Home / Services / Managed detection & response
MDR
Managed detection & response
Analysts watching your endpoints, identities, email and cloud around the clock, with containment authority you set.
Our security operations center ingests telemetry from the EDR agent on every endpoint, from Microsoft 365 or Google Workspace, from your identity provider and from AWS, Azure or GCP. Detections are triaged by a person within minutes, false positives are tuned out rather than forwarded, and confirmed threats are contained under the playbook you approved at onboarding: isolate the host, disable the account, revoke the session, block the sender.
from $14 per endpoint per month
What is included
- 24×7 staffed SOC in the United States; every alert triaged by an analyst
- EDR license included (CrowdStrike, SentinelOne or Microsoft Defender), or bring your own
- Identity and email monitoring: impossible travel, MFA fatigue, inbox rules, OAuth consent grants
- Containment under your playbook: host isolation, account disable, session revocation
- Monthly vulnerability scanning with a ranked remediation list
- Weekly digest, monthly report, quarterly review with your leadership
What you receive
- Onboarding runbook and containment playbook signed by both sides
- Client portal with live alert queue, cases and asset inventory
- Monthly report: detections, cases, mean time to acknowledge and contain, coverage gaps
- Quarterly business review with a 90-day roadmap
How it runs
- 1
Deploy
Agent rollout by your IT team or ours, usually under two weeks for 500 endpoints.
- 2
Tune
Thirty days of learning your environment; noisy detections are suppressed with documented reasons.
- 3
Operate
Alerts triaged around the clock; you hear from us when something needs a decision.
- 4
Review
Monthly report, quarterly review, and a roadmap that closes the gaps we see.
Questions about managed detection & response
Do you replace our IT provider?
No. We work beside your internal IT team or managed service provider. They keep systems running; we watch for and respond to threats. Both sides sit in the same case when an incident touches infrastructure.
What happens at 3 a.m.?
The same thing that happens at 3 p.m. An analyst acknowledges a critical alert within 15 minutes, contains it under the playbook, and calls the on-call contact you listed.
Can we keep the EDR we already pay for?
Yes. Plans are $5 per endpoint lower when you bring an existing CrowdStrike, SentinelOne or Microsoft Defender for Endpoint P2 license.
Other services
Scope managed detection & response for your environment.
Thirty minutes with the people who will do the work, and a fixed price in writing the same day.