Managed security services (MDR and MSSP)

Security operations run for you 4 companies

The customer's laptops, firewalls and cloud accounts send their alerts to the contractor's security operations centre. An older kind of service only passes the alert on to the customer. Managed detection and response (MDR) goes further: the contractor investigates the alert and stops the attack itself, for example by cutting a laptop off the network.

DeepwatchDeepwatch, also with engineers in Bengaluru, sells managed detection and response, and a service that finds security flaws.Bengaluru

Arctic WolfArctic Wolf is by far the largest of these companies, and has engineers in Bengaluru. It began with managed detection and response, and now adds checks for security flaws, cloud settings and security training to the same service.

Critical StartCritical Start, from Texas with engineers in Pune, checks every alert before it reaches the customer, so the customer sees only the ones that matter. It also runs a SIEM for customers who own one.

eSentireeSentire is the oldest of these companies. It runs its service on its own platform, Atlas, so the customer does not need to own a SIEM at all.

The tech, explainedManaged detection and response (MDR)SIEM

A platform shared with the contractor 1 company

This platform sits above the security tools that a customer already owns, whoever made them. It collects their alerts and runs the response automatically, and both the customer's own team and the contractor's analysts work in it.

ReliaQuestReliaQuest, from Tampa with engineers in Pune, sells GreyMatter, a platform that sits above whatever security tools a customer owns, collects their alerts and runs the response automatically.

The tech, explainedSecurity operations platform SOAR AI SOC analyst

How it all worksSecurity operations centre (SOC)Every alert lands here, around the clock.

See how it works →

What's changing

AI is becoming the first analyst.

These companies sell people's time, and analysts are hard to hire. So they now use AI models to read each alert first, collect the evidence and decide whether it matters. Their analysts then deal only with the alerts that the AI could not close.