SOC online · 24/7/365

Managed Detection & Response with a SOC that's awake when your laptop gets popped at 2am

24/7 SOC running CrowdStrike or SentinelOne EDR plus Microsoft Entra and cloud telemetry. Pre-approved containment runbooks, and a real human you can call when it matters.

Run my free 14-day MDR trial Talk to a SOC analyst →

Keep the post-trial threat report either way.

Service tiers

Three lanes for MDR. Per-endpoint pricing. Same SOC behind every tier.

All tiers run on the same 24/7 SOC and the same containment runbooks. The difference is whether you need identity telemetry, weekly threat hunts, cloud workload coverage.

MDR Essentials
CrowdStrike Falcon Pro plus a 24/7 SOC behind it. The minimum that earns the cyber-insurance discount.
$11/endpoint/mo
Annual agreement · 25-endpoint minimum
  • CrowdStrike Falcon Pro EDR (or SentinelOne Singularity Core)
  • 24/7 SOC monitoring
  • Pre-approved isolation + process-kill runbooks
  • Monthly executive report with detection summary
  • Quarterly tuning review
  • Sensor deploys via Intune or RMM
Start Essentials →
Most chosen
MDR + Identity
Add identity and a weekly threat hunt. The tier that catches lateral movement, not just the initial drop.
$19/endpoint/mo
Annual agreement · 25-endpoint minimum
  • Everything in MDR Essentials
  • Microsoft Entra ID + Okta sign-in telemetry into the SIEM
  • Pre-approved containment: disable user, revoke session, force MFA reset
  • Weekly threat hunt by a senior analyst across your tenant
  • Defender XDR or Microsoft Sentinel correlation included
  • Cyber insurance questionnaire completed on your behalf
Start MDR + Identity →
Enterprise MDR
For regulated workloads, cloud-heavy stacks, OT/IoT, or anyone who needs a name on the account.
Custom
Scoped by endpoint, workload, and compliance scope
  • Everything in MDR + Identity
  • Cloud workload protection (CrowdStrike Falcon Cloud or S1 Cloud Workload)
  • OT and IoT telemetry with Tanium or Claroty integration
  • Quarterly purple-team exercise with your IT team
  • Direct mobile line during P1 incidents, no ticket queue
Scope Enterprise →
The detection stack we actually run · no white-label mystery boxes
CrowdStrike Falcon EDR / XDR SentinelOne Singularity EDR alternative Microsoft Defender XDR M365-native Microsoft Sentinel Cloud SIEM Splunk Enterprise Security SIEM Sumo Logic Cloud SIEM Elastic Security Open SIEM Tines SOAR / runbooks Drata SOC 2 evidence Vanta Compliance automation Tanium Endpoint visibility VMware Carbon Black Legacy migration
Threat → detection layer

Which signal catches which threat. Because "we have EDR" doesn't mean anything anymore.

Modern attacks chain together cheap commodity malware, real OS tools, stolen credentials, and cloud tokens. A single signal misses 80% of the kill chain. Here is what each layer catches and where one tool alone falls down.

Threat What it looks like Primary layer What gets contained
Commodity ransomware drop Known family hash, mass file rename, shadow-copy delete, ransom note Falcon / SentinelOne behavioral Auto-isolate host, kill process tree, roll back encrypted files (S1) or block (CrowdStrike)
Living-off-the-land lateral movement PsExec, WMIC, PowerShell remoting, scheduled task creation across hosts EDR + Sentinel correlation Network containment on origin host, disable account, alert on lateral targets
Credential theft / pass-the-hash LSASS access, Mimikatz signatures, NTLM relay, ticket harvesting EDR memory scan + Defender for Identity Force credential rotation, revoke Kerberos tickets, block token reuse
Cloud token theft Stolen OAuth refresh token used from new geography, impossible-travel Entra ID + Okta telemetry Revoke session, require fresh MFA, block IP, audit token activity
Insider data staging Bulk file copy to OneDrive personal, USB write, unusual archive creation EDR file activity + DLP signal Block transfer, alert IT and HR, preserve forensic timeline
Persistence mechanism Run keys, scheduled tasks, WMI subscription, service install in odd path EDR registry/scheduled-task watcher Remove persistence, hash-block dropper, hunt across estate for siblings
Suspicious PowerShell / cmd execution Encoded commands, AMSI bypass, Invoke-Expression with web download EDR script-block logging + AMSI Kill PowerShell, isolate host, decode and preserve the command for analyst review

A full MITRE ATT&CK coverage matrix mapped to our default detection rules is in every proposal. Ask for the sample packet.

Compliance evidence, done for you

We don't sell "compliance." We deliver the packet your auditor actually wants.

Every quarter we drop a ready-made evidence package into your portal: detection coverage, response time records, threat-hunt findings, and the runbook execution log. Your assessor finishes in days, not weeks. Your cyber-insurance broker gets the renewal questionnaire pre-filled.

SOC 2 Type II
Continuous evidence for CC7 (system operations) and CC6 (logical access). Detection-and-response procedures, response-time records, and tested runbooks all included.
HIPAA
Security Rule 164.308 administrative safeguards, audit logs retained per BAA, incident response procedures documented and tested.
PCI-DSS v4.0
Section 10 logging, Section 11 testing, and Section 12 incident response. SOC reports map directly to your QSA's checklist.
CMMC Level 2
All 110 NIST 800-171 controls evidenced. We're a registered RPO and walk you through the C3PAO assessment with the packet ready.
NIST CSF 2.0
Detect and Respond functions fully covered. The framework your cyber-insurance carrier is actually scoring you against on renewal.
ISO 27001
A.16 information security incident management. Useful for clients doing business in the EU or with multinational customers.
CJIS
Criminal Justice Information Services for agencies handling FBI-sourced data. Audit and incident response sections covered.
Cyber insurance
We complete your carrier renewal questionnaire from real telemetry, not aspirational answers. Most clients see EDR-required premium discounts apply at first renewal.
FAQ · the ones that actually block the sale

Five questions. Honest answers.

What's the actual difference between EDR alone and MDR?

EDR is the tool. MDR is the tool plus the people who watch it. CrowdStrike Falcon or SentinelOne Singularity will generate the alert, but a Tuesday-2am alert with no analyst on it is just a notification email your team will read on Wednesday.

Our SOC triages every detection, runs the playbook, and either contains or escalates with full context. We use the EDR you already own, or we deploy the one that fits your stack. You stop paying for an EDR console nobody is watching at 3am.

Will you touch our endpoints without asking?

Only on runbooks you pre-approve in onboarding. The default set is: isolate from network on confirmed malware, kill malicious process, quarantine file, disable user on confirmed account compromise. Each one is a checkbox during onboarding.

You can move any item from auto-execute to gated (we propose, you approve) or advisory (we open a ticket, you execute) at any time. Every automated action is logged to an append-only audit trail your auditor can read.

How does the SOC reach us at 3am?

Tiered by severity. P1 (active threat, containment in progress) goes to your designated 24/7 contact via PagerDuty plus a phone call from the on-call analyst. P2 (suspicious but contained, awaiting your input) goes to a shared Slack or Teams channel and email. P3 (informational, weekly hunt findings) goes into the weekly report.

We do not page you for tuning noise.

Will you replace our current MDR vendor?

Often, yes.

We run a 14-day parallel proof of value where you can compare detection quality, response time, and analyst notes side by side before you switch contracts. You keep your current vendor running until day 14.

What about cloud workloads and SaaS?

Cloud workload protection (CrowdStrike Falcon Cloud or SentinelOne Cloud Workload) is included in Enterprise MDR. Identity telemetry from Microsoft Entra and Okta is included starting at MDR + Identity.

SaaS posture (M365, Google Workspace, Salesforce, GitHub) is best paired with our cloud security service for full coverage. Most MDR-only clients add SaaS posture in year two once the EDR side is stable.

See what your EDR is missing tonight.

Our free 14-day MDR trial deploys CrowdStrike Falcon or SentinelOne Singularity to your endpoints, runs our SOC against the telemetry for two weeks, and ships a threat report. You'll see what's already on your network that your current setup is missing: stale persistence, dormant droppers, risky PowerShell habits, and any active campaign hits. Keep the report either way.

Run my free 14-day MDR trial Or call (888) 574-5120