MDR providers
We list 100 companies active in managed detection and response, and 22 of them have it as their main focus. 9 are public, 22 are owned by another company and 69 are private. Most are based in the United States (60). The oldest, REJIS, was founded in 1974. By revenue from annual reports, the largest company here is Microsoft ($331.8bn in FY2026).
By countryUnited States 60United Kingdom 12
Companies focused on managed detection and response
22 companies| Company | Based in | Founded | Size | Ownership | Revenue |
|---|---|---|---|---|---|
LevelBlue (formerly Trustwave) Managed security provider that now runs Trustwave's SpiderLabs penetration testing team, with CREST-accredited testing, red and purple teaming, and deep PCI DSS expertise. | Chicago, United States | 1995 | 500+ staff | Private | |
WithSecure Helsinki-headquartered Finnish cybersecurity firm with roots dating to 1988, offering CREST-accredited penetration testing and deep expertise in EU regulatory compliance including GDPR, NIS 2, and TIBER-EU. | Helsinki, Finland | 1988 | 500+ staff | Owned by CVC Capital Partners | |
Integrity360 CREST-accredited pan-European cybersecurity services provider delivering penetration testing and managed security from Dublin with a strong UK and Ireland presence. | Dublin, Ireland | 2005 | 201-500 staff | Owned by August Equity | |
DeepSeas (formerly RedTeam Security) RedTeam Security is now part of DeepSeas, which offers penetration testing, red teaming and physical testing as its offensive security practice. | Atlanta, United States | 2012 | 11-50 staff | Private | |
Arctic Wolf Arctic Wolf provides managed security operations, threat detection and incident response services to organisations. | Eden Prairie, United States | 2012 | Private | ||
A Armor Provides cloud security, compliance and managed detection and response services to regulated industries. | Plano, United States | 2009 | Private | ||
Binary Defense Binary Defense provides managed detection and response services and an AI-powered security platform. | Stow, United States | Private | |||
Critical Start Critical Start provides managed detection and response services to monitor, investigate, and resolve security threats for organisations. | Plano, United States | 2012 | Owned by Vista Equity Partners | ||
CybaVerse CybaVerse provides a unified cyber security operations platform called CybaOps. | Portsmouth, United Kingdom | 2018 | Private | ||
Cyderes Cyderes provides managed cybersecurity services including identity, threat detection, and exposure management. | Kansas City, United States | Private | |||
DEFION Security DEFION Security is an independent security partner that has operated since 2005. | Zoetermeer, Netherlands | 2005 | Private | ||
eSentire eSentire provides managed detection and response services to protect organisations from cyber threats. | Waterloo, Canada | 2001 | Private | ||
Expel Expel provides managed detection and response security services using AI and human analysts. | Herndon, United States | 2016 | Private | ||
Foresite Cybersecurity Foresite provides managed detection and response services using agentic AI for security operations. | Overland Park, United States | Private | |||
Huntress Huntress provides managed cybersecurity services including endpoint detection, identity threat detection, and security awareness training. | Columbia, United States | Private | |||
Kaseya Kaseya provides software for IT management, security and automation to IT teams and managed service providers. | Miami, United States | 2000 | Private | ||
Ontinue Ontinue provides managed detection and response services for Microsoft security customers. | Redwood City, United States | Owned by Quorum Cyber | |||
Quzara Quzara provides FedRAMP compliance advisory and managed detection and response services. | Vienna, United States | Private | |||
UnderDefense UnderDefense provides managed detection and response, incident response, and compliance automation services. | New York, United States | 2017 | Private | ||
WISECLICK WISECLICK sells cybersecurity memberships to small businesses and solo professionals in Australia. | Australia, Australia | 2024 | Private | ||
Y Yarix Italian Var Group security firm that absorbed Munich automotive consultancy CYRES and offers a vehicle SOC service. | Treviso, Italy | Owned by Var Group | |||
R Red Canary Zscaler provides cloud-based security, network and transformation services for enterprises. | Santa Clara, United States | 2014 | Part of Zscaler |
Also active in managed detection and response
78 companies| Company | Based in | Founded | Size | Ownership | Revenue |
|---|---|---|---|---|---|
Microsoft Microsoft sells software, cloud services, hardware, and gaming products. | Redmond, United States | 1975 | 228,000 staff | Public, MSFT | $331.8bn (FY2026) |
Palo Alto Networks Palo Alto Networks provides cybersecurity platforms and services to protect organizations from cyber threats. | Santa Clara, United States | 2005 | 13,900 staff | Public, PANW | $11.5bn (FY2026) |
CrowdStrike CrowdStrike provides AI-native cybersecurity solutions to stop breaches. | Austin, United States | 2011 | 7,925 staff | Public, CRWD | $4.8bn (FY2026) |
Check Point Check Point Software provides cyber security solutions including network, cloud, and AI security. | Tel Aviv, Israel | 1993 | Public, CHKP | $2.7bn (FY2025) | |
SentinelOne SentinelOne provides an AI-native cybersecurity platform for endpoint, identity, and cloud protection. | Mountain View, United States | 2013 | Public, S | $1.0bn (FY2026) | |
Rapid7 Rapid7 provides AI-powered managed cybersecurity operations, including MDR, SIEM, and vulnerability management. | Boston, United States | 2000 | 500+ staff | Public, RPD | $859.8m (FY2025) |
Varonis Varonis provides data security software that protects data across cloud, SaaS and on-premises environments. | Miami, United States | 2005 | Public, VRNS | $623.5m (FY2025) | |
K Kaspersky Kaspersky develops antivirus and internet security software for home users and businesses. | Moscow, Russia | 1997 | 3,600 staff | Private | |
Bitdefender Bitdefender provides cybersecurity software and services for consumers, businesses, and governments. | Bucharest, Romania | 2001 | 1,800 staff | Private | |
Darktrace Darktrace provides AI-powered cybersecurity solutions that detect and respond to threats across networks, cloud, email, and AI systems. | Cambridge, United Kingdom | 2013 | 1,600 staff | Owned by Thoma Bravo | |
ESET ESET provides cybersecurity software for home users, businesses, and enterprises. | Bratislava, Slovakia | 1992 | 1,000 staff | Private | |
ThreatLocker Provides Zero Trust cybersecurity software controlling application execution, network access and privileged access for organisations. | Orlando, United States | 2017 | 700 staff | Private | |
Claranet CREST and CHECK-accredited European managed services provider delivering penetration testing with deep infrastructure and cloud hosting expertise. | London, United Kingdom | 1996 | 500+ staff | Private | |
NCC Group Global cybersecurity consultancy with CREST, CHECK, and CBEST accreditation, renowned for deep technical research and penetration testing services. | Manchester, United Kingdom | 1999 | 500+ staff | Public, NCC | |
Redscan (A Kroll Business) London-based cybersecurity provider, now part of Kroll, delivering CREST-accredited penetration testing, managed detection and response, and incident response with a 550-strong cyber team. | London, United Kingdom | 2002 | 500+ staff | Part of Kroll | |
Sophos Sophos provides cybersecurity products and managed detection and response services to organisations worldwide. | Atlanta, United States | 1999 | 500+ staff | Owned by Thoma Bravo | |
G Data CyberDefense G DATA CyberDefense AG is a German cybersecurity company based in Bochum. | Bochum, Germany | 1985 | 500 staff | Private | |
Bridewell Fast-growing CREST and CHECK-accredited UK cybersecurity consultancy with deep expertise in critical national infrastructure sectors. | Bristol, United Kingdom | 2013 | 201-500 staff | Owned by I-TRACING | |
The Missing Link Sydney-headquartered Australian cybersecurity firm founded in 1997, now part of Infosys. CREST-approved with OSCP, OSCE, and OSEE-certified testers. | Sydney, Australia | 1997 | 201-500 staff | Owned by Infosys | |
Argos Security GmbH Argos Security GmbH is a German cyber defence provider with an AI-supported centre in Munich. | Munich, Germany | 1999 | 100 staff | Owned by Sophora Unternehmerkapital | |
CyberLab Cardiff-based CREST and CHECK-accredited cyber security company delivering penetration testing, red teaming, and OT security assessments as part of the Chess Group. | Cardiff, United Kingdom | 2020 | 51-200 staff | Owned by Chess | |
Pen Test Partners The UK's largest independent security testing firm, renowned for IoT/OT research, CBEST red teaming, and CHECK/CREST-accredited penetration testing across all sectors. | Buckingham, United Kingdom | 2010 | 51-200 staff | Private | |
ThreatSpike Red London-based cybersecurity firm offering unlimited, fixed-price penetration testing and red teaming services with ISO 27001 certification and a unique subscription model. | London, United Kingdom | 2011 | 51-200 staff | Private | |
JUMPSEC Full-service London-based cybersecurity consultancy with CREST, CHECK, and NCSC accreditations delivering offensive testing, managed detection, and strategic advisory services. | London, United Kingdom | 2012 | 11-50 staff | Private | |
R Redpoint Cybersecurity US-wide pen testing firm serving major cities including Atlanta, Dallas, Denver, Houston, and Miami with security assessments. | Denver, United States | 2015 | 11-50 staff | Private | |
7AI 7AI provides AI agents that automate security operations centre tasks for enterprises. | Boston, United States | 2024 | Private | ||
Alcott Enterprises Managed IT Services & Cybersecurity Alcott Enterprises is a managed IT service provider and cybersecurity company based in Los Angeles. | Torrance, United States | 2014 | Private | ||
Artemis Security Artemis Security provides an AI-native security operations platform that detects, investigates and responds to cyber attacks. | New York, United States | Private | |||
Barracuda Networks Barracuda Networks provides cybersecurity solutions for email, networks, applications, and data. | Campbell, United States | 2003 | Owned by KKR | ||
Blumira Blumira provides a security operations platform for IT teams to detect and respond to threats. | Ann Arbor, United States | Private | |||
Boston Managed IT Boston Managed IT is a managed service provider based in Waltham, Massachusetts, founded in 2017. | Waltham, United States | 2015 | Private | ||
Cofense Cofense provides phishing detection and response services using AI and human validation. | Arlington, United States | Private | |||
Comodo Group Comodo Group sells cybersecurity products and services to businesses and organisations. | Clifton, United States | 1998 | Private | ||
CyberSheath CyberSheath provides cybersecurity compliance services for DOD contractors, focusing on CMMC, DFARS, and NIST standards. | Reston, United States | 2012 | Private | ||
Cydome Provides cybersecurity protection and risk management for maritime vessels, offshore facilities and ports. | London, United Kingdom | Private | |||
Cyngular Cyngular provides an agentic security operations centre platform that autonomously detects, investigates and resolves cyber threats. | Giv'atayim, Israel | 2021 | Private | ||
D3 Security D3 Security provides an agentic SOC platform that autonomously triages, investigates, and responds to security alerts. | Vancouver, Canada | 2002 | Private | ||
Datto Datto provides backup and disaster recovery, endpoint management, professional services automation, networking and cybersecurity solutions. | Norwalk, United States | 2007 | Part of Kaseya | ||
Deloitte Cyber advisory and managed security services, including managed extended detection and response, cloud security, digital identity and threat intelligence, from a global professional services network. | London, United Kingdom | Private | |||
Dragos Dragos provides cybersecurity for industrial control systems and operational technology environments. | Houston, United States | 2016 | Part of Accenture | ||
Dropzone AI Dropzone AI builds AI agents that investigate security alerts and hunt threats for security teams. | Seattle, United States | 2022 | Private | ||
Druva Druva provides a fully managed SaaS platform for data backup, recovery, and cyber resilience. | Sunnyvale, United States | 2008 | Private | ||
Exaforce Exaforce provides an agentic AI platform for security operations, detection, triage, investigation and response. | San Jose, United States | 2023 | Private | ||
Fleet Defender Hardware and software that detect cyber attacks and cargo theft on fleet vehicles, backed by a vehicle SOC. | Omaha, United States | Private | |||
Globalgig Globalgig provides managed security and network services to enterprises across multiple countries. | San Antonio, United States | Private | |||
Group-IB Group-IB provides cybersecurity products and services to prevent digital crime. | Singapore, Singapore | 2003 | Private | ||
Intezer Intezer provides an AI-powered security operations center that investigates all alerts at forensic depth. | New York, United States | 2015 | Private | ||
ITSECOPS ITSecOps provides managed IT, cybersecurity and compliance services to organisations worldwide. | Greater Noida, India | Private | |||
Laucked Laucked is a French cybersecurity firm based in Toulouse that provides penetration testing and continuous security monitoring for small and medium-sized businesses. | Tournefeuille, France | 2025 | Private | ||
LogPulse LogPulse provides log management and security monitoring hosted in the EU. | Netherlands | 2026 | Private | ||
Lorikeet Security Lorikeet Security provides penetration testing, incident response, and security leadership services. | Kissimmee, United States | 2021 | Private | ||
MonsterCloud MonsterCloud provides managed cloud, IT and cyber security services, including ransomware recovery, to businesses across the United States. | Hollywood, United States | Private | |||
Netrio Netrio provides managed IT, cybersecurity, cloud, and connectivity services to mid-market enterprises. | McKinney, United States | Private | |||
NINJIO NINJIO provides cybersecurity awareness training and human risk management through personalised coaching and phishing simulations. | Westlake Village, United States | Private | |||
nuHarbor nuHarbor provides cybersecurity services and managed security operations to organisations across government, healthcare, finance and enterprise. | United States | 2013 | Private | ||
PlaxidityX Israeli automotive security firm selling in-vehicle intrusion detection, theft prevention, fleet monitoring, TARA and penetration testing. | Herzliya, Israel | 2014 | Part of Elektrobit | ||
Protos AI Protos AI provides managed adversary risk intelligence by collecting and analysing threat signals for organisations. | Singapore, Singapore | Owned by Protos Labs | |||
Red Piranha Red Piranha provides cybersecurity technology that consolidates protection, detection, and response across cloud, on-prem, and endpoints. | Australia | Private | |||
REJIS REJIS provides technology solutions for public safety and government agencies. | St. Louis, United States | 1974 | Private | ||
ReliaQuest ReliaQuest provides an AI security operations platform for enterprises to detect and respond to threats. | Tampa, United States | Private | |||
SCYTHE SCYTHE provides a platform for continuous adversarial exposure validation across IT, cloud, and OT environments. | Columbia, United States | 2018 | Private | ||
Securonix Securonix provides a cloud-native platform for security operations, combining SIEM, UEBA, SOAR and threat intelligence. | San Mateo, United States | 2008 | Private | ||
SonicWall SonicWall provides unified cybersecurity for SMBs, MSPs, and IT teams. | Milpitas, United States | 1991 | Owned by Francisco Partners and Elliott Investment Management | ||
STACK Cybersecurity Provides managed IT services, cybersecurity, compliance support and AI adoption guidance to businesses. | Livonia, United States | Owned by IT Solutions | |||
Sygnia Sygnia provides cyber incident response, readiness, and managed detection and response services to enterprises worldwide. | Tel Aviv, Israel | 2015 | Private | ||
Tranzhalo Georgia start-up whose TranzSecure service flags cyber attacks, unknown devices and cargo theft across trucking fleets. | Alpharetta, United States | Private | |||
Trend Micro Trend Micro provides cybersecurity products and services for businesses and individuals worldwide. | Tokyo, Japan | 1988 | Public, 4704 | ||
Vectra AI Vectra AI provides AI-native security and observability to detect and respond to cyber threats. | San Jose, United States | 2011 | Private | ||
WatchGuard WatchGuard provides unified cybersecurity solutions for networks, endpoints, identities, and cloud environments. | Seattle, United States | 1996 | Owned by Vector Capital | ||
XTIUM Provides managed IT services including security, cloud desktops, networks and AI deployment support. | Oldsmar, United States | Private | |||
Athena Agentic Athena Agentic provides a unified cyber operations platform that automates detection, response, and hardening. | Dallas, United States | Private | |||
Cantina Cantina provides an agentic security platform that uses autonomous AI agents to detect, respond to, and fix security issues. | Miami, United States | Private | |||
IRONVALD IRONVALD provides autonomous cybersecurity defence for critical infrastructure and industrial control systems. | Sarajevo, Bosnia and Herzegovina | 2025 | Private | ||
ITSS L.L.C-FZ ITSS provides managed cybersecurity services including detection, response, and penetration testing from Dubai. | Dubai, United Arab Emirates | 2012 | Private | ||
J Joe Security Joe Security provides automated and analyst-driven malware and phishing analysis through its Joe Sandbox platform. | Switzerland | Private | |||
Kyndryl Managed security operations, threat intelligence and incident response services delivered from global security operations centres by an IT infrastructure services provider. | New York, United States | Private | |||
M Mandiant Mandiant provides threat intelligence and incident response, now sold as Google Threat Intelligence alongside VirusTotal within Google Cloud. | United States | 2004 | Part of Google | ||
Sangfor Technologies Next generation firewalls, endpoint protection, secure web gateway, NDR, SASE and managed detection and response, plus hyperconverged infrastructure and virtual desktop products. | Shenzhen, China | Private |
Recent deals in managed detection and response
All managed detection and response dealsAcquisitions come from SecurityWeek's monthly M&A round-ups from 2021 onwards, from Cybersecurity Ventures' quarterly M&A reports for 2020, and a few from Wikipedia lists. These are dated to the month. A few deals added from the news are dated to the day. Smaller deals may be missing. Amounts are in US dollars.
More in Security Services & MSSPs
See every category- Penetration testing companies 210 companies
- Managed security service providers 106 companies
- Incident response firms 104 companies
- Cybersecurity consulting firms 171 companies
- Bug bounty platforms 14 companies