In short
SOC as a service vendors run 24/7 security operations centres that monitor and respond to threats for their customers. Forever Systems supplies services from Sophos, Check Point, Cisco, WatchGuard, Blackpoint, CrowdStrike, SentinelOne, Todyl, ThreatDown, Acronis, Bitdefender and Perception Point, then chooses the right fit, sets it up, manages it and handles escalation.
Get a quote for managed security
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
How we work with SOC vendors
Every service on this page is delivered by the vendor's own security operations team. Forever Systems does not run its own SOC. What we add is choice and management: because we supply several services, we can recommend the one that fits the tools you already own, then deploy it, connect your data sources, agree response authority, act as your escalation point and review the service with you.
The tables describe how each service works, drawn from the vendors' own material. They are not a ranking; the best fit depends on your estate. Each vendor's service description sets out exactly what it monitors and commits to, and we go through it with you before you sign. For how a vendor SOC works in general, see managed SOC services.
MDR and SOC services compared
| Service | Tiers | Coverage | Licensing unit |
|---|---|---|---|
| Sophos MDR | Sophos MDR (formerly MDR Essentials); Sophos MDR Plus (formerly MDR Complete) | 24/7 across Sophos and supported third-party tools; Microsoft 365 audit logs and Graph Security API at no extra cost, subject to your Microsoft subscriptions; add-ons for ITDR, NDR and Next-Gen SIEM | Per user and per server |
| Check Point MDR | MDR; MDR 360; MXDR 360 | 24/7 across endpoint, email, network, cloud and identity, incident response included; UK among data residency options | Per endpoint, standalone or as an endpoint add-on |
| Cisco XDR Premier | Cisco XDR Essentials, Advantage, Premier (Premier is the managed service) | Cisco XDR Advantage delivered as a Cisco-managed service, with Talos Incident Response and a technical security assessment | Per user, term subscription |
| WatchGuard MDR | Core MDR; Core MDR for Microsoft; Total MDR; Open MDR | WatchGuard endpoints; Microsoft Defender for Endpoint; the wider WatchGuard stack; or third-party tools such as CrowdStrike, Okta and Duo | Core MDR per endpoint; the others per user |
| Blackpoint CompassOne | Essentials (MDR or ITDR); Core; Standard | 24/7 MDR and ITDR; Core adds vulnerability management, Microsoft 365 configuration management and application control; Standard adds SIEM with 365 days of log storage | Endpoints and user accounts, by package |
| CrowdStrike Falcon Complete | Falcon Complete Defend bundle, including Falcon Complete Next-Gen MDR | 24/7 monitoring, investigation and remediation by CrowdStrike, with Adversary OverWatch threat hunting | Per endpoint |
| SentinelOne Wayfinder MDR (formerly Vigilance MDR) | MDR Essentials; MDR Elite | 24/7 across endpoints, cloud workloads, identity and supported third-party integrations | Add-on to Singularity Commercial and Enterprise |
| Todyl MXDR | Included in Todyl packages, or as a module | 24/7 analysts monitoring Todyl SIEM, endpoint and SASE data, including Microsoft 365 identity threats | Per device |
| ThreatDown MDR | Managed Threat Hunting; MDR | Managed Threat Hunting gives prioritised alerts and remediation guidance; MDR adds 24/7 response such as isolating devices and removing malware | Per endpoint |
| Acronis MDR | MDR Standard; MDR Advanced | On Acronis EDR or XDR; Advanced adds 24/7 remediation and, with your agreement, attack rollback and recovery from backup | Endpoints, tier and delivery option |
| Bitdefender MDR | Built on GravityZone EDR; packaged for providers as Secure Plus, with optional XDR sensors | 24/7 monitoring, threat hunting and response on GravityZone endpoints | Confirmed at quote |
| Perception Point (now sold by Fortinet under the FortiMail name) | Email, browser and Microsoft collaboration modules | Every subscription includes a 24/7 managed incident response service for the channels it protects | Per user |
Not sure which tier fits? Ask us
Tell us what you need and we will recommend the right tier for your organisation, with a quote.
Where to read more
Our specialist sites go deeper on the services we supply most, and our licensing site covers how each is bought.
| Service | Explainer | Licensing |
|---|---|---|
| Sophos MDR | Sophos MDR | Sophos MDR licensing |
| Check Point MDR | Check Point MDR | Check Point MDR licensing |
| Cisco XDR Premier and Talos IR | Cisco XDR | Cisco XDR licensing |
| WatchGuard MDR | Managed XDR | WatchGuard MDR licensing |
| Blackpoint | Managed ITDR | Blackpoint CompassOne licensing |
| CrowdStrike Falcon Complete | CrowdStrike Falcon | CrowdStrike Falcon Complete licensing |
| SentinelOne Wayfinder MDR | SentinelOne Singularity | SentinelOne Wayfinder MDR (Vigilance) licensing |
| Todyl MXDR | Todyl | Todyl MXDR licensing |
| ThreatDown MDR | ThreatDown | ThreatDown MDR licensing |
| Acronis MDR | MSSP pricing | Acronis MDR licensing |
| Bitdefender MDR | Bitdefender GravityZone | Bitdefender GravityZone EDR licensing |
| Perception Point | Perception Point | Perception Point licensing |
Related services we supply
Alongside the core MDR services, several vendors offer add-ons that widen what the SOC can see or keep:
- Identity detection and response: Sophos ITDR, Blackpoint ITDR, ThreatDown ITDR, WatchGuard CloudDR and Cisco Identity Intelligence; see managed ITDR
- SIEM and log retention: Sophos Next-Gen SIEM, CrowdStrike Falcon Next-Gen SIEM, SentinelOne AI SIEM, Todyl SIEM and Blackpoint CompassOne Standard; see SIEM as a service
- Network detection: Sophos NDR and WatchGuard NDR (formerly ThreatSync+ NDR); see managed firewall services
- Incident response retainers: Cisco Talos Incident Response and Sophos's retainer; see incident response retainers
- Email security with managed response: Perception Point and IRONSCALES; see managed email security services
Is managed security the right fit for you?
We will check it against your systems and requirements and recommend the right option.
How to choose between them
The most useful starting point is what you already run. A service that integrates with your existing endpoint, firewall and Microsoft 365 tools usually gives better coverage, sooner, than one that needs everything replaced.
- Microsoft Defender in place: WatchGuard Core MDR for Microsoft, Sophos MDR or Blackpoint MDR; see MDR for Microsoft Defender
- Cisco network and security: Cisco XDR Premier
- Check Point, or a mixed estate: Check Point MDR or WatchGuard Open MDR
- Sophos endpoint or firewall: Sophos MDR or MDR Plus
- Smaller organisations wanting simple onboarding: Blackpoint, Todyl, ThreatDown or Acronis MDR; see managed security for small business
- Backup and recovery a priority: Acronis MDR Advanced, which can roll back attacks and recover from backup with your agreement
Then compare the questions that separate services: who the analysts are, which response modes are offered, what is contained rather than only alerted, data residency, log retention and whether incident response is included. Our guide on how to choose an MSSP lists them, and MSSP pricing explains the licensing units. Pricing depends on the service and your numbers, so ask us for a quote and contact us.
How Forever Systems helps with managed security
We do not run our own security operations centre. The round-the-clock monitoring, investigation and response come from managed detection and response services that established security vendors already run at scale. Our part is choosing the right one for you, setting it up properly and staying involved.
- Independent recommendation: we supply several vendor MDR, XDR and SIEM services, including Sophos MDR, Check Point MDR and Cisco XDR, so we can suggest the one that fits the tools you already own
- Setup and onboarding: we can deploy agents, connect integrations such as Microsoft 365 and work with the vendor through tuning
- Clear responsibilities: escalation contacts, response permissions and who does what are agreed with you in writing and confirmed at quote
- Ongoing management: we help with policy changes, exclusions, renewals and regular service reviews
- Wider security too: security awareness training, Cyber Essentials and cloud security advice
We work with businesses, schools, charities and public sector organisations across the UK.
Frequently asked questions
What is a SOC as a service vendor?
A SOC as a service vendor runs a security operations centre that monitors and responds to threats for many customers on subscription. Examples include the MDR services from Sophos, Check Point, WatchGuard, Blackpoint, CrowdStrike and SentinelOne.
Which managed SOC vendors do you work with?
We supply services from Sophos, Check Point, Cisco, WatchGuard, Blackpoint, CrowdStrike, SentinelOne, Todyl, ThreatDown, Acronis, Bitdefender and Perception Point. Forever Systems recommends one, sets it up, manages it and handles escalation.
Do you run your own SOC?
No. The 24/7 monitoring and response comes from the vendor's own security operations centre in the service you choose. Our role is choosing, setting up and managing the service, and acting as your escalation point.
Which SOC vendor is best?
There is no single best vendor. The right service depends on the tools you already own, the data you want monitored, the response authority you are comfortable with and whether you need incident response included. We compare the options against your estate.
How are MDR services licensed?
Units vary by vendor: per user, per server, per endpoint, per device or by package. Some add-ons, such as SIEM, are priced on data volume. Ask us for a quote and we will compare the options on the same basis.
Still have a question about managed security?
Ask us and a member of our team will reply by email.