Method · rev 2026-11-08
How the board is built
Every entry is built from the provider’s own pages, filings and marketplace listings, linked and dated. The board is ordered by how many of six things a provider publishes, then alphabetically. There are no ratings or scores, and no provider pays to appear or to be placed.
Who is on the board
A provider qualifies if it sells a managed detection and response or managed SOC service, with people watching and responding around the clock, to organisations in the United States, and has public pages we can cite.
This revision covers 27 providers of three kinds: MDR specialists (13), endpoint security vendors that sell MDR on top of their own product (11), and broader security services firms for which MDR is one line among many (3). The list started from the providers buyers search for by name (Google Keyword Planner shows US searches such as “sophos mdr”, “arctic wolf mdr” and “huntress mdr” every month) and the large endpoint security vendors that sell MDR. It is not every MDR provider in the market, and being left out says nothing about a provider.
Left out: managed IT providers that resell another company’s MDR under their own name, products with no human-run service, and providers whose sites describe no MDR or managed SOC offer at all.
Two names buyers might expect were checked and left out in this revision. ReliaQuest now presents GreyMatter as a security operations platform and sets it against MDR on its own site (ReliaQuest vs. MDR); its FAQ says the customer’s own team manages alerts (FAQ). Coalfire’s managed security services cover exposure management and monitoring, not MDR or a managed SOC (Coalfire).
What we record
Who they are
Type of provider, headquarters, founding year and ownership, including acquisitions, from the company’s own announcements or filings.
Tools
Whether the service runs on the EDR and SIEM you already own, needs its own agent or platform, or both; and which EDRs it names.
Response
What the provider says it does when it confirms a threat: isolate a host, disable an account, remove persistence. Quoted close to its own words.
Service levels
Any response or escalation time it states, with whether it is a contractual SLA or an average it reports.
Price
A dollar figure only if the provider publishes it, on its own site or on a cloud-marketplace listing it sells itself. Nothing estimated.
Proof
Its own SOC 2, ISO 27001 or FedRAMP status, and any public sample report or product demo.
Sources are, in order of preference: the provider’s own site, documentation, trust centre and press releases; its filings; its own listings on AWS, Azure or Google Cloud Marketplace; the FedRAMP Marketplace; and, for ownership changes and cautions only, reputable news. Third-party price reports (procurement sites, review sites, forums) are never used as prices. Unknowns stay empty: “not stated” means we looked and the provider doesn’t say.
This revision: 27 providers, 452 distinct source URLs, checked November 8, 2026.
The order, and why there are no scores
The board is ordered by how many of these six things a provider publishes, most first; ties go alphabetically.
| Lamp | Published | What counts | Providers |
|---|---|---|---|
| P | Price | A dollar price, on its own site or its own cloud-marketplace listing | 12 of 27 |
| T | Tools | Which EDRs the service runs on (its own, or named third-party ones) | 27 of 27 |
| R | Response | That it contains threats for you (isolates hosts, disables accounts), not only alerts | 26 of 27 |
| S | Service level | A response or escalation time, as an SLA or a stated figure | 19 of 27 |
| A | Attestation | Its own SOC 2, ISO 27001, FedRAMP or similar | 25 of 27 |
| D | Demo or sample | A public sample report or product demo, not behind a form | 5 of 27 |
How many providers publish how many of the six: 6 of 6: 3 · 5 of 6: 7 · 4 of 6: 12 · 3 of 6: 3 · 2 of 6: 2.
That rule rewards transparency, which a buyer can use, and says nothing about detection quality, which no outsider can measure fairly. A provider that publishes little may still be excellent; you will just have to ask it more questions. A score from us would be an opinion presented as a measurement, so there isn’t one.
Entries carry a code such as M·07. It is the entry’s position in this revision’s order, for reference only. It is not a rank.
Public evaluations
MITRE ATT&CK Evaluations for Managed Services tested MDR services in public, in 2022 (OilRig) and 2024 (menuPass + ALPHV BlackCat). 13 providers on this board took part in at least one round, and their entries say so. MITRE publishes each participant’s results, not a score: “MITRE does not assign scores, rankings, or ratings.” (MITRE). Taking part is not one of the six checklist items, because providers choose whether to enter, and most on this board did not.
Upkeep and corrections
This revision was checked on November 8, 2026. MDR is consolidating fast (several providers here changed owner in 2024–2025) and prices and service names change, so confirm anything important with the provider before you sign.
If an entry about your company is wrong or out of date, send a link to the public page that shows the right fact (the address is on the about page). We correct entries from public sources only, and no one can pay to change one.
Sources for this page
- MITRE ATT&CK Evaluations: Managed Services — The two public rounds, their participants, and that MITRE assigns no scores.
- ReliaQuest vs. Managed Detection and Response — Why ReliaQuest is not on the board.
- Coalfire: managed security services — Why Coalfire is not on the board.
- FedRAMP Marketplace — Where FedRAMP authorisation status is checked.
- AWS Marketplace — Providers’ own list-price listings.
- Microsoft Azure Marketplace — Providers’ own list-price listings.
- Each provider’s own pages — Every entry links to its sources and shows its check date.
Each provider’s own sources are linked from its entry on the provider board. How providers are chosen and ordered, and how to correct an entry: methodology.
Cite this page
MDR Companies. “How MDR providers are chosen, checked and ordered.” Updated November 8, 2026. https://mdrcompanies.com/methodology/