Explainer · checked 2026-11-08
Managed SOC and SOC as a service
A managed SOC (also sold as SOC as a service or an outsourced SOC) is a provider’s security operations team watching your logs and alerts 24/7. MDR is the narrower, response-first version; an MSSP mostly runs security devices. Of 27 providers here, 9 say they can work in a SIEM you already own (5 of them also offer a platform of their own); 18 work only on their own platform.
Managed SOC, MDR, MSSP and managed SIEM
Four services that overlap, and that providers often bundle. The useful questions are what gets watched, who responds, and whose SIEM it runs on.
| Managed SOC | MDR | MSSP | Managed SIEM | |
|---|---|---|---|---|
| What they watch | Logs and alerts from across the estate, through a SIEM | Endpoint, identity and cloud alerts, often from an EDR or XDR | The security devices they manage (firewalls, VPN, email filtering) | The SIEM itself: sources, rules, health |
| Do they respond? | Varies: many escalate to you, some act | Yes, that is the point: containment, often remediation | Often alert-only, unless MDR is added | No: it is the platform, not the people |
| Whose SIEM | Theirs or yours | Theirs, or none (EDR-centred) | Theirs, if any | Yours (they run it) or theirs |
| Good fit when | You need broad log coverage and audit evidence | You want threats stopped, fast, by someone else | You want devices run for you | You have analysts but no SIEM engineers |
Security operations centre (SOC). “The role of a SOC is to limit the damage to an organisation by detecting and responding to cyber attacks that successfully bypass your preventative security controls.” — The UK National Cyber Security Centre
Managed security service provider (MSSP). “‘managed security service provider’ means a managed service provider that carries out or provides assistance for activities relating to cybersecurity risk management” — The EU NIS2 Directive, Article 6(40)
Security information and event management (SIEM). “A SIEM is a type of software platform that collects, centralises, and analyses log data.” — The Australian Cyber Security Centre, with CISA and partners
On your SIEM, or on theirs
If you already pay for a SIEM, a provider that works inside it saves a migration and keeps your logs where they are. If you don't, a provider with its own platform brings one.
Works in a SIEM you own (9)
| Binary DefenseMDR specialist | Works in the customer’s SIEM; supported platforms listed: Microsoft Sentinel, Sumo Logic, Palo Alto Networks XSIAM, CrowdStrike NG-SIEM… source |
| eSentireMDR specialist | Own Atlas SIEM (log detection; 90-day retention in Atlas Enhanced, 365-day in Atlas Elite). Also works with Microsoft Sentinel, Splunk and… source |
| ExpelMDR specialist | No SIEM required (Workbench is not a SIEM). Ingests from the customer’s SIEM: Splunk, Microsoft Sentinel, Google Security Operations, Sumo… source |
| Red Canary (Zscaler)MDR specialist | Not a SIEM-based service. Sends MDR alerts to the customer’s SIEM, SOAR or ITSM; its Microsoft listing says it takes Microsoft Sentinel… source |
| BlueVoyantMDR specialist | Works in the customer’s Microsoft Sentinel or Splunk (MDR for Splunk); also Cisco XDR source |
| Critical StartMDR specialist | Microsoft Sentinel, Splunk, Sumo Logic and CrowdStrike Falcon Next-Gen SIEM (monitoring), plus Microsoft Defender XDR; own Security Data… source |
| DeepwatchMDR specialist | Works in the customer’s SIEM (‘SIEM-agnostic’, bring your own technology): Splunk, Microsoft Sentinel, Google SecOps, Securonix, plus a… source |
| OntinueMDR specialist | Works in the customer’s own Microsoft Sentinel (required for ION MXDR; data stays in the customer’s tenant) source |
| Trustwave (LevelBlue)Security services firm | Own platform: Fusion. Co-managed SOC services for customer SIEMs including Microsoft Sentinel and SentinelOne Singularity AI SIEM; an MXDR… source |
Brings its own platform (23)
| Field EffectMDR specialist | Own platform; log retention 90 days on MDR Endpoint and MDR Core, 90 days up to 7 years on MDR Complete (longer options include… source |
| HuntressMDR specialist | Own: Huntress Managed SIEM (priced per data source) source |
| Rapid7EDR vendor’s MDR | Own: Rapid7 SIEM (InsightIDR) included with every Managed Threat Complete tier; unlimited data ingestion, 13 months data retention source |
| Arctic WolfMDR specialist | Own platform (Aurora Superintelligence Platform, open XDR); ingests logs from sensors, cloud log forwarding and syslog; Arctic Wolf says it… source |
| BitdefenderEDR vendor’s MDR | Own platform: Bitdefender GravityZone source |
| eSentireMDR specialist | Own Atlas SIEM (log detection; 90-day retention in Atlas Enhanced, 365-day in Atlas Elite). Also works with Microsoft Sentinel, Splunk and… source |
| ExpelMDR specialist | No SIEM required (Workbench is not a SIEM). Ingests from the customer’s SIEM: Splunk, Microsoft Sentinel, Google Security Operations, Sumo… source |
| Red Canary (Zscaler)MDR specialist | Not a SIEM-based service. Sends MDR alerts to the customer’s SIEM, SOAR or ITSM; its Microsoft listing says it takes Microsoft Sentinel… source |
| SophosEDR vendor’s MDR | Own: Sophos Fusion / Sophos Data Lake, ingesting alerts and telemetry from integrated Sophos and third-party products source |
| Adlumin (N-able)MDR specialist | Own: Adlumin XDR platform with built-in SIEM (Managed ITDR tier limited to Microsoft data); data retention 30 days (Managed ITDR, MDR… source |
| Blackpoint CyberMDR specialist | Own: CompassOne LogIC, described as a ‘SIEM alternative’ for compliance logging with 365 days of retention source |
| Critical StartMDR specialist | Microsoft Sentinel, Splunk, Sumo Logic and CrowdStrike Falcon Next-Gen SIEM (monitoring), plus Microsoft Defender XDR; own Security Data… source |
| CrowdStrikeEDR vendor’s MDR | Own: Falcon Next-Gen SIEM (Falcon Complete offers detection and response for third-party data from Next-Gen SIEM); no third-party EDR… source |
| FortinetEDR vendor’s MDR | The MDR service monitors FortiEDR alerts. The separate SOCaaS uses FortiSIEM as its primary analytics platform for multi-vendor monitoring… source |
| Palo Alto Networks Unit 42EDR vendor’s MDR | Customer’s own Cortex XDR Pro or Cortex XSIAM; higher SKUs also monitor network, cloud, identity and third-party cases generated by the… source |
| Secureworks (Sophos Taegis)EDR vendor’s MDR | Own: Taegis XDR with Next-Gen SIEM (one year of retention as standard, up to five years) source |
| SentinelOneEDR vendor’s MDR | Own: SentinelOne Singularity Platform; MDR Essentials and Elite coverage lists “Endpoint, Cloud, Identity & Supported 3rd Party… source |
| Trustwave (LevelBlue)Security services firm | Own platform: Fusion. Co-managed SOC services for customer SIEMs including Microsoft Sentinel and SentinelOne Singularity AI SIEM; an MXDR… source |
| KrollSecurity services firm | CrowdStrike Falcon Next-Gen SIEM, implemented and operated by Kroll source |
| Mandiant (Google Cloud)Security services firm | Runs on Google Security Operations (SecOps); curated-detection coverage depends on the customer’s Google SecOps license source |
| Trend MicroEDR vendor’s MDR | Own platform: TrendAI Vision One. The 2025 services brief says the MDR also monitors ‘third-party logs’ source |
| MicrosoftEDR vendor’s MDR | Plan 1 uses Microsoft Defender data; Plan 2 operates on the customer’s own Microsoft Sentinel workspace (Microsoft says it is not a managed… source |
| TodylEDR vendor’s MDR | Own: Todyl AI-Powered Managed (Cloud) SIEM; MXDR operates out of it, and other security tools can be integrated into the SIEM source |
From each provider’s own pages. The 5 providers that do both appear in both lists. “Its own platform” includes a vendor’s SIEM or XDR product that you license from it. Checked November 8, 2026.
Where the analysts sit
27 of 27 providers state 24/7 monitoring by people. These say where their SOCs are, which matters for data residency and for the hours your own team overlaps with theirs.
| Provider | SOC locations, as stated |
|---|---|
| Rapid7 | U.S., Ireland, India, Australia and the Czech Republic (per Rapid7’s FY2025 Form 10-K) source |
| Binary Defense | U.S.-based team (AWS Marketplace listing: ‘24/7/365 support from a dedicated U.S.-based team’, including SOC analysts) source |
| Bitdefender | Three SOCs: North America (US-TX), Europe (Romania) and Asia-Pacific (Singapore), in follow-the-sun shifts; an EU-only sovereign MDR option is delivered from the Romania SOC source |
| eSentire | Two SOCs: Waterloo, Ontario, Canada and Cork, Ireland; additional analysts across the US, EMEA and APAC source |
| Sophos | Nine regional security operations teams (“follow-the-sun”); locations not listed source |
| BlueVoyant | Leeds, Cork, Washington DC and Manila (map in MDR for Microsoft brief; ‘100+ SOC personnel across 4 global SOC locations’, ‘24x7 in-region Europe and US SOC support’; the map marks some sites weekdays-only without saying which in text) source |
| Critical Start | U.S.-based SOC source |
| Deepwatch | Says its security experts are U.S.-based (offices in Palo Alto CA, Tampa FL and Bengaluru, India) source |
| Fortinet | The SOCaaS datasheet map labels ‘SOC’ and ‘Data Center’ sites in Burnaby (Canada), Plano (Texas, US), Paris and Nice (France), Frankfurt (Germany), Madrid (Spain), Prague (Czechia), Singapore, Tokyo (Japan) and Sydney (Australia); the text does not say which sites are SOCs source |
| Ontinue | Follow-the-sun Cyber Defense Center running multiple SOCs (locations not listed); staff across Europe, North America and India source |
| SentinelOne | Not listed; SentinelOne says its threat hunters, analysts, incident responders and advisors work across 16 countries source |
| Trustwave (LevelBlue) | Full list not published; LevelBlue opened a SOC in Sydney, Australia in August 2026 source |
MSSPs that sell MDR
Broader security services firms on this board, for which MDR is one line among several.
| Firm | MDR offer | Contains for you | Service level |
|---|---|---|---|
| Trustwave (LevelBlue)Owned by LevelBlue since August 2025. LevelBlue is private: launched in May 2024 as a WillJam Ventures-AT&T joint venture (AT&T kept a minority stake at launch); SoftBank Corp., SoftBank Vision Fund 2 and Liberty Strategic Capital became investors in November 2025 | LevelBlue Managed Detection & Response (MDR and MDR Elite; formerly Trustwave MDR). Related: LevelBlue MXDR and Co-Managed SOC | Stated | MDR Elite: 15-min acknowledge, under 30-min respond (in its SOW) |
| KrollPrivate (investor consortium led by Stone Point Capital and Further Global, deal agreed January 2020) | Kroll Responder MDR (since 2025-26 delivered on CrowdStrike Falcon Complete Next-Gen MDR) | Stated | Not stated |
| Mandiant (Google Cloud)Part of Google Cloud (Alphabet Inc.); Google completed its acquisition of Mandiant on 12 September 2022 | Mandiant Managed Defense (Managed Defense for Google SecOps; Managed Defense Standard) | Stated | No response-time SLA; 99.9% portal availability is contractual |
Choosing a managed SOC?
Tell us your SIEM (if any), your EDR and your size. We reply by email with the providers on this board that fit.
We only pass your details to a provider if you ask us to.
Neutral guidance worth reading
Before you sign, government guidance on buying a managed security service.
- CISA, NSA, FBI and Five Eyes partners: Protecting Against Cyber Threats to Managed Service Providers and their Customers (AA22-131A). Write down who owns detection and incident response. “Each customer should ensure their contractual arrangements meet their specific security requirements and that their contract specifies whether the MSP or the customer owns specific responsibilities, such as hardening, detection, and incident response.”
- NIST SP 800-61 Rev. 3: Incident Response Recommendations. Outsourcing is a shared-responsibility model, and the provider’s own access is a risk to manage. “Service providers often have privileged access to organizational systems and may also have access to sensitive organizational data.”
- Canadian Centre for Cyber Security: considerations for consumers of managed services (ITSM.50.030). What the SLA should cover. “Your service level agreement with the service provider should specify the expected turnaround times, communication media, escalation processes, metrics for assessing performance, and penalties for not meeting turnaround times.”
- Australian Cyber Security Centre, with CISA: Implementing SIEM and SOAR platforms, executive guidance. Among the contract terms to check when outsourcing SIEM operation: “the division of responsibility and liability for detecting and responding to cyber security incidents.”
- UK NCSC blog: SOC or not?. The trade-off of an outsourced SOC. “However, external SOC analysts can lack the knowledge of (for example) a project's architecture, and may not be able to respond to alerts as promptly as an internal SOC.”
Questions
What is SOC as a service?
A security operations centre you rent rather than build: a provider’s analysts watch your logs and alerts around the clock from their own SOC, investigate, and escalate or respond. “Managed SOC”, “outsourced SOC” and “SOC as a service” are used for the same thing.
What is the difference between MDR and a managed SOC?
Scope. MDR centres on detecting and responding to threats, usually starting from endpoint data, and the provider acts for you. A managed SOC usually watches a wider set of logs through a SIEM, may include compliance reporting and log retention, and may stop at telling you what to do. Many providers sell both, and the names overlap.
What is the difference between MDR and an MSSP?
An MSSP (managed security service provider) runs security technology for you: firewalls, VPNs, email filters, sometimes a SIEM. It often monitors and alerts. MDR is narrower and deeper: hunting and investigating threats and containing them. Many MSSPs now sell an MDR service as one line among many.
What is managed SIEM?
A provider runs the SIEM (the system that collects and searches your logs): onboarding sources, tuning rules, keeping it healthy. On its own it says nothing about who watches the alerts; managed SOC and MDR add the people.
How long should a managed SOC keep our logs?
Ask for the retention period and its price in writing. CISA and its Five Eyes partners advise: “It can be months before incidents are detected, so UK, Australian, Canadian, New Zealand, and U.S. cybersecurity authorities recommend all organizations store their most important logs for at least six months.”
Do I need a SIEM to buy a managed SOC?
Not always. 18 providers on this board work only on their own platform, so you don’t need a SIEM of your own; 9 say they can work in one you already own, such as Microsoft Sentinel or Splunk.
Sources for this page
- The UK National Cyber Security Centre: Security operations centre (SOC) — The definition of SOC.
- The EU NIS2 Directive, Article 6(40): Managed security service provider (MSSP) — The definition of MSSP.
- The Australian Cyber Security Centre, with CISA and partners: Security information and event management (SIEM) — The definition of SIEM.
- Microsoft, a vendor that sells MDR: Managed detection and response (MDR) — The definition of MDR.
- CISA, NSA, FBI and Five Eyes partners: Protecting Against Cyber Threats to Managed Service Providers and their Customers (AA22-131A) — Write down who owns detection and incident response.
- NIST SP 800-61 Rev. 3: Incident Response Recommendations — Outsourcing is a shared-responsibility model, and the provider’s own access is a risk to manage.
- Canadian Centre for Cyber Security: considerations for consumers of managed services (ITSM.50.030) — What the SLA should cover.
- Australian Cyber Security Centre, with CISA: Implementing SIEM and SOAR platforms, executive guidance — Among the contract terms to check when outsourcing SIEM operation:
- UK NCSC blog: SOC or not? — The trade-off of an outsourced SOC.
- CISA AA22-131A: log retention — Keep important logs for at least six months.
- Each provider’s own pages — Which providers work in your SIEM or bring their own, and where their SOCs are.
Each provider’s own sources are linked from its entry on the provider board. How providers are chosen and ordered, and how to correct an entry: methodology.
Cite this page
MDR Companies. “Managed SOC and SOC as a service, against MDR and MSSPs.” Updated November 8, 2026. https://mdrcompanies.com/managed-soc/