Managed Security Service Providers: 7 Companies compared
Managed Security Service Providers and MDR firms compared on services, EDR-stack neutrality, transparency posture, and delivery model. From vendor-neutral cloud-native MDR to traditional 24/7 SOC outsourcing.
By use case
Our read on which firm suits which job. Editorial, not paid, and separate from the alphabetical listing below.
Red Canary (a Zscaler company)
Reference-class MDR for organisations standardising on Defender for Endpoint and Sentinel.
Expel
Pure-API, no agent. Layers a transparent SOC on top of whatever EDR / SIEM / cloud stack you already own.
Arctic Wolf
Concierge Security Team gives mid-market buyers a named point of contact and a security operations warranty.
Quick comparison
All managed security service providers companies side by side, alphabetical.
| Company | Founded | Engagement | Specialism | Standards / accreditations |
|---|---|---|---|---|
| UnderDefense | 2017 | Per device or asset per month on an annual contract, plus project fees for penetration testing and compliance work | Mid-market organisations that want a 24/7 outsourced SOC layered onto security tools they… | SOC 2 Type I (attested by Prescient Assurance, November 2024) |
| Arctic Wolf | 2012 | Per-asset managed service (annual contract) | Organizations without in-house security expertise wanting fully managed vulnerability sca… | — |
| Critical Start | 2012 | Subscription per integrated surface | Mid-market and enterprise teams that already own EDR/XDR and want managed response with s… | SOC 2 Type II |
| eSentire | 2001 | Subscription tiers (Atlas Essentials / Advanced / Complete) | Financial services, legal, and insurance firms that want a mature MDR partner with deep v… | SOC 2 Type IIISO 27001 |
| Expel | 2016 | Subscription per integrated surface | Teams that already own a quality EDR/SIEM/cloud stack and want a transparent, vendor-neut… | SOC 2 Type II |
| Red Canary (a Zscaler company) | 2013 | Subscription per managed surface | Microsoft-centric organisations wanting Defender / Sentinel telemetry analysed by a high-… | SOC 2 Type II |
| Secureworks (a Sophos company) | 1999 | Subscription + project services | Mid-to-large enterprises wanting a vendor-open MDR with strong threat intel and an embedd… | SOC 2 Type IIISO 27001PCI DSS |
Arctic Wolf
Managed Security Service ProvidersOrganizations without in-house security expertise wanting fully managed vulnerability scanning and prioritized remediation guidance
Arctic Wolf is a managed security operations platform that includes managed vulnerability management as part of its Concierge Security approach. Rather than providing a self-service vulnerability scanning tool, Arctic Wolf assigns dedicated security engineers (the Concierge Security Team) who configure, run, and interpret vulnerability scans on the customer's behalf, delivering prioritized remediation guidance. This managed approach targets organizations that lack in-house vulnerability management expertise and want a turnkey service rather than a platform they must operate themselves.
Critical Start
Managed Security Service ProvidersMid-market and enterprise teams that already own EDR/XDR and want managed response with strong noise reduction
Founded in 2012 by Rob Davis to address alert fatigue, Critical Start's Trusted Behavior Registry (TBR) auto-resolves known-good behaviours at scale so analysts focus on true positives. The MOBILESOC iOS/Android app lets customers triage, escalate, and contain incidents from a phone. The firm runs MDR across multiple third-party EDR/XDR/SIEM stacks rather than shipping its own endpoint agent.
eSentire
Managed Security Service ProvidersFinancial services, legal, and insurance firms that want a mature MDR partner with deep vertical playbooks
eSentire is one of the longest-operating pure-play MDR firms, protecting more than 2,000 organisations across 80+ countries. Its proprietary Atlas platform ingests signals across the customer's vendor stack and powers the firm's 24/7 SOC, threat hunting, and incident response. It runs an in-house Threat Response Unit (TRU) for original research and is well known for deep specialisation in financial services, legal, and insurance verticals.
Expel
Managed Security Service ProvidersTeams that already own a quality EDR/SIEM/cloud stack and want a transparent, vendor-neutral SOC layered on top
Founded in May 2016 by ex-Mandiant/FireEye veterans Dave Merkel, Justin Bajko, and Yanek Korff, Expel takes a deliberate stance: no proprietary agent, full transparency into SOC activity via the Workbench portal, and integration with whatever security tools the customer already owns. The company reached unicorn status in November 2021 and was named a Leader in The Forrester Wave for MDR Services, Q1 2025. Independent and private.
Red Canary (a Zscaler company)
Managed Security Service ProvidersMicrosoft-centric organisations wanting Defender / Sentinel telemetry analysed by a high-fidelity detection-engineering team
Red Canary delivers managed detection and response built on detection engineering rigor and broad telemetry ingestion (Microsoft Defender, CrowdStrike, SentinelOne, Palo Alto, Zscaler, AWS, Google Cloud, 200+ tools). It is widely regarded as a reference partner for organisations standardising on Microsoft Defender for Endpoint and Sentinel. Zscaler closed the $692M acquisition on August 1, 2025; Red Canary operates as a separate business unit within Zscaler.
Secureworks (a Sophos company)
Managed Security Service ProvidersMid-to-large enterprises wanting a vendor-open MDR with strong threat intel and an embedded SIEM, especially in regulated verticals
Secureworks pioneered the modern MSSP model and was majority-owned by Dell before its acquisition by Sophos in an $859M deal that closed February 2025. The Taegis platform (MDR, XDR, NDR, VDR, embedded SIEM) continues as a standalone, vendor-open product line within Sophos with native Sophos Endpoint integration. The Counter Threat Unit (CTU) remains a key differentiator.
UnderDefense
Managed Security Service ProvidersMid-market organisations that want a 24/7 outsourced SOC layered onto security tools they already own, often alongside SOC 2 or ISO 27001 readiness work.
UnderDefense is a managed security services firm offering 24/7 managed detection and response, managed SOC and SIEM, incident response, penetration testing and compliance services. Delivery is vendor-agnostic: the firm's MAXI platform layers alert triage, automation and reporting on top of a client's existing EDR and SIEM tools, and it operates co-managed SIEM on Elastic, Splunk, QRadar, LogRhythm and Sumo Logic. Founded in 2017, it is headquartered in New York and runs delivery teams from Jacksonville in the US, Krakow in Poland and Lviv in Ukraine. Its own site states 120 certified security engineers across three continents.
Related guides
Other categories you might be evaluating alongside managed security service providers.
About this listing
Managed Security Service Providers companies, listed alphabetically and compared on public information. How we work →