they publish

Q: What is an MDR provider?

A company that watches your security tools around the clock, investigates what they flag and responds to real threats for you, for example by isolating a laptop or disabling a compromised account. Some run on the endpoint detection and response (EDR) software you already own; others install their own.

Q: Who are the top MDR providers?

This site doesn't rank providers on quality, because no outsider can measure it fairly. It orders them by how much they publish. On November 8, 2026, the 3 that published the most (6 of 6 items) were Field Effect, Huntress, Rapid7.

Q: Will an MDR provider work with the EDR we already have?

16 of the 27 providers here say they run on third-party EDRs, and 11 require their own agent or platform. The EDRs named most often are Microsoft Defender (16), CrowdStrike Falcon (16), SentinelOne (16). The full matrix is on the MDR vs EDR vs XDR page.

Q: Do MDR providers fix the problem or just tell you about it?

26 of the 27 say they contain threats for you (isolating hosts, disabling accounts) as part of the service; 6 say full remediation is included. Ask what the provider may do without calling you first, and what it charges for incident response.

Q: How much does MDR cost?

12 of the 27 providers publish a price, on their own site or on a cloud-marketplace listing they sell themselves. The rest quote on request. Every published figure is on the pricing page, with its unit and source.

Managed detection and response providers, and the facts each one puts in writing: the tools it runs on, what it does for you when something fires, the service levels and prices it states, and its own audits. Linked, dated, unranked.

In brief

Of 27 MDR providers, 16 say they run on third-party EDRs you may already own and 11 require their own agent. 26 say they contain threats for you, 19 state a response time, and only 12 publish a price. The board is ordered by how much each publishes, not by quality.

All 27 providers

One strip per provider. The six lamps show which items of the checklist each one publishes; the board is ordered by how many are lit, then by name. Select a name for the full entry and its sources.

PPriceTToolsRResponseSService levelAAttestationDDemo or sample

MDR providers, ordered by how much they publish
Provider	Tools	Contains for you	Service level stated	Published price	Own attestations	Publishes
M·01 Field EffectMDR fieldeffect.com	Its own stack Own: Field Effect MDR	Yes, stated	Stated medians: 18 s to detect and alert, 2.6 min to investigate	$5 to $25 per user a month, “typically”	SOC 2 · ISO 27001	PTRSAD
M·02 HuntressMDR huntress.com	Its own stack Own: Huntress	Yes, stated + remediation	Stated average: 8-minute mean time to respond	$8.99 per endpoint a month, managed EDR (MSRP)	SOC 2	PTRSAD
M·03 Rapid7EDR vendor rapid7.com	Own stack or yours Own: Rapid7 Insight Agent · 5 other EDRs	Yes, stated	Objective: start investigating critical alerts within 15 minutes	From $73,000 a year, Essential tier from 300 assets (its AWS listing)	SOC 2 · ISO 27001 · ISO 42001 · GovRAMP +3	PTRSAD
M·04 Arctic WolfMDR arcticwolf.com	Own stack or yours Own: Arctic Wolf Aurora (Cyla… · 13 other EDRs	Yes, stated	No figure. FAQ: contacts you “within minutes” of a threat	$44,000 a year, MDR Basic for up to 100 users (its AWS listing)	SOC 2 · ISO 27001	PTRSAD
M·05 Binary DefenseMDR binarydefense.com	Own stack or yours Own: BDVision · 5 other EDRs	Yes, stated	Contractual: critical alerts within 30 minutes, high within 4 hours	$136,842 for 36 months, managed EDR for 5,000 endpoints (its AWS listing)	SOC 2	PTRSAD
M·06 BitdefenderEDR vendor bitdefender.com	Its own stack Own: Bitdefender	Yes, stated	Stated: a call within 30 minutes of an incident	Not published	SOC 2 · ISO 27001 · ISO 27017 · ISO 27018	PTRSAD
M·07 eSentireMDR esentire.com	Own stack or yours Own: Atlas Endpoint Agent / e… · 5 other EDRs	Yes, stated + remediation	Stated average: 15 minutes to contain	$17, $24 or $28 per user a month (10–100 users), plus $2,500 a year	SOC 2 · ISO 27001 · PCI DSS	PTRSAD
M·08 ExpelMDR expel.com	Your tools 13 other EDRs	Yes, stated + remediation	No SLA. Stated averages: 13 min to respond, 14 min to remediate (high and critical)	$88,800 a year for 500 cloud-resource units (its AWS listing)	SOC 2 · ISO 27001 · ISO 27701 · PCI DSS +2	PTRSAD
M·09 Red Canary (Zscaler)MDR Zscaler, Inc. · zscaler.com	Own stack or yours Own: Zscaler MDR Linux EDR · 7 other EDRs	Yes, stated	No SLA. Stated: 2-minute median to acknowledge high-severity threats	$120 per endpoint, 12-month contract (its AWS listing)	SOC 2 · ISO 27001 · ISO 27701	PTRSAD
M·10 SophosEDR vendor sophos.com	Own stack or yours Own: Sophos · 10 other EDRs	Yes, stated	MDR Plus, contractual: respond within 60 minutes for 90% of priority cases	$239.64 a year per unit, workstation MDR (its AWS listing; the unit isn’t…	SOC 2 · ISO 27001 · ISO 27017 · ISO 27018 +4	PTRSAD
M·11 Adlumin (N-able)MDR N-able · n-able.com	Own stack or yours Own: Adlumin Endpoint Agent · 10 other EDRs	Yes, stated	Not stated	$15,575 a year, Premium SMB up to 100 endpoints (its AWS listing)	SOC 2 · ISO 27001	PTRSAD
M·12 Blackpoint CyberMDR blackpointcyber.com	Own stack or yours Own: SNAP Agent · 8 other EDRs	Yes, stated	Stated average: under 15 minutes to contain live threats	Not published	SOC 2	PTRSAD
M·13 BlueVoyantMDR bluevoyant.com	Your tools 4 other EDRs	Not stated	Stated average: under 15 minutes to identify	$73,872 a year, MDR for Splunk; “price will depend on scope” (its AWS listing)	SOC 2 · ISO 27001 · ISO 27701 · Cyber Essentials	PTRSAD
M·14 Critical StartMDR criticalstart.com	Your tools 4 other EDRs	Yes, stated	Contractual: 60-minute mean time to respond, with service credits	Not published	ISO 27001 · SOC 2 · PCI DSS	PTRSAD
M·15 CrowdStrikeEDR vendor crowdstrike.com	Its own stack Own: CrowdStrike Falcon	Yes, stated + remediation	No SLA. Stated median: 1 minute to contain	Not published	SOC 2 · ISO 27001 · ISO 42001 · CSA STAR +7	PTRSAD
M·16 DeepwatchMDR deepwatch.com	Your tools 5 other EDRs	Yes, stated	Not stated	$245,198 a year: MDR with Splunk licensing, 50 GB a day (its AWS listing)	SOC 2 · PCI DSS · ISO 27001 · ISO 42001	PTRSAD
M·17 FortinetEDR vendor fortinet.com	Its own stack Own: Fortinet	Yes, stated	MDR: events handled within 24 hours; SOCaaS: P1 escalation in 15 minutes	Not published	SOC 2 · ISO 27001	PTRSAD
M·18 OntinueMDR ontinue.com	Your tools Microsoft Defender	Yes, stated	Contractual: critical-attack response triggered within 15 minutes, with credits	Not published	ISO 27001 · ISO 27017 · ISO 27018 · SOC 1 +1	PTRSAD
M·19 Palo Alto Networks Unit 42EDR vendor paloaltonetworks.com	Its own stack Own: Palo Alto Cortex	Yes, stated + remediation	Objective, no credits: resolve critical to medium cases in under 60 minutes	Not published	SOC 2 · ISO certifications · ENS High (Spain) · NCSC CIR	PTRSAD
M·20 Secureworks (Sophos Taegis)EDR vendor Sophos · sophos.com	Own stack or yours Own: Sophos · 4 other EDRs	Yes, stated	Contractual: under 60 minutes from case to notification, with credits	Not published	SOC 2 · ISO 27001 · TX-RAMP	PTRSAD
M·21 SentinelOneEDR vendor sentinelone.com	Its own stack Own: SentinelOne	Yes, stated	No SLA. Stated average: 3.3 minutes to detect	Not published	SOC 2 · ISO 27001 · ISO 27017 · ISO 27018 +3	PTRSAD
M·22 Trustwave (LevelBlue)MSSP LevelBlue · levelblue.com	Your tools 3 other EDRs	Yes, stated	MDR Elite: 15-min acknowledge, under 30-min respond (in its SOW)	Not published	ISO 27001 · SOC 2 · PCI DSS · ISO 27701 +2	PTRSAD
M·23 KrollMSSP kroll.com	Its own stack CrowdStrike Falcon	Yes, stated + remediation	Not stated	Not published	CREST · SOC 2	PTRSAD
M·24 Mandiant (Google Cloud)MSSP Google (Alphabet Inc.) · cloud.google.com	Own stack or yours 4 other EDRs	Yes, stated	No response-time SLA; 99.9% portal availability is contractual	Not published	ISO 27001 · SOC 2 · PCI DSS	PTRSAD
M·25 Trend MicroEDR vendor trendaisecurity.com	Its own stack Own: Trend Micro	Yes, stated	Not stated	Not published	SOC 2 · ISO 27001 · ISO 27017 · ISO 20000-1 +6	PTRSAD
M·26 MicrosoftEDR vendor microsoft.com	Its own stack Own: Microsoft Defender	Yes, stated	Not stated	Not published	Not found	PTRSAD
M·27 TodylEDR vendor todyl.com	Its own stack Own: Todyl Endpoint Security	Yes, stated	Not stated	Not published	Not found	PTRSAD

Strip colours: MDR MDR specialist (13) ·EDR vendor EDR vendor’s MDR (11) ·MSSP Security services firm (3). “Not stated” means we looked and the provider’s public pages don’t say. Checked November 8, 2026. Something wrong? Send a correction.

Want a shortlist instead of a board?

Tell us your size, the EDR you already run and what you need covered. We reply by email with the providers on this board that fit, and why.

We only pass your details to a provider if you ask us to.

Get a shortlist

Your tools, or theirs

The first fork in choosing an MDR provider: does it work on the EDR and SIEM you already pay for, or does it bring its own?

6 providers

Your tools

Works on the EDR and SIEM you already run.

ExpelRuns on 13 third-party EDRs
BlueVoyantRuns on 4 third-party EDRs
Critical StartRuns on 4 third-party EDRs
DeepwatchRuns on 5 third-party EDRs
OntinueRuns on 1 third-party EDR
Trustwave (LevelBlue)Runs on 3 third-party EDRs

10 providers

Own stack or yours

Has its own agent, also runs on named third-party EDRs.

Rapid7Own: Rapid7 Insight Agent · Runs on 5 third-party EDRs
Arctic WolfOwn: Arctic Wolf Aurora (Cylance) · Runs on 13 third-party EDRs
Binary DefenseOwn: BDVision · Runs on 5 third-party EDRs
eSentireOwn: Atlas Endpoint Agent / eSentire MDR Agent · Runs on 5 third-party EDRs
Red Canary (Zscaler)Own: Zscaler MDR Linux EDR · Runs on 7 third-party EDRs
SophosOwn: Sophos · Runs on 10 third-party EDRs
Adlumin (N-able)Own: Adlumin Endpoint Agent · Runs on 10 third-party EDRs
Blackpoint CyberOwn: SNAP Agent · Runs on 8 third-party EDRs
Secureworks (Sophos Taegis)Own: Sophos · Runs on 4 third-party EDRs
Mandiant (Google Cloud)Runs on 4 third-party EDRs

11 providers

Its own stack

Deploys its own agent or platform.

Field EffectOwn: Field Effect MDR
HuntressOwn: Huntress
BitdefenderOwn: Bitdefender
CrowdStrikeOwn: CrowdStrike Falcon
FortinetOwn: Fortinet
Palo Alto Networks Unit 42Own: Palo Alto Cortex
SentinelOneOwn: SentinelOne
KrollRuns on 1 third-party EDR
Trend MicroOwn: Trend Micro
MicrosoftOwn: Microsoft Defender
TodylOwn: Todyl Endpoint Security

Which EDR each provider names: the EDR matrix.

Who owns whom

MDR is consolidating. Deals and ownership news since 2023 for the providers on this board, newest first, each linked to its source.

Ontinue
2026-09 · Quorum Cyber signed a definitive agreement to acquire Ontinue; Eterna Growth Partners to be majority investor of the combined company; companies operate independently until closing
Trustwave (LevelBlue)
2026-01 · LevelBlue announced it will acquire Fortra’s Alert Logic MDR, XDR and WAF managed services as part of a partnership with Fortra
Trustwave (LevelBlue)
2025-11 · LevelBlue completed its acquisition of Cybereason; SoftBank Corp., SoftBank Vision Fund 2 and Liberty Strategic Capital became LevelBlue investors
Red Canary (Zscaler)
2025-08 · Zscaler completed its acquisition of Red Canary (announced August 1, 2025); CRN reported the deal at $675 million
Trustwave (LevelBlue)
2025-08 · LevelBlue completed its acquisition of Trustwave
Red Canary (Zscaler)
2025-05 · Zscaler signed a definitive agreement to acquire Red Canary
Trustwave (LevelBlue)
2025-03 · The planned Trustwave-Cybereason merger was scrapped (CRN)
Sophos
2025-02 · Sophos completed its acquisition of Secureworks (about $859 million, all cash)
Adlumin (N-able)
2024-11 · N-able announced that it has acquired Adlumin, Inc. (about $100 million cash at closing plus N-able shares, deferred installments and a possible earn-out)
Trustwave (LevelBlue)
2024-11 · Trustwave and Cybereason announced a definitive merger agreement, expected to close in early 2025
Trustwave (LevelBlue)
2024-01 · MC² Security Fund, an affiliate of The Chertoff Group, completed its acquisition of Trustwave
Ontinue
2023-02 · Launched by Open Systems as its new MDR division

Every provider in detail

The full entry for each provider, in board order: ownership, tools, response, service levels, price, attestations and public proof, each with its source.

MDR specialistM·01

Field Effect

Field Effect MDR (formerly Covalence): MDR Endpoint, MDR Core, MDR Complete · SMEs and the partners (MSPs and VARs) that protect them

Ownership: Private (venture-backed)
HQ, founded: Ottawa, Ontario, Canada
Tools: Its own stack. Deploys its own agent or platform. Own technology: Field Effect MDR platform (formerly Covalence), built in-house: endpoint, network and cloud detection and response, roaming DNS firewall. EDRs named: its own Field Effect MDR. SIEM: Own platform; log retention 90 days on MDR Endpoint and MDR Core, 90 days up to 7 years on MDR Complete (longer options include security-relevant external log data) Source
Response: Automatically blocks malware and tampering on endpoints; isolates affected endpoints automatically or through Field Effect analysts; ‘disrupts and contains threats on your behalf’; DNS firewall blocking. Incident response: Incident response retainer is an optional upgrade on all three packages (‘two flexible incident response retainer packages’) Source
Service level: Median time to block certain attacks: <1 second; median time to detect and alert on threats: 18 seconds; median time for expert-led investigation: 2.6 minutes (a stated average) Source
24/7 human analysts, stated.
Price: Field Effect MDR: $5 to $25 per user per month, “typically”, depending on the solution, number of users and deployment
Attestations: SOC 2 Type II (2026 SOC 2 Type II audit covering Security, Availability and Confidentiality, completed May 2026 (auditor MHM); report available through the Trust Center); ISO 27001 (ISO/IEC 27001:2022; recertification audit completed March 2026 (auditor MHM); certificate available on request)
Demo, sample: Reporting demo videos are part of a ‘full demo series’ that has to be unlocked through a form on https://get.fieldeffect.com/field-effect-mdr-3-min-video-tour. Public demo (Ungated 3-minute walkthrough video of Field Effect MDR; nine further feature demos are gated behind a form.).
MITRE eval: Took part in MITRE ATT&CK Evaluations, Managed Services: menuPass + ALPHV BlackCat (2024). MITRE publishes results, not scores.
Also: Field Effect publishes a typical price range of $5–$25 per user per month and says it does not charge by device, endpoint or data stream.
Three packages (MDR Endpoint, MDR Core, MDR Complete); Endpoint and Core are ‘generally suited for 25 users or less’.
Field Effect says its SOC is staffed almost exclusively by veterans of Five Eyes intelligence agencies and runs a follow-the-sun model. Source

PTRSADChecked 2026-11-08 · 14 sources: fieldeffect.com, fieldeffect.com

MDR specialistM·02

Huntress

Huntress Managed EDR, Managed ITDR and Managed SIEM, run by the Huntress 24/7 AI-centric SOC · Businesses of all sizes, built for SMBs; channel-first (MSPs and resellers), direct purchase possible

Ownership: Private (venture-backed)
HQ, founded: Columbia, Maryland, US · 2015
Tools: Its own stack. Deploys its own agent or platform. Own technology: Huntress Agentic Security Platform: Huntress agent and Managed EDR for Windows, macOS and Linux, Managed ITDR, Managed SIEM, Managed ISPM, Managed ESPM, Managed SAT. Huntress builds its own EDR and sells it only as a managed service. EDRs named: its own Huntress Managed EDR, Microsoft Defender for Endpoint (works alongside it; manages Defender Antivirus). SIEM: Own: Huntress Managed SIEM (priced per data source) Source
Response: SOC contains threats (including host isolation), removes the attacker’s foothold and gives plain-English remediation guidance; ‘stages remediations’ for one-click approval; Managed ITDR includes automated remediation for Microsoft 365 and Google identities. Source
Service level: ‘8-minute MTTR’ (mean time to respond), stated on Huntress’s own Microsoft Marketplace listing for Managed EDR (a stated average) Source
24/7 human analysts, stated.
Price: Managed EDR: $8.99 per endpoint per month
Managed ITDR: $4.80 per licensed identity per month
Managed SIEM: $4.00 per data source per month
Managed ISPM: $4.00 per licensed identity per month
Managed SAT: $2.08 per learner per month
Minimum: Huntress-required minimum of 50 seats per product when buying direct or through a reseller; no Huntress-required minimum when buying through an MSP.
Free trial: ‘the same fully featured version as our paid products, including 24/7 SOC support’; ‘no commitments necessary’
Attestations: SOC 2 Type II (Trust Center lists SOC 2 Type 2 under Compliance; report available on request)
Demo, sample: Public demo (Interactive Storylane tour of the Huntress dashboard, linked from the Managed EDR page; no form shown when opened. Live demos are booked through a form.).
Also: Huntress publishes MSRP list prices; buying direct or through a reseller carries a 50-seat minimum per product, buying through an MSP has no Huntress-required minimum.
Huntress manages Microsoft Defender Antivirus at no additional cost and says Managed EDR works with Defender for Business and Defender for Endpoint.
Huntress reported more than $250 million in ARR and more than 270,000 businesses protected on July 30, 2026. Source

PTRSADChecked 2026-11-08 · 13 sources: huntress.com, huntress.com

EDR vendor’s MDRM·03

Rapid7

Rapid7 MDR: Managed Threat Complete (Essential, Advanced, Ultimate tiers); also sold as Rapid7 MDR for Microsoft and MDR for Enterprise. Legacy MDR Essentials and MDR Elite continue for existing customers. · Organizations across industries and maturity levels, from lean teams needing 24x7 coverage to mature security programs

Ownership: Public (NASDAQ: RPD)
HQ, founded: Boston, Massachusetts, US · 2000
Tools: Own stack or yours. Has its own agent, also runs on named third-party EDRs. Own technology: Rapid7 Insight Agent (EDR), Rapid7 SIEM (InsightIDR) on the Command Platform, InsightVM, InsightConnect (SOAR/Active Response), Velociraptor DFIR, network traffic sensor. EDRs named: its own Rapid7 Insight Agent, CrowdStrike Falcon, Microsoft Defender for Endpoint, Palo Alto Cortex XDR, SentinelOne, Sophos Central. SIEM: Own: Rapid7 SIEM (InsightIDR) included with every Managed Threat Complete tier; unlimited data ingestion, 13 months data retention. Source
Response: Active Response: the SOC contains impacted assets (quarantine) and users (disable) for validated threats, via the Insight Agent or a supported EDR (CrowdStrike Falcon, SentinelOne, Carbon Black Cloud, Microsoft Defender, Cisco Secure Endpoint); forensic collection with the Insight Agent or Velociraptor; remediation and corrective-action recommendations. Incident response: Unlimited incident and breach response included in all Managed Threat Complete tiers; delivered remotely (‘All incident response services will be provided remotely’) Source
Service level: Scope of Service objective for time to begin alert investigation: Critical 15 minutes, High 1 hour, Medium 12 hours, Low 48 hours. Phone call to contacts within 30 minutes of incident identification (Medium/High); kickoff call within 1 hour of notification (High). Inbound urgent requests acknowledged within 2 hours. Separate platform SLA: 99.95% monthly availability with service credits. (a stated claim) Source
24/7 human analysts, stated.
Warranty: Breach Protection Warranty included with Managed Threat Complete Ultimate only: reimbursement of forensic, legal-consultation, notification and PR expenses up to $100,000 (500-4,999 covered endpoints), $500,000 (5,000-10,000) or $1,000,000 (10,001+); endpoints must run the Rapid7 agent; a covered incident must involve exfiltration, destruction or irreversible encryption of data the customer reasonably values above $25,000; Rapid7 may terminate the warranty for convenience. Source
Price: AWS Marketplace, sold by Rapid7: Managed Threat Complete Essential: Starting at 300 assets: $73,000 for 12 months (12 months)
AWS Marketplace, sold by Rapid7: Managed Threat Complete Advanced: Starting at 500 assets: $111,000 for 12 months (12 months)
AWS Marketplace, sold by Rapid7: Managed Threat Complete Ultimate: Starting at 500 assets: $175,000 for 12 months (12 months)
Attestations: SOC 2 Type II (Rapid7 states it undergoes a SOC 2 Type II audit annually; report available via account representative); ISO 27001 (Rapid7’s ISMS is ISO 27001 certified; audited by Schellman); ISO/IEC 42001 (AI management system certified (Schellman); scope includes ‘Agentic AI Workflow for MDR’ and ‘AI Dashboard Summary Card (Managed Detection and Response)’); GovRAMP Authorized (InsightGovCloud platform (vulnerability management, cloud security, automation); announced June 23, 2026; not the MDR service); TX-RAMP (Listed in June 2026 press release as held, ‘applicable to designated products and services’); IRAP (Listed in June 2026 press release as held, ‘applicable to designated products and services’); Cyber Essentials Plus (Listed in June 2026 press release as held, ‘applicable to designated products and services’); InsightGovCloud (InsightPlatform, InsightVM, InsightCloudSec, InsightConnect): FedRAMP Certified, Class C, Rev5 agency path (Department of the Treasury), status since 2025-07-11. The MDR service and InsightIDR are not part of this listing. (not the MDR service)
Demo, sample: Sample report (Public sample MDR incident report (PDF, 14 pages) linked from Rapid7’s MTC documentation; other sample reports (threat briefing, risk scorecard) are linked from the same docs page.). Self-guided MDR product tour exists but sits behind a form (name, company, phone, email): https://www.rapid7.com/product-tours/mdr-technology/.
MITRE eval: Took part in MITRE ATT&CK Evaluations, Managed Services: OilRig (2022). MITRE publishes results, not scores.
Also: Rapid7’s own AWS Marketplace listing prices Managed Threat Complete at $73,000 (Essential, from 300 assets), $111,000 (Advanced, from 500 assets) and $175,000 (Ultimate, from 500 assets) per 12-month contract; its website shows no figures.
The Breach Protection Warranty comes only with MTC Ultimate; limits are $100,000, $500,000 or $1,000,000 depending on covered endpoint count, and it covers forensic, legal-consultation, notification and PR costs only.
Monitoring of third-party EDR and security tools is an add-on for MTC Essential; Advanced includes 2 third-party products and Ultimate 4. Source

NoteIn August 2026 Rapid7’s board approved a restructuring plan including a workforce reduction of approximately 12% (SEC Form 8-K filed 2026-08-10); the filing does not say which teams are affected. Source

PTRSADChecked 2026-11-08 · 23 sources: rapid7.com, rapid7.com

MDR specialistM·04

Arctic Wolf

Aurora Managed Detection and Response (Arctic Wolf MDR); Aurora MDR Connect (MDR tier for MSPs) · Customers of all sizes across a wide range of industries and geographies; sold through channel partners

Ownership: Private (venture-backed)
HQ, founded: Eden Prairie, Minnesota, US · 2012
Tools: Own stack or yours. Has its own agent, also runs on named third-party EDRs. Own technology: Aurora Superintelligence Platform (open XDR architecture), Aurora Agentic SOC, Arctic Wolf Agent, Arctic Wolf Sensors, Aurora Endpoint Security / Aurora Endpoint Defense. EDRs named: its own Aurora Endpoint Defense, Microsoft Defender for Endpoint, CrowdStrike Falcon, SentinelOne, Sophos Intercept X, Palo Alto Cortex XDR, Trend Vision One, Broadcom Carbon Black, Cisco Secure Endpoint, Fortinet FortiEDR, Symantec / Broadcom SES, ESET, Tanium, ThreatDown Nebula, Webroot. SIEM: Own platform (Aurora Superintelligence Platform, open XDR); ingests logs from sensors, cloud log forwarding and syslog; Arctic Wolf says it can ingest any required log source. Source
Response: Active Response (included in the MDR licence) lets Arctic Wolf contain, remove or disconnect threats through the Arctic Wolf Agent and first- and third-party integrations for hosts, identities, email, firewalls (denylist) and URLs; the Concierge Security Team provides remediation guidance. Incident response: Not stated as included in MDR. The MDR page lists incident response (business restoration, severe incident remediation, digital forensics) among what its SOC delivers; Arctic Wolf also sells separate IR retainers (Incident360 Retainer, JumpStart Retainer) Source
Service level: FAQ: ‘When a threat is identified, the Arctic Wolf Security Services Team will contact your organization within minutes and execute your response strategy’ (a stated claim) Source
24/7 human analysts, stated.
Warranty: Arctic Wolf Security Operations Warranty: up to $3 million (USD) for covered security events, offered ‘at no cost’; the amount depends on the Security Operations Bundle and Aurora Endpoint Defense purchased and on subscription term, subject to the warranty terms and conditions. Source
Price: AWS Marketplace, sold by Arctic Wolf: Arctic Wolf Managed Detection and Response (MDR): MDR Basic, monitor up to 100 users: $44,000 for 12 months ($93,685.68 for 24 months, $140,528.52 for 36 months) (12 months)
Attestations: SOC 2 Type II (‘Arctic Wolf has a SOC 2 Type II Report’); ISO 27001 (‘...and is also ISO 27001 certified’)
Demo, sample: Public demo (Public two-part recorded walkthrough of the Arctic Wolf Unified Portal in Arctic Wolf’s help documentation (marked Public). Live demos are by request through a form.).
Also: Arctic Wolf closed its acquisition of BlackBerry’s Cylance endpoint security assets on February 3, 2025.
Arctic Wolf announced the acquisition of exposure assessment company Sevco Security on February 23, 2026.
Aurora MDR Connect, launched September 15, 2026, is an MDR tier built exclusively for MSPs, with 24x7 detection, investigation and pre-authorized response. Source

PTRSADChecked 2026-11-08 · 20 sources: arcticwolf.com, arcticwolf.com

MDR specialistM·05

Binary Defense

Binary Defense Managed Detection and Response (also referenced as MDR, MDR Plus, MDR+, MDR Core); BDVision managed EDR as an add-on · Organizations with or without an existing security team; ‘trusted by hundreds of organizations’

Ownership: Private (growth equity from Invictus Growth Partners, 2022)
2022-11 Closed a $36 million growth equity round led by Invictus Growth Partners, its first institutional funding (previously bootstrapped)
HQ, founded: Stow, Ohio, US
Tools: Own stack or yours. Has its own agent, also runs on named third-party EDRs. Own technology: BDVision (Vision agent, managed EDR with deception and disruption controls); NightBeacon CMD portal and NightBeacon AI analysis engine. EDRs named: Microsoft Defender for Endpoint, SentinelOne, CrowdStrike Falcon, Palo Alto Cortex XDR, Broadcom Carbon Black, its own BDVision. SIEM: Works in the customer’s SIEM; supported platforms listed: Microsoft Sentinel, Sumo Logic, Palo Alto Networks XSIAM, CrowdStrike NG-SIEM, Google SecOps, Devo, USMA, Splunk. Delivered through Binary Defense’s NightBeacon CMD portal. Source
Response: Host isolation and account lockout; the site also lists disabling users, isolating endpoints and killing malicious processes, with guided remediation playbooks for the customer. Incident response: Analysis on Demand (incident response and forensics) is part of the MDR bundle in the hours quoted (annual, no rollover); the AoD team works Monday-Friday 9am-5pm ET; remote only, onsite IR excluded. Source
Service level: Detection and Escalation SLA: respond to Critical (P1) alerts within 30 minutes and High (P2) alerts within 4 hours of detection; 95% compliance commitment measured over a rolling three months; service credits up to 5% of the quarter’s fees. ‘Respond’ means assigning an analyst, starting investigation and directing notification to the client. (contractual) Source
24/7 human analysts, stated.
Price: AWS Marketplace, sold by Binary Defense: BDVision (managed EDR, an add-on to its MDR): 5,000 endpoints: $136,842.11 for 36 months (36 months)
Attestations: SOC 2 Type II (Binary Defense offers a SOC 2 Type II report on request (form))
Demo, sample: Live NightBeacon CMD demo with a synthetic incident is available only after a request form (name, company, email, phone); a private link is sent after review: https://live-demo.nightbeacon.binarydefense.com/live-demo.
Also: Contractual SLA: Critical (P1) alerts within 30 minutes and High (P2) within 4 hours of detection, with a 95% compliance commitment; credits are capped at 5% of the quarter’s fees.
Remediation beyond host isolation and account lockout is excluded from the MDR service, as is onsite incident response.
Incident response hours (Analysis on Demand) come with the MDR bundle as quoted, but that team works Monday-Friday 9am-5pm ET. Source

PTRSADChecked 2026-11-08 · 26 sources: binarydefense.com, binarydefense.nyc3.digitaloceanspaces.com

EDR vendor’s MDRM·06

Bitdefender

Bitdefender Managed Detection and Response (MDR), Bitdefender MDR PLUS; Managed Detection and Response for MSPs · Medium-to-large businesses; managed service providers through MDR for MSPs

HQ, founded: Bucharest, Romania (US office: San Antonio, Texas) · 2001
Tools: Its own stack. Deploys its own agent or platform. Own technology: Bitdefender GravityZone; the MDR service includes GravityZone Business Security Enterprise, with XDR sensors as add-ons. EDRs named: its own Bitdefender GravityZone. SIEM: Own platform: Bitdefender GravityZone. Source
Response: Analysts contain and mitigate threats using pre-approved actions (PAAs); root-cause and impact analysis with after-action reports; 72 hours of enhanced monitoring after an incident; recommendations and corrective actions. Source
Service level: If a security incident occurs, a security account manager will call the customer’s emergency contact within 30 minutes and stay in contact throughout the incident (a stated claim) Source
24/7 human analysts, stated.
Warranty: Included at no extra cost, through Cysurance. MDR: up to $100,000 for ransomware events only. MDR PLUS (and MDR customers with 1,000+ endpoints): up to $1,000,000 in total (ransomware and BEC $200,000; compliance $200,000; cyber legal liability $500,000; business income $100,000 with a $2,500 deductible). One valid claim per year; pre-existing incidents not covered; customer must accept Cysurance’s terms; not available on the monthly MSP services (MDR Foundations for MSP, GravityZone SecurePlus, SecureExtra) Source
Price: Not published.
Attestations: SOC 2 Type 2 (Annual audit covering Security, Confidentiality and Availability; first page public, full report on request); ISO/IEC 27001 (Certificate linked from the certifications page); ISO/IEC 27017 (Certificate linked from the certifications page); ISO/IEC 27018 (Certificate linked from the certifications page)
Demo, sample: Public demo (Public interactive guided tour of the MDR Portal (Storylane), linked from the MDR page).
MITRE eval: Took part in MITRE ATT&CK Evaluations, Managed Services: OilRig (2022); menuPass + ALPHV BlackCat (2024). MITRE publishes results, not scores.
Also: The MDR service includes the GravityZone Business Security Enterprise platform; Bitdefender says it owns the whole platform.
A breach warranty comes at no extra cost: up to $100,000 (ransomware only) with MDR, and up to $1,000,000 with MDR PLUS.
SOCs in Texas, Romania and Singapore run follow-the-sun shifts; EU customers can opt into sovereign MDR delivered only from the EU. Source

PTRSADChecked 2026-11-08 · 14 sources: bitdefender.com, bitdefender.com

MDR specialistM·07

eSentire

eSentire MDR (Atlas Professional, Atlas Enhanced and Atlas Elite packages) · 2,000+ organizations in 80+ countries across 35 industries; online packages cover 10-250 users, larger or regulated environments are scoped by sales

Ownership: Private; Warburg Pincus made a growth equity investment in 2017
2017-08 Funds affiliated with Warburg Pincus made a significant equity investment in eSentire (terms not disclosed)
HQ, founded: Waterloo, Ontario, Canada · 2001
Tools: Own stack or yours. Has its own agent, also runs on named third-party EDRs. Own technology: Atlas Platform (Atlas AI, Atlas SIEM, Atlas Operations Center) and the Atlas Endpoint Agent / eSentire MDR Agent, deployed alongside the customer’s EDR. EDRs named: CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint, Palo Alto Cortex XDR, Broadcom Carbon Black, Deep Instinct, its own Atlas Endpoint Agent / eSentire MDR Agent, Bitdefender (telemetry & investigation only), Sophos (telemetry & investigation only), Trend Micro (telemetry & investigation only), Trellix (telemetry & investigation only), Symantec (telemetry & investigation only), Cybereason (telemetry & investigation only), ESET (telemetry & investigation only), BlackBerry (telemetry & investigation only), Tanium (telemetry & investigation only), Jamf Protect (telemetry & investigation only), Malwarebytes (telemetry & investigation only), McAfee (telemetry & investigation only). SIEM: Own Atlas SIEM (log detection; 90-day retention in Atlas Enhanced, 365-day in Atlas Elite). Also works with Microsoft Sentinel, Splunk and Sumo Logic (telemetry, investigation and response) and IBM QRadar, Exabeam, Alert Logic and others (telemetry and investigation). Source
Response: Host isolation, user and identity suspension, TCP disruption, file quarantine, process termination, removal of service and registry keys, system reboots, retroactive organization-wide email purges, blocking compromised email accounts, correcting critical cloud misconfigurations, blocking communication with known bad actors. Incident response: SOC incident response (detect, analyze, contain, assist recovery) is in every Atlas package. The Digital Forensics & Incident Response retainer is included only in Atlas Elite; otherwise DFIR is sold as IR Readiness, Incident Response Retainer or Emergency Incident Response. Source
Service level: MDR figures: 15-minute mean time to contain; mean time to engage a signal 30 seconds; under 5 minutes from signal to full threat context. Incident Response Retainer: respond and engage within one hour, with a stated threat suppression guarantee. (a stated average) Source
24/7 human analysts, stated.
Warranty: ‘Threat suppression guarantee’ with the Incident Response Retainer: ‘We respond and engage within one hour, guaranteeing threat suppression’, with unlimited incident response. No dollar warranty stated. Source
Price: Atlas Professional: $17.00 per user per month (up to 100 users; $16.15 for 101–250)
Atlas Enhanced: $24.00 per user per month (up to 100 users; $22.80 for 101–250)
Atlas Elite: $28.00 per user per month (up to 100 users; $26.60 for 101–250)
Launch & Optimization fee: $2,500 per package per year, whatever the user count
Minimum: 10 users.
Attestations: SOC 2 Type II (Separate reports for MDR services and for DF/IR services, period December 1, 2024 to November 30, 2025); ISO/IEC 27001:2022 (Certificate of registration listed on the trust center); PCI DSS 4.0 (service provider) (Attestation of Compliance for eSentire XDR Services)
Demo, sample: No public product demo found; the SOC page has short SOC videos, and demos/quotes go through ‘Get Started’..
Also: Publishes per-user prices on its own shop: $17-$28 per user per month for 10-250 users, billed annually, plus a $2,500 yearly launch fee per package.
The full digital forensics and incident response retainer is included only in the top Atlas Elite package.
Runs two SOCs, in Waterloo (Canada) and Cork (Ireland). Source

PTRSADChecked 2026-11-08 · 15 sources: esentire.com, shop.esentire.com

MDR specialistM·08

Expel

Expel Managed Detection and Response (MDR) · Organizations from under 100 seats to more than 10,000 seats; sells to organizations only

Ownership: Private (venture-backed)
HQ, founded: Herndon, Virginia, US · 2016
Tools: Your tools. Works on the EDR and SIEM you already run. Own technology: Expel Workbench (operations platform) and Ruxie (AI SOC manager); no agent to deploy. EDRs named: CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne, Broadcom Carbon Black, Cisco Secure Endpoint, Cybereason, Elastic, Trellix, Symantec / Broadcom SES, Palo Alto Cortex XDR, Trend Micro Apex One, Tanium XEM Core, Arctic Wolf Aurora Endpoint Security (CylanceENDPOINT). SIEM: No SIEM required (Workbench is not a SIEM). Ingests from the customer’s SIEM: Splunk, Microsoft Sentinel, Google Security Operations, Sumo Logic Cloud SIEM, CrowdStrike Falcon Next-Gen SIEM and LogScale, IBM QRadar, Exabeam, Securonix, LogRhythm, Devo, Palo Alto Networks Cortex XSIAM. Can license a SIEM / security data lake built on Sumo Logic. Managed SIEM add-on covers Splunk Enterprise Security and Microsoft Sentinel. Source
Response: After an analyst validates an incident, Expel runs remediation actions under rules the customer sets in advance: kill process, contain host, block file hash, delete malicious file, delete registry key, disable user account, disable cloud access key, reset credentials, remove malicious email. Incident response: Not included. Expel says it is not an incident response retainer: large-scale breach response, forensic imaging, legal support and litigation-grade evidence handling are outside the service (IR retainers and forensics engagements are listed as out of scope). Source
Service level: No SLA published: ‘Expel publishes no service level agreement (SLA). The figures above are historical performance, not contractual commitment.’ Published figures: mean time to remediate 14 minutes and mean time to respond 13 minutes (high/critical incidents with automated remediation); median time to detect 2.41 minutes (all alerts); mean time to touch 5.13 minutes. The MDR page FAQ also says ‘under 15 minutes’. (a stated average) Source
24/7 human analysts, stated.
Price: AWS Marketplace, sold by Expel: Expel Managed Detection and Response (MDR): Cloud infrastructure: By resources, Unit = 500, 1-year contract, paid upfront: $88,800.00 per 12 months. 24- and 36-month contract tabs also shown. No refunds. (12 months)
Attestations: SOC 2 Type II (Security trust services criterion; Expel says zero exceptions in every report since 2018; report and bridge letter available under NDA via its Trust Center); ISO/IEC 27001:2022 (Listed as an active certification); ISO/IEC 27701:2019 (Listed as an active certification); PCI DSS SAQ-D (Self-assessment questionnaire D, as listed); CSA STAR Level 1 (Level 1 (self-assessment), as listed); NIST SP 800-171 Rev. 2 (Independent assessment; assessor report available under NDA)
Demo, sample: A 10-minute on-demand demo video sits behind a contact form at https://expel.com/on-demand-mdr-demo/; live group demos need registration..
Also: Expel states it publishes no SLA; its 14-minute mean time to remediate (high/critical incidents with automated remediation) is a historical average, not a contractual commitment.
No agent: Expel connects to the customer’s existing tools by API and lists 160+ integrations.
Sold as Starter, Select and Premium packages; its own AWS Marketplace listing prices 500 cloud-infrastructure units at $88,800 for 12 months. Source

PTRSADChecked 2026-11-08 · 13 sources: expel.com, expel.com

MDR specialistM·09

Red Canary (Zscaler)

Zscaler Managed Detection & Response (MDR), formerly Red Canary MDR · Organizations of all sizes (Red Canary’s words when the acquisition was announced)

Ownership: Owned by Zscaler (NASDAQ: ZS) since August 2025
2025-05 Zscaler signed a definitive agreement to acquire Red Canary
2025-08 Zscaler completed its acquisition of Red Canary (announced August 1, 2025); CRN reported the deal at $675 million
HQ, founded: San Jose, California, US (parent Zscaler’s headquarters)
Tools: Own stack or yours. Has its own agent, also runs on named third-party EDRs. Own technology: Zscaler MDR platform and portal (AI agents, playbooks), Zscaler MDR Linux EDR sensor (formerly Red Canary Linux EDR), Security Data Lake. EDRs named: Microsoft Defender for Endpoint, CrowdStrike Falcon, SentinelOne, Palo Alto Cortex XDR, Trend Vision One, Broadcom Carbon Black, Jamf Pro/Protect, its own Zscaler MDR Linux EDR. SIEM: Not a SIEM-based service. Sends MDR alerts to the customer’s SIEM, SOAR or ITSM; its Microsoft listing says it takes Microsoft Sentinel incidents. Offers its own Security Data Lake for log storage. Source
Response: Automated playbooks isolate endpoints through the EDR, block URLs and IOCs through Zscaler Internet Access and suspend users through the identity provider; the customer can automate these or require approval. Response recommendations cover containment, eradication and hardening. Hands-on-keyboard remediation is the paid Active Remediation add-on. Source
Service level: No published SLA: the docs say Active Remediation ‘has no publicly shareable Service Level Agreements (SLAs) or Objectives (SLOs)’. A Red Canary page states its response engineers’ ‘median time to acknowledge high-severity threats is just 2 minutes’. (a stated average) Source
24/7 human analysts, stated.
Price: AWS Marketplace, sold by Red Canary: Red Canary Managed Detection and Response: 12-month contract: Endpoint $120.00 (overage $10.00/unit); Account $100.00 (overage $8.33/unit); Resource $250.00 (overage $20.83/unit); Network $20.00 (overage $1.66/unit). 24-month (‘save up to 50%’) and 36-month (‘save up to 67%’) tabs shown. No refunds. (12 months)
Attestations: SOC 2 Type II (Badge on the Zscaler MDR (Red Canary) Trust Center, which says it is being consolidated into compliance.zscaler.com); ISO/IEC 27001 (Badge on the Zscaler MDR (Red Canary) Trust Center); ISO/IEC 27701 (Badge on the Zscaler MDR (Red Canary) Trust Center)
Demo, sample: Demo by request form on the Zscaler MDR page. The page also embeds ungated 24-29 minute ‘Zscaler MDR experts explain...’ videos; these are expert sessions, not product demos..
MITRE eval: Took part in MITRE ATT&CK Evaluations, Managed Services: OilRig (2022). MITRE publishes results, not scores.
Also: Zscaler completed its acquisition of Red Canary on August 1, 2025; redcanary.com now redirects to Zscaler’s MDR page and the docs say ‘Red Canary is now Zscaler MDR’.
Licensed per endpoint; usage is reviewed every three months and overages are trued up.
Hands-on-keyboard remediation (Active Remediation) is an annual add-on, available for Windows and macOS but not Linux. Source

PTRSADChecked 2026-11-08 · 19 sources: zscaler.com, zscaler.com

EDR vendor’s MDRM·10

Sophos

Sophos Managed Detection and Response: Sophos MDR and Sophos MDR Plus (MDR Plus formerly MDR Complete) · Organizations of all sizes and security maturity, “from small and mid-sized organizations to complex enterprises”; also MSPs and MSSPs

Ownership: Private equity: owned by Thoma Bravo since March 2020
2020-03 Thoma Bravo completed its take-private acquisition of Sophos (valued at about $3.9 billion); Sophos shares ceased trading on the London Stock Exchange
2025-02 Sophos completed its acquisition of Secureworks (about $859 million, all cash)
HQ, founded: Oxford, UK
Tools: Own stack or yours. Has its own agent, also runs on named third-party EDRs. Own technology: Sophos Endpoint (Intercept X) with XDR, included with Sophos MDR; Sophos Fusion platform; Sophos Email Monitoring System (included). EDRs named: its own Sophos Intercept X (Sophos Endpoint with XDR), Microsoft Defender for Endpoint, CrowdStrike Falcon, SentinelOne, Palo Alto Cortex XDR, Trend Vision One, Broadcom Carbon Black, Symantec / Broadcom SES, Cisco Secure Endpoint, Trellix, BlackBerry CylanceOPTICS. SIEM: Own: Sophos Fusion / Sophos Data Lake, ingesting alerts and telemetry from integrated Sophos and third-party products. Source
Response: Depends on the customer’s Threat Response Mode (Authorize, Collaborate, Collaborate then Authorize, Notify Only): host isolation, process termination, quarantine or deletion of malicious artifacts, blocking indicators, disabling users, revoking sessions, configuration changes; on agentless third-party endpoints only host isolation and un-isolation. Incident response: Sophos MDR tier: Sophos contains and escalates, and the customer carries out “the full incident response and threat neutralization”. Sophos MDR Plus: remote incident response on endpoints running Sophos XDR with an assigned Incident Response Advisor, no hourly caps; excludes system restoration or recovery, disk forensics, ransomware negotiation and on-site work. Source
Service level: MDR Plus SLA: Time to Respond within 60 minutes for 90% of Priority (high/critical) Investigations, measured monthly from 60 days after purchase; missed if failed in more than three months of a rolling 12; service credit = lesser of 5% of the prior billing cycle’s fees or $5,000. Both tiers also have non-binding targets: case creation within 2 minutes of detection ingestion, initial action within 30 minutes of case creation. Sophos also states an 89-second average from alert to automated response. (contractual) Source
24/7 human analysts, stated.
Warranty: Breach Protection Warranty, MDR Plus only, at no extra charge: up to $1,000 per license or per breached endpoint (whichever is lower), capped at $1,000,000 per year; ransom payments capped at $100,000 per claim; minimum $5,000 out-of-pocket expenses. Covers ransomware causing irretrievable data loss. Requires a 12-month subscription (no cover in the first 60 days), Threat Response Mode “Authorize” or “Collaborate with authorize”, Account Health Check score of 100, and patching within set windows (critical CVEs within 7 days). Direct-customer warranty excludes MSPs; a separate MSP warranty covers MDR Plus sold by authorized MSPs. Source
Price: AWS Marketplace, sold by Sophos: Sophos MDR - Endpoint (user workstations, with XDR tools): $239.64 per unit for 12 months; the listing doesn’t define the unit or the MDR tier (12 months)
AWS Marketplace, sold by Sophos: Cloud Workload MDR (server operating systems, with XDR tools): $390.72 per unit for 12 months; the listing doesn’t define the unit or the MDR tier (12 months)
Attestations: SOC 2 (Report available under NDA on request (type not stated on the page)); ISO/IEC 27001:2022 (Certificate and Statement of Applicability published); ISO/IEC 27017:2015 (Certificate published); ISO/IEC 27018:2019 (Certificate published); CSA STAR Level 1 (Self-assessment listed in CSA STAR registry); TX-RAMP (Sophos Cloud certificate (a separate Taegis MDR certificate is also listed)); PCI DSS (Report available under NDA on request); BSI C5 (Report available under NDA on request)
Demo, sample: No sample MDR report found. Sophos publishes “MDR threat cases” (write-ups of real incidents handled by Sophos MDR) at https://www.sophos.com/en-us/resources/type/mdr-threat-cases. No public product demo found; pricing and expert consultation via forms at https://www.sophos.com/en-us/products/managed-detection-and-response/get-pricing and https://www.sophos.com/en-us/services/managed-detection-and-response.
MITRE eval: Took part in MITRE ATT&CK Evaluations, Managed Services: OilRig (2022); menuPass + ALPHV BlackCat (2024). MITRE publishes results, not scores.
Also: Sophos MDR works with third-party endpoint products; on agentless third-party endpoints Sophos’s response actions are limited to host isolation and un-isolation.
The contractual SLA, the incident response team and the $1M breach protection warranty come only with the MDR Plus tier.
The customer chooses how much Sophos may do: Authorize, Collaborate, Collaborate then Authorize, or Notify Only. Source

PTRSADChecked 2026-11-08 · 26 sources: sophos.com, assets.sophos.com

MDR specialistM·11

Adlumin (N-able)

Adlumin MDR (N-able Adlumin Security Operations): Managed ITDR, MDR Standard, MDR Advanced · MSPs and internal IT teams of organizations of all sizes

Ownership: Owned by N-able (NYSE: NABL) since November 2024
2024-11 N-able announced that it has acquired Adlumin, Inc. (about $100 million cash at closing plus N-able shares, deferred installments and a possible earn-out)
HQ, founded: Burlington, Massachusetts, US (N-able headquarters)
Tools: Own stack or yours. Has its own agent, also runs on named third-party EDRs. Own technology: Adlumin XDR platform (built-in SIEM, SOAR and UEBA) and the Adlumin Endpoint Agent. EDRs named: its own Adlumin Endpoint Agent, CrowdStrike Falcon, SentinelOne, Sophos Intercept X, Bitdefender GravityZone, Broadcom Carbon Black, Cisco Secure Endpoint, ESET, Trend Micro, Palo Alto Cortex XDR, Cylance, WithSecure, Webroot. SIEM: Own: Adlumin XDR platform with built-in SIEM (Managed ITDR tier limited to Microsoft data); data retention 30 days (Managed ITDR, MDR Standard) or 90 days (MDR Advanced) Source
Response: ‘Adlumin analysts handle initial threat containment and response’; playbooks ‘isolate endpoints, disable user accounts, enforce password resets, and more’; auto-contains endpoints in case of ransomware, malware or lateral movement. Incident response: MDR covers initial containment and response; Adlumin Incident Response (an ‘incident response subscription’ with a ‘24/7 dedicated response team’) is listed as an add-on for IT departments. Source
Service level: No response time stated
24/7 human analysts, stated.
Warranty: Two programs are published: (1) ‘Adlumin Protect Warranty’, ‘up to $500,000 reimbursement’, included with the Adlumin Protection Plus suite at no additional cost; (2) N-able Cyber Warranty Program (announced Nov 12, 2025): ‘$100,000 cyber warranty for each protected entity’ for MSP customers using Adlumin MDR Advanced, conditional on best practices such as MFA, patching and regular backups. Source
Price: AWS Marketplace, sold by Adlumin: Cloud-Native MDR Platform plus Risk Management and Security Services: 12-month contract; dimension ‘Adlumin Premium SMB – Support for up to 100 endpoints and devices’: $15,575.00. Vendor refund policy: ‘No Refunds’. (12 months)
Attestations: SOC 2 Type II (N-able Trust Center lists an ‘N-able-Adlumin 2026 SOC 2 Type 2 Report’ (gated download)); ISO 27001 (N-able ISO 27001 certificate issued by Schellman (certificate 1766689-4, gated download); public page does not say whether the scope covers Adlumin)
Demo, sample: Demo booking form at https://www.n-able.com/products/adlumin/demo; the ‘Take a tour’ button on the Adlumin page has no linkable URL..
Also: Adlumin is now sold by N-able as Adlumin Security Operations (MDR and XDR); adlumin.com redirects to n-able.com.
Three tiers: Managed ITDR, MDR Standard and MDR Advanced, with 30, 30 and 90 days of data retention.
N-able’s Cyber Warranty Program (Nov 12, 2025) offers $100,000 per protected entity to MSP customers on Adlumin MDR Advanced, subject to best-practice conditions. Source

PTRSADChecked 2026-11-08 · 14 sources: n-able.com, n-able.com

MDR specialistM·12

Blackpoint Cyber

Blackpoint MDR (CompassOne MDR), including Managed EDR and Cloud MDR · MSPs (MDR ‘purpose-built for the MSP channel’) and in-house IT teams

Ownership: Private (growth investment from Bain Capital Tech Opportunities and Accel)
HQ, founded: Denver, Colorado, US · 2014
Tools: Own stack or yours. Has its own agent, also runs on named third-party EDRs. Own technology: CompassOne platform; SNAP Agent (Blackpoint’s EDR agent); Cloud MDR; ITDR; LogIC compliance logging. EDRs named: its own SNAP Agent, CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint, Sophos Intercept X, Bitdefender GravityZone, WatchGuard, Webroot, Malwarebytes, Arctic Wolf Aurora Endpoint. SIEM: Own: CompassOne LogIC, described as a ‘SIEM alternative’ for compliance logging with 365 days of retention. Source
Response: Analysts isolate endpoints and terminate malicious processes (on Blackpoint’s agent or a supported third-party EDR), disable compromised identities in Microsoft 365, Cisco Duo and Google Workspace, and act before alerting the partner. Incident response: FAQ: MDR packages include ‘prioritized, human-led incident response’; no retainer hours stated. Source
Service level: ‘<15 min’ average time to contain live threats (a stated average) Source
24/7 human analysts, stated.
Price: Not published.
Free trial with ‘Full platform access from day one’; ‘No credit card, no strings attached’
Attestations: SOC 2 Type II (‘We undergo an annual SOC 2 Type 2 external audit’; report available on request under a mutual NDA)
Demo, sample: Live demos only, by registration (CompassOne Demo Series) or request form: https://blackpointcyber.com/compassone-demo-series/.
Also: Blackpoint says it was founded in 2014 by former NSA cyber operations experts.
Managed EDR works on Blackpoint’s own agent or on third-party EDRs including CrowdStrike, SentinelOne, Microsoft Defender for Endpoint and Sophos.
Cloud MDR covers Microsoft 365, Cisco Duo and Google Workspace and can disable compromised identities. Source

PTRSADChecked 2026-11-08 · 24 sources: blackpointcyber.com, blackpointcyber.com

MDR specialistM·13

BlueVoyant

BlueVoyant Managed Detection & Response: MDR for Microsoft (Defender XDR and/or Sentinel), MDR for Cisco XDR, MDR / MXDR for Splunk · Companies and government entities, including Fortune 500 companies and critical infrastructure providers

Ownership: Private
HQ, founded: New York, New York, US · 2017
Tools: Your tools. Works on the EDR and SIEM you already run. Own technology: BlueVoyant Cyber Defense Platform (client portal) and BlueVoyant AI; no proprietary EDR agent. EDRs named: Microsoft Defender for Endpoint, CrowdStrike Falcon, SentinelOne, Cisco Secure Endpoint. SIEM: Works in the customer’s Microsoft Sentinel or Splunk (MDR for Splunk); also Cisco XDR. Source
Response: Automated response playbooks run by agents; SOC analyst response for incidents without a playbook; ‘live response’ by SOC analysts (Cisco XDR brief) Incident response: Digital Forensics and Incident Response (DFIR) retainer sold as an add-on for incidents beyond the standard MDR scope. Source
Service level: ‘< 15-minute MTTI’ (mean time to identify) from 24x7x365 monitoring (MDR for Cisco XDR brief) (a stated average) Source
24/7 human analysts, stated.
Price: AWS Marketplace, sold by BlueVoyant: MDR for Splunk Enterprise: $73,872 for 12 months ($147,744 for 24, $221,616 for 36); the listing adds “Price will depend on scope” (12 months)
Attestations: SOC 2 Type II (SOC 2 Type 2 Report (December 2025) and bridge letter in trust center (access on request)); ISO 27001:2022 (Certificate dated July 2026 in trust center); ISO 27701:2019 (Certificate dated July 2026 in trust center); UK Cyber Essentials Plus (Certificate dated September 2026 in trust center); Supply Chain Command (BlueVoyant Government Services): FedRAMP In Process, Class C, since 2026-10-29. This is a supply-chain risk product, not the MDR service. (not the MDR service)
Demo, sample: Demo by request form: https://www.bluevoyant.com/request-a-demo.
MITRE eval: Took part in MITRE ATT&CK Evaluations, Managed Services: OilRig (2022). MITRE publishes results, not scores.
Also: BlueVoyant’s own AWS Marketplace listing for MDR for Splunk Enterprise shows $73,872 for 12 months, but says the price depends on scope.
Its Cisco XDR service supports Cisco Secure Endpoint, CrowdStrike Falcon, SentinelOne and Microsoft Defender for Endpoint.
It states a mean time to identify under 15 minutes; this is an average, not a contractual SLA. Source

PTRSADChecked 2026-11-08 · 16 sources: bluevoyant.com, bluevoyant.com

MDR specialistM·14

Critical Start

Critical Start Managed Detection and Response (MDR), in Essentials, Enterprise and Signature tiers · Enterprises; it names financial services firms, healthcare systems, manufacturers and utilities

Ownership: Private (backed by Vista Equity Partners, which made a $215M+ strategic growth investment in 2022)
2022-04 Critical Start announced a strategic growth investment of over $215 million from Vista Equity Partners
HQ, founded: Plano, Texas, US · 2012
Tools: Your tools. Works on the EDR and SIEM you already run. Own technology: CORR platform, Trusted Behavior Registry (TBR), SOC AI agents, MobileSOC app, Security Data Lake; no proprietary agent. EDRs named: CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne, Palo Alto Cortex XDR. SIEM: Microsoft Sentinel, Splunk, Sumo Logic and CrowdStrike Falcon Next-Gen SIEM (monitoring), plus Microsoft Defender XDR; own Security Data Lake; Managed SIEM is a separate service. Source
Response: Analysts act in the customer’s own tools through 30+ bidirectional integrations: isolate host, block file hash, forensic capture (endpoint); reset password, disable account, re-initiate MFA (identity); quarantine or delete email, block sender (email); block IP (firewalls). Can notify the customer before acting if preferred. Incident response: Not included in the MDR tiers: incident response is listed as an add-on for every tier, and IR retainers are sold separately (unused retainer hours convert to service credits at 3 hours per credit). Source
Service level: Contractual: mean time to respond 60 minutes (monthly average, all tiers); per-alert time to respond 60 minutes for critical and high alerts (Signature tier only); optional 10-minute time to notify; 98% monthly average platform availability. Credits: 10% per missed per-alert TTR/TTN, 10% when the monthly MTTR is missed, 50% if monthly availability falls below 98%. Response time runs from alert ingestion in CORR to the analyst’s documented disposition, 24/7/365. Covers alerts classed as Threat, Mitigated Threat and Control Validation. Also states averages: 5-minute threat detection, 13-minute alert-to-verdict. (contractual) Source
24/7 human analysts, stated.
Price: Not published.
Attestations: ISO/IEC 27001 (ISO 27001 certification and 2025 ISMS documents listed on the trust center (access on request)); SOC 2 (SOC 2 report listed on the trust center (access on request); report type not stated there); PCI DSS (PCI DSS report and responsibility matrices listed on the trust center (access on request))
Demo, sample: Demo by request form at https://www.criticalstart.com/demo; the demo includes a walkthrough of the SLA contract language..
MITRE eval: Took part in MITRE ATT&CK Evaluations, Managed Services: OilRig (2022). MITRE publishes results, not scores.
Also: Publishes contractual SLAs with service credits: 60-minute mean time to respond on all tiers, a 60-minute per-alert response for critical and high alerts on the Signature tier, and credits of 10% to 50%.
The response-time clock runs from alert ingestion to the analyst’s documented disposition, 24/7/365.
No proprietary agent: 30+ bidirectional integrations let analysts act inside the customer’s own tools, such as isolating a host in CrowdStrike or disabling an account in Entra ID. Source

PTRSADChecked 2026-11-08 · 16 sources: criticalstart.com, criticalstart.com

EDR vendor’s MDRM·15

CrowdStrike

CrowdStrike Falcon Complete (marketed as “Agentic MDR” since March 2026; formerly Falcon Complete Next-Gen MDR) · Companies that may lack the resources or expertise to deliver enterprise-level security on their own; also resold by service providers

Ownership: Public (NASDAQ: CRWD)
HQ, founded: Austin, Texas, US · 2011
Tools: Its own stack. Deploys its own agent or platform. Own technology: CrowdStrike Falcon platform and sensor; Falcon Next-Gen SIEM; Falcon Identity Threat Protection; Falcon Shield (SaaS); Falcon Guardian (AI agents); Falcon Adversary OverWatch threat hunting. EDRs named: its own CrowdStrike Falcon (Falcon Insight XDR). SIEM: Own: Falcon Next-Gen SIEM (Falcon Complete offers detection and response for third-party data from Next-Gen SIEM); no third-party EDR support stated. Source
Response: Analysts contain threats using response playbooks and deliver “full-cycle remediation on your behalf” to “restore your environment to a known-good state”; 24/7 managed remediation. Source
Service level: No contractual SLA published. CrowdStrike states “1 min Median time-to-contain (MTTC)”, measured from initial detection to containment on an endpoint; “actual results may vary”. (a stated average) Source
24/7 human analysts, stated.
Warranty: Falcon Complete Warranty, included with an active Falcon Complete subscription: up to $1 million for customers with EDR, up to $2 million for customers with EDR plus Falcon Identity Threat Protection, calculated at $2,000 per impacted covered endpoint. Covers ransomware incidents only, occurring after activation. Requires supported Windows/macOS/Linux endpoints at the recommended Measured Security Posture or higher at all times, Falcon sensor current or up to two versions prior, MFA on internet-facing services. Not valid where it would be an insurance contract. Terms not negotiable. Source
Price: Not published.
Attestations: SOC 2 Type II (Type 2 report provided to Falcon platform customers); ISO/IEC 27001:2022 (Certified); ISO/IEC 42001:2023 (AI management system certification); CSA STAR Level 1 and Level 2 (Falcon platform listed in CSA STAR registry; Level 2 third-party audit against CCM v4.0); FedRAMP High (CrowdStrike Falcon Platform for Government (package FR1807853629A), FedRAMP Certified, Class D (High), as of 2025-03-12; Falcon Complete listed among certified services); DoD IL5 Provisional Authorization (Falcon platform granted DISA Provisional Authorization up to Impact Level 5); BSI C5 (Falcon platform); IRAP (Assessed under Australia’s IRAP); PCI DSS AOC (CrowdStrike provides a PCI DSS Attestation of Compliance to customers); TISAX (Registered); UK Cyber Essentials (Certified); FedRAMP High: CrowdStrike Falcon Platform for Government, status “FedRAMP Certified” (Class D High, Rev5, agency path) as of 2025-03-12; Falcon Complete is listed among the certified services
Demo, sample: Live demo by request only, via the form at https://www.crowdstrike.com/en-us/services/falcon-complete-mdr/demo/ (no public recorded or interactive MDR demo found).
MITRE eval: Took part in MITRE ATT&CK Evaluations, Managed Services: OilRig (2022); menuPass + ALPHV BlackCat (2024). MITRE publishes results, not scores.
Also: The included warranty pays up to $2 million (with Falcon Identity Threat Protection) at $2,000 per impacted endpoint, for ransomware incidents only.
CrowdStrike unveiled “Agentic MDR” for Falcon Complete on March 24, 2026; its 10-K filed March 5, 2026 describes the service as Falcon Complete Next-Gen MDR.
Falcon Complete is listed as a certified service in CrowdStrike’s FedRAMP High package on the FedRAMP Marketplace. Source

NoteOn July 19, 2024 a faulty Falcon sensor content update crashed certain Windows systems running the sensor; CrowdStrike’s 10-K (filed March 2026) reports lawsuits over the incident, including one filed by Delta Air Lines. Source

PTRSADChecked 2026-11-08 · 16 sources: crowdstrike.com, crowdstrike.com

MDR specialistM·16

Deepwatch

Deepwatch Managed Detection and Response (Deepwatch Guardian MDR Platform); Managed Endpoint Detection and Response (MEDR) · Enterprises (‘Enterprise MDR’)

Ownership: Private (backed by Springcoast Partners, Goldman Sachs, ABS Capital and Splunk Ventures)
HQ, founded: Palo Alto, California, US
Tools: Your tools. Works on the EDR and SIEM you already run. Own technology: Deepwatch Guardian MDR Platform, NEXA agentic AI ecosystem, Dynamic Risk Scoring, Deepwatch Security Index; no own agent. EDRs named: CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint, Palo Alto Cortex XDR, Broadcom Carbon Black. SIEM: Works in the customer’s SIEM (‘SIEM-agnostic’, bring your own technology): Splunk, Microsoft Sentinel, Google SecOps, Securonix, plus a CrowdStrike Next-Gen SIEM offering. Its AWS listing also offers MDR with Deepwatch-provided Splunk licensing. Source
Response: Active Response for identities and endpoints: actions run automatically, after analyst approval, or in monitor-only mode, according to a customer-defined Response Intent Matrix (which detections, which actions, under what conditions). Source
Service level: No response time stated
24/7 human analysts, stated.
Price: AWS Marketplace, sold by Deepwatch: Deepwatch Managed Security Services: MDR (Deepwatch-provided Splunk licensing, 50 GB per day) $245,198.00; MEDR (up to 1001 endpoints, Deepwatch-provided EDR licensing) $98,369.00; VM Essential (up to 2500 IPs) $192,251.00; FW (up to 10 firewalls, BYOL Palo Alto, Check Point or Fortinet) $50,160.00; each per 12 months. (12 months)
Attestations: SOC 2 Type II (Security, Availability and Confidentiality criteria; audited every year since inception (Deepwatch’s statement)); PCI DSS (service provider) (Deepwatch says it implements controls for PCI Level 1 Service Providers and has been certified to PCI DSS since inception); ISO/IEC 27001:2022 (First certified in 2024); ISO/IEC 42001 (AI management system certification covering the NEXA agentic AI ecosystem)
Demo, sample: Demo by request form at https://www.deepwatch.com/get-a-demo/..
Also: Sells only through channel partners: ‘We don’t sell direct.’
Its own AWS Marketplace listing prices MDR including Deepwatch-provided Splunk licensing (50 GB/day) at $245,198 for 12 months.
Supports Splunk, Microsoft Sentinel, Google SecOps and Securonix as the customer’s SIEM (Securonix added February 2026). Source

PTRSADChecked 2026-11-08 · 18 sources: deepwatch.com, deepwatch.com

EDR vendor’s MDRM·17

Fortinet

FortiGuard Managed Detection and Response (MDR) Service (for FortiEDR / FortiXDR); FortiGuard SOC-as-a-Service (SOCaaS) · Customers of the FortiEDR and FortiXDR endpoint security platforms

Ownership: Public (NASDAQ: FTNT)
HQ, founded: Sunnyvale, California, US · 2000
Tools: Its own stack. Deploys its own agent or platform. Own technology: FortiEDR / FortiXDR (part of the FortiEndpoint single-agent platform); SOCaaS runs on FortiSIEM and FortiAnalyzer. EDRs named: its own Fortinet FortiEDR. SIEM: The MDR service monitors FortiEDR alerts. The separate SOCaaS uses FortiSIEM as its primary analytics platform for multi-vendor monitoring of Fortinet and third-party sources. Source
Response: Reviews every alert, hunts threats and takes actions on the customer’s behalf according to its risk profile; initial tactical containment through FortiEDR (for example stopping a process from writing to disk or blocking communications to another device); guidance on remediation steps such as terminating a process, removing a file or removing registry persistence; malware and forensic-artifact analysis. Incident response: Not stated as included. The MDR datasheet describes ‘incident handling’ and guidance to incident responders; Fortinet lists Forensics Services and Incident Response separately. Source
Service level: MDR: ‘Every security event that is triggered by our FortiEDR technology is handled within 24 hours’ (February 2024 datasheet). SOCaaS: critical escalation times of P1 15 minutes, P2 45 minutes, P3 90 minutes, P4 6 hours, and 99.99% availability (March 2026 datasheet) (a stated claim) Source
24/7 human analysts, stated.
Price: Not published.
Attestations: SOC 2 (SOC 2 reports listed for ‘FortiEDR System and MDR Services’ and ‘FortiCloud SOCaaS’; report type (I or II) not stated on the page); ISO/IEC 27001 (Scope: FortiGuard portfolio of security services and FortiCloud portfolio of services; certificates on request)
Demo, sample: No MDR demo found; a FortiEDR/XDR demo is booked through a form at https://www.fortinet.com/demo-center/fortiedr-demo.
Also: FortiGuard MDR is an add-on to FortiEDR, priced per endpoint for the entire FortiEDR-protected estate and sold through Fortinet resellers and distributors; no price is published.
The MDR datasheet says every FortiEDR-triggered security event is handled within 24 hours; Fortinet’s datasheets state that nothing in them is a binding commitment.
The separate FortiGuard SOCaaS publishes escalation times of 15 minutes for P1 and 45 minutes for P2 and can monitor third-party sources through FortiSIEM. Source

NoteIn September 2024 Fortinet disclosed that an individual accessed a limited number of files on its instance of a third-party cloud file drive, including limited data on fewer than 0.3% of its customers; Fortinet said there was no indication of malicious activity affecting customers. Source

PTRSADChecked 2026-11-08 · 15 sources: fortinet.com, fortinet.com

MDR specialistM·18

Ontinue

Ontinue ION MXDR (also called MXDR Core) and Ontinue MXDR Essentials (launched November 3, 2026), both for Microsoft Security environments · Organizations running Microsoft Security

Ownership: Private; definitive agreement (September 16, 2026) to be acquired by Quorum Cyber, majority-owned by Eterna Growth Partners; closing pending
2023-02 Launched by Open Systems as its new MDR division
2026-09 Quorum Cyber signed a definitive agreement to acquire Ontinue; Eterna Growth Partners to be majority investor of the combined company; companies operate independently until closing
HQ, founded: Zürich, Switzerland (registered office and European HQ); North America HQ in Redwood City, California · 2023
Tools: Your tools. Works on the EDR and SIEM you already run. Own technology: ION SecOps Platform (ION Automate, ION Engage in Microsoft Teams, dashboards); no agent of its own. EDRs named: Microsoft Defender for Endpoint. SIEM: Works in the customer’s own Microsoft Sentinel (required for ION MXDR; data stays in the customer’s tenant) Source
Response: ION Automate and Cyber Defenders run Defender for Endpoint automated investigation and response, isolate hosts, block IoCs, restrict app execution and run antivirus, within actions the customer pre-authorizes; other actions go to the customer for approval. Incident response: Not included in ION MXDR (service description: incident response ‘would be the responsibility of a third party’); ‘ION for DFIR’ add-on (effective September 22, 2026) delivered with a DFIR alliance partner, remote or on-site as agreed. Source
Service level: ION MXDR SLA v3 (for subscriptions starting on or after June 1, 2025): ION Engage, Ontinue joins the virtual meeting within 15 minutes; Known Critical Attack response action triggered within 15 minutes; event engagement completion within 1 hour (P1), 4 hours (P2), 16 hours (P3); qualified response within 1 hour of engagement completion. Missed SLA: credit of 5% of that month’s fees. (contractual) Source
24/7 human analysts, stated.
Price: Not published.
Attestations: ISO 27001 (Listed on Ontinue’s certifications page); ISO 27017 (Listed on Ontinue’s certifications page); ISO 27018 (Listed on Ontinue’s certifications page); ISAE 3402 & AT-C 320 (SOC 1 Type 2) (Listed on Ontinue’s certifications page (‘Often known as SOC1 Type 2’)); Cyber Essentials (Listed on Ontinue’s certifications page)
Demo, sample: Demo by request form: https://www.ontinue.com/demo-request.
Also: Contractual SLA (v3, June 2025): 15 minutes for ION Engage and known-critical-attack response, 1/4/16 hours for P1/P2/P3 engagement, with a 5% monthly-fee credit per miss.
Requires the customer’s own Microsoft Sentinel, and Defender for Endpoint Plan 2 for containment; it works only on the Microsoft stack.
Incident response is not part of ION MXDR; deeper DFIR is the ‘ION for DFIR’ add-on, delivered with a partner. Source

PTRSADChecked 2026-11-08 · 18 sources: ontinue.com, ontinue.com

EDR vendor’s MDRM·19

Palo Alto Networks Unit 42

Unit 42 Managed Detection and Response (MDR) · Commercial entities running Palo Alto Networks Cortex XDR Pro (minimum 200 agents) or Cortex XSIAM (minimum 1,000)

Ownership: Public (NASDAQ: PANW)
HQ, founded: Santa Clara, California, US · 2005
Tools: Its own stack. Deploys its own agent or platform. Own technology: Cortex XDR Pro (agents required) and Cortex XSIAM. EDRs named: its own Palo Alto Cortex XDR. SIEM: Customer’s own Cortex XDR Pro or Cortex XSIAM; higher SKUs also monitor network, cloud, identity and third-party cases generated by the Cortex analytics engine. Source
Response: On Cortex XDR endpoints: retrieve files, live terminal session, isolate endpoint, search and destroy files, run scripts, quarantine, terminate processes; remove malicious files and registry keys and restore damaged files. Incident response: Not included: Unit 42 incident response for events escalated by MDR requires a separate service description or statement of work. Source
Service level: Service Level Objectives (“commercially reasonable efforts”, no service credits stated): MTTR (mean time to resolve, over 30 days) under 60 minutes for Critical, High and Medium cases; agent-side detection/prevention under 60 minutes; server-side BIOCs/IOCs under 70 minutes; server-side multi-event analytics under 90 minutes (a stated claim) Source
24/7 human analysts, stated.
Price: Not published.
Attestations: SOC 2+ (Listed on Palo Alto Networks’ Trust Center certifications page; product scope not stated there); ISO certifications (Listed on the Trust Center certifications page; specific standards and scope not stated there); ENS High (Spain) (“Palo Alto Networks is Esquema Nacional de Seguridad (ENS) High certified”); NCSC Cyber Incident Response (Enhanced level) (Unit 42 assured at the Enhanced level under the UK NCSC CIR scheme (incident response, not MDR))
Demo, sample: The MDR page embeds a public overview video; no interactive demo or sample report found. Expert consultation via form on https://www.paloaltonetworks.com/unit42/respond/managed-detection-response.
MITRE eval: Took part in MITRE ATT&CK Evaluations, Managed Services: OilRig (2022); menuPass + ALPHV BlackCat (2024). MITRE publishes results, not scores.
Also: Unit 42 MDR requires Cortex XDR Pro (at least 200 agents) or Cortex XSIAM (at least 1,000); the Cortex licenses are not included.
Response actions run only through Cortex XDR agents; third-party data is monitored only as cases raised by the Cortex analytics engine.
The service description sets an MTTR objective of under 60 minutes for Critical, High and Medium cases, on a commercially-reasonable-efforts basis. Source

PTRSADChecked 2026-11-08 · 8 sources: paloaltonetworks.com, paloaltonetworks.com

EDR vendor’s MDRM·20

Secureworks (Sophos Taegis)

Taegis MDR (formerly Taegis ManagedXDR), with Taegis MDR Plus, Taegis MDR Enhanced and Taegis MDR for OT; now sold by Sophos · Organizations requiring an enterprise-grade MDR service (Sophos’s description), fully managed or in collaboration with in-house analysts

Ownership: Owned by Sophos since February 2025 (previously NASDAQ: SCWX, majority-owned by Dell Technologies)
2011-02 Dell Inc. acquired SecureWorks
2016-04 Secureworks completed its IPO on Nasdaq; Dell Technologies remained the controlling shareholder (about 81% of shares as of February 2024)
2025-02 Sophos completed its acquisition of Secureworks (about $859 million, all cash); Secureworks stock ceased trading on Nasdaq
HQ, founded: Atlanta, Georgia, US (Secureworks’ headquarters before the acquisition; now part of Sophos, Oxford, UK) · 1999
Tools: Own stack or yours. Has its own agent, also runs on named third-party EDRs. Own technology: Taegis XDR platform with Next-Gen SIEM and SOAR; Sophos Endpoint (included in all Taegis MDR subscriptions since September 2025); Taegis Endpoint Agent (end of support July 31, 2027). EDRs named: its own Sophos Intercept X (Sophos Endpoint, included), its own Taegis Endpoint Agent, CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne, Broadcom Carbon Black. SIEM: Own: Taegis XDR with Next-Gen SIEM (one year of retention as standard, up to five years) Source
Response: Supported threat response actions within Taegis XDR after customer authorization; customers can pre-authorize containment actions through their own playbooks; “Unlimited Response” for confirmed active threats that meet set criteria. Incident response: “Unlimited Response” included for confirmed active threats meeting set criteria (endpoint, network, log and malware analysis, response actions within Taegis). Emergency incident response and proactive services use separately purchased Service Units; matters needing legal counsel or insurers require a separate incident response engagement. Source
Service level: Security Investigation: less than 60 minutes from case creation to customer notification; credit of 1/100th of the monthly service fee if 60-240 minutes, 1/30th if over 240 minutes (maximum one credit per day). Urgent Unlimited Response requests acknowledged within 4 hours (credit of 1/100th of the monthly fee per day missed). The SLA applies once at least 40% of licensed endpoints are deployed. (contractual) Source
24/7 human analysts, stated.
Price: Not published.
Attestations: SOC 2 Type II (Secureworks completed a Type II SOC 2 examination (security, availability, confidentiality)); ISO/IEC 27001 (ISMS supporting the infrastructure and services used for the Taegis platform); TX-RAMP (Taegis MDR certificate listed on the Sophos Trust Center)
Demo, sample: None public.
MITRE eval: Took part in MITRE ATT&CK Evaluations, Managed Services: menuPass + ALPHV BlackCat (2024). MITRE publishes results, not scores.
Also: Secureworks was acquired by Sophos on February 3, 2025; secureworks.com now redirects to sophos.com and Taegis MDR is sold as part of the Sophos portfolio.
Since September 2025 Sophos Endpoint is natively integrated and automatically included in every Taegis MDR and Taegis XDR subscription.
Taegis MDR has a contractual SLA: case-to-notification under 60 minutes, with service credits if missed. Source

NoteSecureworks’ own endpoint agents are being retired: Red Cloak reaches end of life on December 31, 2026 (existing deployments stop working) and the Taegis Endpoint Agent loses support on July 31, 2027; customers are told to move to Sophos Endpoint or a supported third-party EDR. Source

PTRSADChecked 2026-11-08 · 20 sources: sophos.com, docs.taegis.secureworks.com

EDR vendor’s MDRM·21

SentinelOne

Wayfinder Managed Detection & Response (Wayfinder MDR Essentials, Wayfinder MDR Elite), part of Wayfinder Threat Detection & Response (Wayfinder TDR); formerly Vigilance MDR, with WatchTower threat hunting · From startups to global enterprises; MDR Elite aimed at organizations wanting a high-touch partnership with a dedicated Threat Advisor

Ownership: Public (NYSE: S)
HQ, founded: Mountain View, California, US · 2013
Tools: Its own stack. Deploys its own agent or platform. Own technology: SentinelOne Singularity Platform and Sentinel agent; Purple AI; threat intelligence from Google Threat Intelligence. EDRs named: its own SentinelOne Singularity. SIEM: Own: SentinelOne Singularity Platform; MDR Essentials and Elite coverage lists “Endpoint, Cloud, Identity & Supported 3rd Party Integration” (third-party vendors not named) Source
Response: Confirmed threats contained “according to your configured response policy”: malicious processes killed, endpoints isolated, unauthorized changes rolled back; DFIR experts for critical incidents. Incident response: MDR Elite includes a built-in Incident Readiness & Response (IRR) retainer with pre-approved hours and full DFIR access; MDR Essentials does not include IRR or DFIR. Source
Service level: No contractual SLA published. SentinelOne states Wayfinder MDR’s “mean time to detect averages 3.3 minutes across customer environments”. (a stated average) Source
24/7 human analysts, stated.
Warranty: Breach Response Warranty for Wayfinder MDR Essentials, Wayfinder MDR Elite, Vigilance MDR and Singularity MDR subscribers (must be stated in the quote or PO). Reimburses pre-approved forensic, legal, data-privacy and recovery costs after a breach, capped by subscribed endpoint count: $100,000 (up to 4,999 endpoints), $500,000 (5,000-10,000), $1,000,000 (10,001 and above). Conditions include reporting within 48 hours of discovery, best-practice configuration, security awareness training and offline backups; service rates over $250/hour are not reimbursed. Source
Price: Not published.
Attestations: SOC 2 Type II (Examined against Security, Availability and Confidentiality criteria by Schellman & Company); ISO/IEC 27001:2022 (ISMS for the Singularity XDR Platform); ISO/IEC 27017:2015 (Certified); ISO/IEC 27018:2019 (Certified); FedRAMP High (SentinelOne Singularity Platform High (package FR1919071020A), FedRAMP Certified, Class D (High), as of 2024-09-10; certified services include Wayfinder MDR Essentials, Wayfinder MDR Elite, Wayfinder Threat Hunting, Vigilance MDR and WatchTower); BSI C5:2020 (Singularity XDR Platform attestation); IRAP (PROTECTED) (Singularity XDR Platform assessed against PROTECTED-level controls); FedRAMP High: SentinelOne Singularity Platform High, status “FedRAMP Certified” (Class D High) as of 2024-09-10; Wayfinder MDR Essentials/Elite, Vigilance MDR and WatchTower are listed among the certified services
Demo, sample: The MDR page’s “See it in Action” link goes to public Storylane product tours of the Singularity platform (https://www.sentinelone.com/tour/), none specific to the MDR service; MDR demo by request.
MITRE eval: Took part in MITRE ATT&CK Evaluations, Managed Services: OilRig (2022); menuPass + ALPHV BlackCat (2024). MITRE publishes results, not scores.
Also: SentinelOne made Wayfinder Threat Detection and Response generally available on November 24, 2025, replacing the Vigilance MDR and WatchTower names.
The breach response warranty cap depends on endpoint count: $100,000 below 5,000 endpoints, $500,000 for 5,000-10,000, $1,000,000 above 10,000.
MDR Elite adds a dedicated Threat Advisor, an incident readiness and response retainer and DFIR access; MDR Essentials does not include them. Source

NoteOn May 29, 2025 a software flaw in SentinelOne’s infrastructure caused a global service disruption that cut commercial customers off from their consoles; SentinelOne said endpoints stayed protected but during the outage “managed response services will not have visibility”. Source

PTRSADChecked 2026-11-08 · 12 sources: sentinelone.com, sentinelone.com

Security services firmM·22

Trustwave (LevelBlue)

LevelBlue Managed Detection & Response (MDR and MDR Elite; formerly Trustwave MDR). Related: LevelBlue MXDR and Co-Managed SOC · Enterprises; US federal and state agencies through Trustwave Government Solutions

Ownership: Owned by LevelBlue since August 2025. LevelBlue is private: launched in May 2024 as a WillJam Ventures-AT&T joint venture (AT&T kept a minority stake at launch); SoftBank Corp., SoftBank Vision Fund 2 and Liberty Strategic Capital became investors in November 2025
2015-04 Singtel signed a definitive agreement to acquire Trustwave Holdings
2024-01 MC² Security Fund, an affiliate of The Chertoff Group, completed its acquisition of Trustwave
2024-11 Trustwave and Cybereason announced a definitive merger agreement, expected to close in early 2025
2025-03 The planned Trustwave-Cybereason merger was scrapped (CRN)
2025-08 LevelBlue completed its acquisition of Trustwave
2025-11 LevelBlue completed its acquisition of Cybereason; SoftBank Corp., SoftBank Vision Fund 2 and Liberty Strategic Capital became LevelBlue investors
2026-01 LevelBlue announced it will acquire Fortra’s Alert Logic MDR, XDR and WAF managed services as part of a partnership with Fortra
HQ, founded: Plano, Texas, US (LevelBlue global headquarters)
Tools: Your tools. Works on the EDR and SIEM you already run. Own technology: Fusion security operations platform and Fusion mobile app (Trustwave lineage); LevelBlue also owns USM Anywhere and, since November 2025, Cybereason’s XDR. EDRs named: Microsoft Defender for Endpoint, SentinelOne, Palo Alto Cortex XDR. SIEM: Own platform: Fusion. Co-managed SOC services for customer SIEMs including Microsoft Sentinel and SentinelOne Singularity AI SIEM; an MXDR offering with an embedded SIEM was announced in March 2025. Source
Response: Containment under a client-defined Response Protocol per endpoint group: TLP Green (contain by any means without separate approval), TLP Yellow (pre-agreed actions), TLP Red (recommend only); for SentinelOne estates, containment, isolation and rollback. Incident response: MDR: not included; the service description says ‘This Service is not a threat or incident response service’. MDR Elite: SpiderLabs Remote Incident Response, up to 20 hours of remote investigation for one incident per year; more hours cost extra. Source
Service level: MDR Elite: mean time to acknowledge (MTTA) of 15 minutes and personalized mean time to respond (MTTR) of less than 30 minutes, per the June 2022 launch release. The June 2026 brief lists ‘Service Levels for MTTA and MTTR’ for MDR Elite only and repeats ‘Personalized MTTR of less than 30 minutes’; the published service descriptions leave SLA terms to the SOW or Order Form (contractual) Source
24/7 human analysts, stated.
Price: Not published.
Attestations: ISO/IEC 27001 (Listed as a key certification on LevelBlue’s compliance page; product scope not stated); SOC 2 Type II (Listed as a key certification on LevelBlue’s compliance page; product scope not stated); PCI DSS (Listed as a key certification on LevelBlue’s compliance page; product scope not stated); ISO/IEC 27701 (Listed as a key certification on LevelBlue’s compliance page; product scope not stated); StateRAMP / GovRAMP (Trustwave became a StateRAMP-certified vendor in August 2024; LevelBlue’s history page lists ‘Trustwave Government Solutions Attains GovRAMP Authorization’. Level not stated); FedRAMP Moderate: ‘Trustwave Fusion’ (Trustwave Government Solutions), now shown as FedRAMP Certified, Class C (Moderate), agency path, since 13 February 2025; it is the platform for Trustwave’s government MDR and co-managed SIEM/SOC. Separately, ‘LevelBlue Threat Detection and Response for Government’ has been FedRAMP Certified, Class C (Moderate), since 12 May 2021
Demo, sample: None public.
Also: trustwave.com now redirects to levelblue.com; Trustwave’s MDR is sold as LevelBlue Managed Detection & Response, and the June 2026 service descriptions still use the Trustwave name.
The 2024 Trustwave-Cybereason merger was scrapped in March 2025; LevelBlue then bought Trustwave (August 2025) and Cybereason (November 2025).
Response actions follow a customer-set Response Protocol per endpoint group (TLP Green/Yellow/Red), and the service description makes the customer responsible for mitigating threats. Source

PTRSADChecked 2026-11-08 · 31 sources: levelblue.com, levelblue.com

Security services firmM·23

Kroll

Kroll Responder MDR (since 2025-26 delivered on CrowdStrike Falcon Complete Next-Gen MDR)

Ownership: Private (investor consortium led by Stone Point Capital and Further Global, deal agreed January 2020)
2020-01 Duff & Phelps (the firm now operating as Kroll) agreed to be acquired for $4.2 billion by an investor consortium led by Stone Point Capital and Further Global; Permira funds kept a significant stake
HQ, founded: New York, New York, US · 1932
Tools: Its own stack. Deploys its own agent or platform. Own technology: No proprietary EDR: the service runs on CrowdStrike Falcon (Falcon Complete Next-Gen MDR through CrowdStrike’s Falcon Complete for Service Providers program) and Falcon Next-Gen SIEM, deployed by Kroll; Redscan threat management platform as client portal; KAPE forensic tool. EDRs named: CrowdStrike Falcon (deployed and run by Kroll). SIEM: CrowdStrike Falcon Next-Gen SIEM, implemented and operated by Kroll. Source
Response: Isolate compromised endpoints, update WAFs and firewalls, revoke access via authentication platforms; then eradicate malware, remove persistence, write custom clean-up scripts, reverse engineer malware and validate ‘clean’ status. Incident response: Remote digital forensics and incident response by Kroll’s DFIR team included ‘without additional cost’ (‘Complete Response’); a separate Cyber Incident Response Retainer is also sold. Source
Service level: No response time stated
24/7 human analysts, stated.
Warranty: Complimentary $1 million Incident Protection Warranty for Kroll Responder clients whose package includes endpoint protection, subject to enrollment; minimum 1-year term, no minimum endpoint count; reimburses costs related to ransomware, business email compromise, compliance and regulatory failure, and business income loss. Source
Price: Not published.
Attestations: CREST accreditation (‘CREST-accredited for Penetration Testing, SOC and IR Services’); SOC 2 Type II (Announced December 24, 2020 (as Duff & Phelps) for its computing infrastructure and facilities service system; report by KirkpatrickPrice. No later report date published.)
Demo, sample: Customized demo by request form on the Kroll Responder page: https://www.kroll.com/en/services/cyber/kroll-responder#form2899.
Also: Since a December 2025 partnership with CrowdStrike, Kroll Responder runs on CrowdStrike Falcon Complete Next-Gen MDR; Kroll says it migrated over 270 client environments in under eight months.
Kroll’s previous MDR model supported five EDR and three SIEM platforms; the service has been consolidated onto CrowdStrike Falcon.
Remote DFIR, including removing persistence, malware clean-up and recovery support, is included at no extra cost. Source

NoteIn August 2023 a SIM-swap attack on a Kroll employee’s phone number let an attacker reach files with personal data of bankruptcy claimants in the BlockFi, FTX and Genesis matters (BleepingComputer, August 25, 2023). The incident was in Kroll’s restructuring/claims business, not its MDR service. Source

PTRSADChecked 2026-11-08 · 13 sources: kroll.com, kroll.com

Security services firmM·24

Mandiant (Google Cloud)

Mandiant Managed Defense (Managed Defense for Google SecOps; Managed Defense Standard)

Ownership: Part of Google Cloud (Alphabet Inc.); Google completed its acquisition of Mandiant on 12 September 2022
2022-09 Google completed its acquisition of Mandiant; Mandiant joined Google Cloud and kept the Mandiant brand
HQ, founded: Mountain View, California, US (Alphabet Inc.)
Tools: Own stack or yours. Has its own agent, also runs on named third-party EDRs. Own technology: Google Security Operations (SecOps) platform with curated detections from Google Threat Intelligence; no own EDR agent. EDRs named: CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint, Trellix. SIEM: Runs on Google Security Operations (SecOps); curated-detection coverage depends on the customer’s Google SecOps license. Source
Response: Alert triage and investigation, managed threat hunting mapped to MITRE ATT&CK, and rapid response; with supported technology-partner products the team can take actions on the customer’s behalf such as host containment, file acquisition and closing out alerts. Incident response: No retainer hours stated. Google says its experts can contain impacted hosts and help ‘resolve incidents without impact or the need for a formal incident response engagement’ Source
Service level: Contractual SLA covers the Managed Defense Portal only: 99.9% monthly availability, with service credits of 2% (below 99.9%), 5% (below 99.0%) and 10% (below 98.0%), capped at 10% of the prorated monthly fee. No detection or response-time SLA is published; the product page says alerts are ‘triaged and prioritized by a Mandiant expert within minutes’ (contractual) Source
24/7 human analysts, stated.
Price: Not published.
Attestations: ISO/IEC 27001, 27017, 27018 (‘Mandiant Managed Services’ is listed in scope of Google’s ISO 27001/27017/27018 certifications); SOC 2 and SOC 3 (‘Mandiant Managed Services’ is in scope of Google’s SOC 2 and SOC 3 reports (not SOC 1)); PCI DSS (‘Mandiant Managed Services’ is listed in scope of Google’s PCI DSS certification)
Demo, sample: None public.
Also: Managed Defense runs on top of Google Security Operations; Google says the service is most effective when a broad set of telemetry is integrated into SecOps.
The January 2025 technology datasheet names the supported EDRs and their licence prerequisites: CrowdStrike Falcon Insight XDR (Falcon Data Replicator), SentinelOne Singularity XDR (Cloud Funnel), Microsoft Defender for Endpoint (Plan 2) and, for Managed Defense Standard, Trellix Endpoint Security (HX) 9.1-10.0.
The only published contractual SLA is portal availability (99.9% per month, credits up to 10%), not detection or response time. Source

PTRSADChecked 2026-11-08 · 11 sources: cloud.google.com, cloud.google.com

EDR vendor’s MDRM·25

Trend Micro

TrendAI Vision One Services – Managed Detection and Response (MDR); bundled in TrendAI Vision One Services – Complete (listed on AWS Marketplace as ‘TrendAI Service One’) · TrendAI Vision One customers; TrendAI is Trend Micro’s enterprise business unit

Ownership: Public (Tokyo Stock Exchange Prime Market: 4704)
HQ, founded: Tokyo, Japan (US headquarters: Irving, Texas) · 1988
Tools: Its own stack. Deploys its own agent or platform. Own technology: TrendAI Vision One platform: Endpoint Security (including Apex One), Email and Collaboration Security, XDR for Networks, Deep Discovery Inspector, TippingPoint. EDRs named: its own TrendAI Vision One Endpoint Security. SIEM: Own platform: TrendAI Vision One. The 2025 services brief says the MDR also monitors ‘third-party logs’ Source
Response: Initiates threat containment actions, automatically generates IoCs, provides a step-by-step response plan for remediation and, where applicable, custom clean-up tools, and keeps sweeping for resurgence; incident cases and monthly executive reports. Incident response: In the ‘Services Complete’ bundle: the July 2026 brief lists ‘Unlimited Incident Response’ (subject to fair use) for assets protected by TrendAI or a third party, while the Services web page says ‘Guaranteed access to global Incident Response team, including 40 hours’. Not stated for MDR bought on its own. Source
Service level: No response time stated
24/7 human analysts, stated.
Price: Not published.
Trial: 30-day free trial of the TrendAI Vision One platform (not stated to include MDR)
Attestations: SOC 2 Type II (SOC 3 report public; SOC 2 report on request); ISO/IEC 27001:2022 (With ISO/IEC 27014 and 27034-1; Trend says its SaaS offerings and data centers are certified); ISO/IEC 27017 (Cloud security controls); ISO/IEC 20000-1:2018 (Trend says its threat discovery and response teams are certified); CSA STAR Level 2 (Certificate linked from the compliance page); C5 Type 2 (BSI C5 Type 2 attestation; report on request); IRAP (Trend Vision One assessed at PROTECTED level); PCI DSS (service provider) (Trend Vision One is a certified PCI DSS service provider); ISMAP (Trend cloud-based products listed under Japan’s ISMAP); GovRAMP / TX-RAMP (Listed for Trend Cloud One for Government and Trend Vision One for Government; level not stated on the page); FedRAMP Moderate (now shown as FedRAMP Certified, Class C (Moderate), agency path) for ‘Trend Vision One for Government’ since 22 November 2024. This covers the platform; the listing does not mention the MDR service (not the MDR service)
Demo, sample: None public.
MITRE eval: Took part in MITRE ATT&CK Evaluations, Managed Services: menuPass + ALPHV BlackCat (2024). MITRE publishes results, not scores.
Also: Since 23 March 2026 Trend Micro’s enterprise business operates as TrendAI; the MDR is now ‘TrendAI Vision One Services – Managed Detection and Response’ (the page URL and datasheet ID still say ‘Managed XDR’).
Trend’s Services Complete brief says MDR customers must be TrendAI Vision One customers.
Services Complete combines MDR, incident response and premium support and is designed for 12-month terms. Source

PTRSADChecked 2026-11-08 · 17 sources: trendmicro.com, trendmicro.com

EDR vendor’s MDRM·26

Microsoft

Microsoft Defender Experts MDR (Plan 1 and Plan 2; Plan 1 formerly Defender Experts for XDR) and Microsoft Defender Experts Hunting (formerly Defender Experts for Hunting); also sold within the Microsoft Defender Experts Suite · Customers with constrained SOCs overburdened with alert volume, needing skilled experts, or both (Defender Experts Hunting is for customers with a robust SOC)

Ownership: Public (NASDAQ: MSFT)
HQ, founded: Redmond, Washington, US · 1975
Tools: Its own stack. Deploys its own agent or platform. Own technology: Microsoft Defender XDR (Defender for Endpoint P2, Defender for Office 365 P2, Defender for Identity, Defender for Cloud Apps), Microsoft Entra ID P2; Microsoft Sentinel for Plan 2. EDRs named: its own Microsoft Defender for Endpoint. SIEM: Plan 1 uses Microsoft Defender data; Plan 2 operates on the customer’s own Microsoft Sentinel workspace (Microsoft says it is not a managed SIEM service) Source
Response: Triage, investigation and managed response on Microsoft Defender incidents; with the security operator role analysts “can also take specific remediation actions agreed upon with your SOC team”; for Plan 2 third-party sources, response guidance only. Incident response: Not included: Defender Experts MDR “doesn’t provide incident response services for an active compromise”; incident response is the separate Microsoft Defender Experts Cybersecurity Incident Response service. Source
Service level: No response time stated
24/7 human analysts, stated.
Price: Not published.
Attestations: None found for this service on its public pages.
Demo, sample: None public.
MITRE eval: Took part in MITRE ATT&CK Evaluations, Managed Services: OilRig (2022); menuPass + ALPHV BlackCat (2024). MITRE publishes results, not scores.
Also: Plan 1 covers Microsoft Defender workloads only; Plan 2 (needs Microsoft Sentinel and at least 1,500 seats) adds Okta, Proofpoint TAP, AWS CloudTrail, AWS GuardDuty, Palo Alto PAN-OS, Cisco ASA/Meraki, Zscaler ZIA/ZPA and Fortinet FortiGate.
For third-party sources Microsoft analysts give response guidance but do not act inside the third-party product.
The service covers High and Medium severity incidents on Windows, Linux and macOS; iOS, Android, IoT, DLP and custom detections are out of scope, and neither plan covers Defender for Cloud workloads. Source

NoteMicrosoft disclosed in an SEC filing that a nation-state actor accessed and exfiltrated information from a small percentage of Microsoft corporate email accounts, including senior leadership and cybersecurity staff, between late November 2023 and January 2024. Source

PTRSADChecked 2026-11-08 · 11 sources: microsoft.com, learn.microsoft.com

EDR vendor’s MDRM·27

Todyl

Todyl MXDR (Managed eXtended Detection & Response) · Small and mid-market businesses, served exclusively through channel partners (MSPs and solution providers/VARs)

Ownership: Private (venture-backed)
HQ, founded: Denver, Colorado, US · 2015
Tools: Its own stack. Deploys its own agent or platform. Own technology: Todyl Security Platform (single agent): Endpoint Security (EDR + NGAV), SASE, AI-Powered Managed SIEM, SOAR, ITDR, GRC. EDRs named: its own Todyl Endpoint Security. SIEM: Own: Todyl AI-Powered Managed (Cloud) SIEM; MXDR operates out of it, and other security tools can be integrated into the SIEM. Source
Response: MXDR analysts and automated playbooks act on threats: isolate compromised endpoints, quarantine files, disable or kill malicious processes, and contain identity attacks (account takeover, AitM); partners also get recommended and one-click response actions. Incident response: MXDR datasheet lists ‘Collaborative investigations and incident response’; no retainer hours stated. Source
Service level: No response time stated
24/7 human analysts, stated.
Price: Not published.
Attestations: None found for this service on its public pages.
Demo, sample: Demos by request only (‘Get a Demo’ form)..
Also: Todyl describes itself as ‘MSPs-First, Channel-Only’.
Every package (Essentials, Advanced, Complete) includes SASE, Endpoint Security, SIEM, MXDR and GRC, with 30-day, 90-day or 1-year data retention respectively; all are ‘Contact Sales for Pricing’.
Every MXDR customer is assigned a Detection and Response Account Manager (DRAM) with at least five years of cybersecurity experience. Source

PTRSADChecked 2026-11-08 · 13 sources: todyl.com, todyl.com

How to choose

Start from your tools
If you already pay for an EDR such as Defender or CrowdStrike, a provider that runs on it saves a migration. If you have nothing, a provider with its own agent may be simpler.
Ask what they do at 3 a.m.
Containment means they isolate the host or lock the account themselves. Alert-only means they phone you. Get the list of actions in writing, and what needs your approval.
Get the service level in the contract
A stated average response time is not a promise. Ask for the SLA, how it is measured, and what happens when it is missed.
Check what is extra
Incident response hours, identity and cloud coverage, log retention and the onboarding fee are often priced separately.
Ask for their own audit
A provider with admin rights on your endpoints is a supply-chain risk. Ask for its SOC 2 Type II report or ISO 27001 certificate.
See a real report
Ask for a sample incident report and a monthly report before you sign. Some providers publish one.

Questions

What is an MDR provider?

A company that watches your security tools around the clock, investigates what they flag and responds to real threats for you, for example by isolating a laptop or disabling a compromised account. Some run on the endpoint detection and response (EDR) software you already own; others install their own.

Who are the top MDR providers?

This site doesn't rank providers on quality, because no outsider can measure it fairly. It orders them by how much they publish. On November 8, 2026, the 3 that published the most (6 of 6 items) were Field Effect, Huntress, Rapid7.

Will an MDR provider work with the EDR we already have?

16 of the 27 providers here say they run on third-party EDRs, and 11 require their own agent or platform. The EDRs named most often are Microsoft Defender (16), CrowdStrike Falcon (16), SentinelOne (16). The full matrix is on the MDR vs EDR vs XDR page.

Do MDR providers fix the problem or just tell you about it?

26 of the 27 say they contain threats for you (isolating hosts, disabling accounts) as part of the service; 6 say full remediation is included. Ask what the provider may do without calling you first, and what it charges for incident response.

How much does MDR cost?

12 of the 27 providers publish a price, on their own site or on a cloud-marketplace listing they sell themselves. The rest quote on request. Every published figure is on the pricing page, with its unit and source.

07 · sources

Sources for this page

Each provider’s own site, documentation, trust centre and marketplace listings — Every fact on the board; 452 source URLs, linked from each entry.
Ontinue: Quorum Cyber signed a definitive agreement to acquire Ontinue; Eterna Growth Partners to be majority investor of the combined company; companies operate independently until closing — Ownership change, 2026-09.
Trustwave (LevelBlue): LevelBlue announced it will acquire Fortra’s Alert Logic MDR, XDR and WAF managed services as part of a partnership with Fortra — Ownership change, 2026-01.
Trustwave (LevelBlue): LevelBlue completed its acquisition of Cybereason; SoftBank Corp., SoftBank Vision Fund 2 and Liberty Strategic Capital became LevelBlue investors — Ownership change, 2025-11.
Red Canary (Zscaler): Zscaler completed its acquisition of Red Canary (announced August 1, 2025); CRN reported the deal at $675 million — Ownership change, 2025-08.
Trustwave (LevelBlue): LevelBlue completed its acquisition of Trustwave — Ownership change, 2025-08.
Red Canary (Zscaler): Zscaler signed a definitive agreement to acquire Red Canary — Ownership change, 2025-05.
Trustwave (LevelBlue): The planned Trustwave-Cybereason merger was scrapped (CRN) — Ownership change, 2025-03.
Sophos: Sophos completed its acquisition of Secureworks (about $859 million, all cash) — Ownership change, 2025-02.

Each provider’s own sources are linked from its entry on the provider board. How providers are chosen and ordered, and how to correct an entry: methodology.

Cite this page

MDR Companies. “MDR companies, compared on what they publish.” Updated November 8, 2026. https://mdrcompanies.com/

All 27 providers

Want a shortlist instead of a board?

Your tools, or theirs

Your tools

Own stack or yours

Its own stack

Who owns whom

Ontinue

Trustwave (LevelBlue)

Trustwave (LevelBlue)

Red Canary (Zscaler)

Trustwave (LevelBlue)

Red Canary (Zscaler)

Trustwave (LevelBlue)

Sophos

Adlumin (N-able)

Trustwave (LevelBlue)

Trustwave (LevelBlue)

Ontinue

Every provider in detail

How to choose

Start from your tools

Ask what they do at 3 a.m.

Get the service level in the contract

Check what is extra

Ask for their own audit

See a real report

Questions

Sources for this page

Cite this page