Use it when
Use this list when one part of your environment needs managed monitoring or response coverage.
Coverage area
Identity & Access Monitoring
Providers covering Identity & Access. Confirm whether coverage means monitoring, investigation, or response.
34 providers
Arctic Wolf
24/7 threat monitoring, detection, and guided response across your entire environment — endpoints, cloud, and identity
Mid-Market / Enterprise · Endpoints
Service SOCaaS
Response Full SOC
Price ~$10/user/month
CrowdStrike Falcon Complete
24/7 threat detection, investigation, and full remote remediation — they find threats and eliminate them without you lifting a finger
Enterprise / Mid-Market · Endpoints
Service MDR
Response Contain threats
Price Around $15-25/endpoint/month plus Falcon licensing
Expel
24/7 threat detection and automated response across your existing security tools — with full transparency into every action taken
Enterprise / Mid-Market · Endpoints
Service MDR
Response Contain threats
Price Custom per-asset pricing based on integrations and environment size. Not publicly listed — request a quote.
Huntress
24/7 managed endpoint protection, identity monitoring, and SIEM — human analysts investigate and respond to threats for you
SMB / MSP/MSSP · Endpoints
Service MDR
Response Contain threats
Price Published and partner signals around $3-5/endpoint/month
Microsoft Defender Experts
24/7 threat hunting and managed response natively built into the Microsoft security stack — no additional tools or agents needed
Enterprise / Mid-Market · Endpoints
Service XDR
Response Contain threats
Price Per-user/month pricing. Requires 1,500-seat minimum. Defender Experts Suite bundles MXDR + IR + advisory.
Red Canary
24/7 threat detection and response layered on top of your existing EDR — expert analysts and automation operationalize your security tools
Mid-Market / Enterprise · Endpoints
Service MDR
Response Contain threats
Price ~$100-120/endpoint/year
SentinelOne Vigilance
AI-powered autonomous endpoint protection with 24/7 human analyst oversight — threats are contained in minutes, not hours
Enterprise / Mid-Market · Endpoints
Service MDR
Response Contain threats
Price ~$17-50/endpoint/year (on top of platform license)
Sophos MDR
24/7 threat monitoring and full incident response across your existing security tools — they work with what you already have
Enterprise / Mid-Market · Endpoints
Service MDR
Response Contain threats
Price ~$5-12/endpoint/month
Adlumin
A managed security operations platform that bundles SIEM-style log collection, behavioral analytics, response automation, and 24/7 MDR support.
Mid-Market / MSP/MSSP · Endpoints
Service MDR
Response Contain threats
Price Quote-based, directional range $2K-$15K/month
AT&T Cybersecurity
24/7 security monitoring and detection through a unified platform — with built-in threat intelligence from one of the largest open threat sharing communities
Enterprise / Mid-Market · Endpoints
Service MSSP
Response Investigate alerts
Price $1,695/year (USM Anywhere)
Binary Defense
24/7 threat detection and response from offensive security experts — using your existing SIEM and tools without vendor lock-in
Mid-Market / Enterprise · Endpoints
Service SOCaaS
Response Full SOC
Price Custom pricing based on environment size. Mid-market focused — contact for quote.
Bitdefender MDR
24/7 threat monitoring, detection, and response across endpoints, cloud, identity, email, and network — with $1M breach warranty on the PLUS tier
SMB / Mid-Market · Endpoints
Service MDR
Response Contain threats
Price Around $7-15/endpoint/month
Blackpoint Cyber
24/7 threat detection and automatic response with unique network-level lateral movement detection — stops attackers before they spread
MSP/MSSP / SMB · Endpoints
Service MDR
Response Contain threats
Price ~$8-15/endpoint/month
Blumira
Automated threat detection with guided response playbooks — a cloud SIEM you can actually use without a dedicated security team
SMB / Mid-Market · Endpoints
Service XDR
Response Investigate alerts
Price Free tier; paid plans around $12-$21/user/month
ConnectWise MDR
24/7 managed detection and response built specifically for MSPs — integrates directly into your RMM and ticketing systems
MSP/MSSP / SMB · Endpoints
Service MDR
Response Contain threats
Price Channel-only per-endpoint pricing with volume discounts. Contact ConnectWise for MSP partner pricing.
Critical Start
24/7 threat detection and response that resolves every single alert — no alert fatigue, no ignored warnings, every signal gets triaged
Enterprise / Mid-Market · Endpoints
Service MDR
Response Contain threats
Price Custom tiered pricing based on environment complexity. Not publicly listed — contact for quote.
Cybereason
24/7 threat detection, investigation, and response powered by MalOp technology that maps complete attack operations — not just isolated alerts
Enterprise / Mid-Market · Endpoints
Service MDR
Response Contain threats
Price Per-endpoint pricing with tiered service levels. Mid-market organizations typically pay $10K-$25K/month.
Cyderes
24/7 security operations with identity-first detection — specialized in catching account takeovers and identity-based attacks that other MDRs miss
Enterprise / Mid-Market · Endpoints
Service MDR
Response Contain threats
Price Fixed per-employee pricing — costs don't increase as you add more data sources or telemetry. Contact for quote.
Deepwatch
24/7 managed detection and response on top of your existing SIEM — a dedicated team of analysts that knows your environment
Enterprise / Mid-Market · Endpoints
Service MDR
Response Investigate alerts
Price Custom enterprise pricing based on environment size and SIEM platform. Average annual contracts around $220K/year.
eSentire
24/7 multi-signal threat detection and full incident response across endpoint, network, cloud, identity, and insider threats
Mid-Market / Enterprise · Endpoints
Service MDR
Response Contain threats
Price ~$15-25/endpoint/month
IBM Security
24/7 global security operations from one of the world's largest security teams — monitoring, detection, response, and strategic consulting
Enterprise / Government · Endpoints
Service MSSP
Response Co‑managed SOC
Price Enterprise custom pricing. QRadar on Cloud starts ~$800/month. Full managed services priced per organization.
LevelBlue
24/7 managed security monitoring, threat detection, and response through a unified platform — with deep compliance support and FedRAMP authorization for government workloads
Enterprise / Mid-Market · Endpoints
Service MSSP
Response Contain threats
Price Custom per-asset pricing based on environment size and service tier. Mid-market deployments typically run $8K-$25K/month; enterprise engagements range from $25K-$75K/month.
Mandiant / Google Security Operations
24/7 managed detection and response from the world's most experienced incident response team — detection rules written by the same experts investigating nation-state breaches
Enterprise / Mid-Market · Endpoints
Service MDR
Response Contain threats
Price Custom enterprise pricing — contact for quote. Premium tier reflecting Mandiant's IR expertise and Google-scale analytics. Expect $ pricing.
Netsurion
Co-managed security monitoring where your team and theirs share the same dashboard — 24/7 coverage without losing control
Mid-Market / SMB · Endpoints
Service Co‑managed SOC
Response Co‑managed SOC
Price ~$3,000-$5,000/month
NTT Security
24/7 global security operations from one of the world's largest IT services companies — monitoring, detection, and incident response at massive scale
Enterprise / Government · Endpoints
Service MSSP
Response Contain threats
Price Custom enterprise pricing based on organization size and services. Contact for quote.
Proficio
24/7 global threat detection and rapid automated response — follow-the-sun SOCs mean analysts are always working during business hours
Enterprise / Mid-Market · Endpoints
Service MDR
Response Contain threats
Price Custom per-asset pricing based on environment size and selected services. Contact for quote.
Rapid7 MDR
24/7 threat detection and response bundled with unlimited vulnerability management — detect threats and fix the weaknesses they exploit
Enterprise / Mid-Market · Endpoints
Service MDR
Response Contain threats
Price ~$17/asset/month
ReliaQuest
A force-multiplier for your existing security team — AI and analysts that make your current tools work better together and respond faster
Enterprise / Mid-Market · Endpoints
Service Co‑managed SOC
Response Co‑managed SOC
Price Enterprise custom pricing. Average engagements around $170K/year. Large enterprises can exceed $1M/year.
Secureworks
24/7 threat detection, investigation, and response powered by Taegis XDR — backed by one of the industry's oldest threat research teams
Enterprise / Mid-Market · Endpoints
Service XDR
Response Contain threats
Price Custom enterprise pricing based on organization size and selected services. Contact for quote.
Todyl
One platform that replaces your firewall, SIEM, EDR, and SOC — true convergence instead of bolting tools together
MSP/MSSP / SMB · Endpoints
Service MDR
Response Contain threats
Price Channel-only tiered pricing: Essentials, Advanced, and Complete. Custom quotes through MSP partners.
Trend Micro MDR
24/7 managed detection and response across endpoint, email, cloud, network, and OT — powered by the broadest native XDR platform and Zero Day Initiative threat intelligence
Enterprise / Mid-Market · Endpoints
Service XDR
Response Contain threats
Price Credit-based licensing via Vision One platform. MDR add-on pricing varies by coverage scope. Mid-market deployments typically run $15K-$40K/month; enterprise ranges from $40K-$150K+.
Trustwave
24/7 managed security operations with full incident response — backed by SpiderLabs, one of the industry's elite threat research teams
Enterprise / Mid-Market · Endpoints
Service MSSP
Response Co‑managed SOC
Price Custom enterprise pricing. Typical mid-market engagements range $5K-$20K/month. Government and large enterprise contracts vary.
UnderDefense
24/7 threat monitoring, detection, and active response from a dedicated security team — with transparent pricing and fast onboarding
SMB / Mid-Market · Endpoints
Service MDR
Response Full SOC
Price Published pricing on website. Flat-fee and per-endpoint options. Most SMBs pay $2K-$5K/month.
Vectra AI MXDR
24/7 managed detection, investigation, and response across network, identity, and cloud — powered by 170+ AI models that catch the threats your EDR misses
Enterprise / Mid-Market · Endpoints
Service MDR
Response Contain threats
Price Custom pricing based on IP address count and environment scope. A mid-market deployment typically runs $15K-$40K/month; enterprise engagements range from $40K-$150K+.
How to use this list
Do not assume
Coverage does not always mean action. Some providers monitor a source but cannot contain threats there.
Ask before shortlisting
- Confirm which telemetry sources are included by default.
- Ask whether response actions work on this surface or only alerting is included.
- Check whether reporting and detection tuning are part of the managed service.
Category background
These SOC providers monitor your identity and access systems — Active Directory, Azure AD/Entra, Okta, Duo, and other IAM platforms. With 80%+ of breaches involving compromised identities, this is the fastest-growing detection category.
Why Identity Monitoring Matters
Stolen credentials don’t trigger endpoint alerts. An attacker logging in with valid credentials from an unusual location at 3 AM looks normal to endpoint tools. Identity monitoring detects impossible travel, credential stuffing, MFA bypass, privilege escalation, and lateral movement across your identity systems — catching the attacks that endpoint-only providers miss.
Questions
What is identity threat detection and response (ITDR)?
ITDR monitors your identity systems — Active Directory, Azure AD/Entra, Okta, Duo — for signs of compromised credentials, unauthorized access, privilege escalation, and lateral movement. Since 80%+ of breaches involve stolen or compromised identities, ITDR has become one of the fastest-growing detection categories. Providers like Huntress, CrowdStrike, and Microsoft offer managed ITDR as part of their SOC services.
Why do I need identity monitoring separate from endpoint monitoring?
Attackers increasingly bypass endpoints entirely by using stolen credentials, phishing for MFA tokens, or exploiting identity provider misconfigurations. An attacker with valid credentials looks like a legitimate user to endpoint tools. Identity monitoring watches for impossible travel, unusual authentication patterns, privilege escalation, and credential abuse across your identity infrastructure — threats that endpoint-only monitoring misses.