DeepSeas vs Sapphire
DeepSeas is a Pure-play MDR that works with your existing tools. Sapphire is a Services firm that works with your existing tools. DeepSeas targets Mid-market and Enterprise organizations; Sapphire serves SMB, Mid-market, and Enterprise.
Buyer brief
DeepSeas is a Pure-play MDR that works with your existing tools. Sapphire is a Services firm that works with your existing tools. DeepSeas targets Mid-market and Enterprise organizations; Sapphire serves SMB, Mid-market, and Enterprise.
DeepSeas (Pure-play MDR) and Sapphire (Services firm) serve different buyer profiles. Your decision depends on whether you prioritize DeepSeas's technology-agnostic mdr with ot/ics coverage, which is rare in this market or Sapphire's sapphire mdr is strongest for uk buyers that value local ownership, a crest-accredited uk soc and....
At a glance
| FIELD |  |  |
|---|---|---|
| Best fit | Mid-market and enterprise organizations with OT/ICS environments needing unified IT and OT threat monitoring | UK organisations that want MDR from a UK-owned provider with a UK-based CREST-accredited SOC |
| Price | Custom quote | Custom quote |
| Response authority | 5/6 actions · Configurable | 1/6 actions · Configurable |
| Stack | Works with existing stack | Works with existing stack |
| Data access | Dashboards | Dashboards |
| Warranty | None listed | None listed |
- Best fit
- Mid-market and enterprise organizations with OT/ICS environments needing unified IT and OT threat monitoring
- Price
- Custom quote
- Response authority
- 5/6 actions · Configurable
- Stack
- Works with existing stack
- Data access
- Dashboards
- Warranty
- None listed
- Best fit
- UK organisations that want MDR from a UK-owned provider with a UK-based CREST-accredited SOC
- Price
- Custom quote
- Response authority
- 1/6 actions · Configurable
- Stack
- Works with existing stack
- Data access
- Dashboards
- Warranty
- None listed
›› Detailed comparison
| FIELD | DeepSeasTECH-AGNOSTIC | SapphireTECH-AGNOSTIC |
|---|---|---|
| ›› Fit | ||
| Target size | Mid-market, Enterprise | SMB, Mid-market, Enterprise |
| Sentiment | Mixed | Mixed |
| ›› Your stack | ||
| Approach | Works with your tools | Works with your tools |
| EDR integrations | CrowdStrike FalconMicrosoft DefenderSentinelOneCarbon Black | EDR toolsMicrosoft technologies |
| SIEM integrations | SplunkMicrosoft Sentinel | ExabeamSIEM tools |
| Coverage | EPEndpoint: CoveredCloudCloud: CoveredIDIdentity: Optional add-onSaaSSaaS: Optional add-onNetNetwork: CoveredOTOT/IoT: Covered | EPEndpoint: CoveredCloudCloud: CoveredIDIdentity: LimitedSaaSSaaS: CoveredNetNetwork: CoveredOTOT/IoT: Optional add-on |
| ›› Response | ||
| Response type | Active Remediation | Active Remediation |
| Approval policy | Configurable | Configurable |
| Response actions | IsolateContainDisable accountsQuarantineCustom playbooks | Custom playbooks |
| IR included | Separate | ✓ Included |
| ›› Cost | ||
| Price range | Not published | Not published |
| Minimum seats | None | None |
| Breach warranty | – | – |
| ›› More details | ||
| Requires own agent | No | No |
| Endpoints | ✓ Included | ✓ Included |
| Cloud workloads | ✓ Included | ✓ Included |
| Identity | + Optional | ~ Limited |
| SaaS apps | + Optional | ✓ Included |
| Network | ✓ Included | ✓ Included |
| OT/ICS | ✓ Included | + Optional |
| Threat hunting | ✓ Included | ✓ Included |
| Response SLA | Not disclosed | Not disclosed |
| 24/7 coverage | ✓ | ✓ |
| Pricing model | Custom pricing based on environment size and coverage areas. No published pricing. 1-3 year contract terms. | Custom quote. Sapphire does not publish MDR package pricing. |
| Hidden cost warnings | Pricing is opaque, no public pricing or seat minimums disclosed. Incident response (DFIR) is handled through external partners, not included in MDR. OT/ICS coverage may require Nozomi Networks licensing and separate scoping. CyberFusion SOC (dedicated infrastructure) is a separate, premium offering beyond base MDR+ | Public pages do not publish response SLAs or exact response-authority rules.. MDR, MXDR and OT SOC scope can differ materially, so buyers should define monitored surfaces in the order form.. The page publishes vendor-reported comparative metrics without independent methodology.. IR hours are included as standard, but buyers should confirm number of hours, coverage triggers and overage rates. |
| Data portability | Partial | Partial |
| Contract terms | Annual, Multi-year (1-3 years) | Custom |
| Channels | EmailPortalPhone | PortalEmailPhone |
| Data access | Dashboards | Dashboards |
| Dedicated analyst | – | – |
| SOC regions | North America | Europe |
| Onboarding | Not published | Sapphire references onboarding and implementation that can be shorter than expected, but no standard public MDR onboarding timeline was found. |
| Industry focus | ManufacturingEnergy & UtilitiesCritical InfrastructureFinancial ServicesHealthcareTechnology | Public SectorDefenceFinancial ServicesProfessional ServicesIndustrialsManufacturingOperational TechnologyHealthcare |
| MTTD | Not published | Not published |
| MTTR | Not published | Not published |
| Community view | Ranked #1 service-based MDR in the 2024 Frost Radar and listed in Gartner's top 40 MDR providers. Praised for OT/ICS coverage and working with existing tools. Very limited practitioner reviews on G2, PeerSpot, or Reddit. Most validation comes from analyst reports rather than user feedback. | Sapphire has limited MDR-specific community review volume. The public buyer case is strongest for UK ownership, UK-based SOC delivery, CREST SOC accreditation and IT/OT services depth. Buyers should validate response authority, price, metrics and the exact split between MDR, MXDR, OT SOC and incident-response work. |
| Compliance | ISO 27001 | ISO 27001NISTHIPAADORACyber Essentials PlusCRESTGDPRPCI DSS |
| Certifications | ISO 27001 (certified December 2024, audited by A-LIGN)Nozomi Networks MSSP Elite PartnerMicrosoft PartnerCrowdStrike Integration Partner | CREST SOCCREST Penetration TestingCyber Essentials PlusISO 27001 |
| Founded | 2022 | 1996 |
| Data retention | Not published | Not published as a standard MDR retention period. |
| API available | ✓ | – |
| Website | Visit → | Visit → |
›› FAQ
What is the main difference between DeepSeas and Sapphire?
DeepSeas is a Pure-play MDR that is technology-agnostic (works with your existing tools). Sapphire is a Services firm that is technology-agnostic (works with your existing tools).
How do DeepSeas and Sapphire differ in response capabilities?
DeepSeas supports 5 autonomous actions (account disable, custom playbooks, endpoint isolation, file quarantine, network containment) and approval is configurable. Sapphire supports 1 autonomous actions (custom playbooks) and approval is configurable. Incident response is not included with DeepSeas and included with Sapphire.
How does DeepSeas pricing compare to Sapphire?
DeepSeas pricing: Not published. Sapphire pricing: Not published. Watch for with DeepSeas: Pricing is opaque, no public pricing or seat minimums disclosed; Incident response (DFIR) is handled through external partners, not included in MDR. Watch for with Sapphire: Public pages do not publish response SLAs or exact response-authority rules.; MDR, MXDR and OT SOC scope can differ materially, so buyers should define monitored surfaces in the order form..
Should I choose DeepSeas or Sapphire?
Choose DeepSeas if: mid-market and enterprise organizations with OT/ICS environments needing unified IT and OT threat monitoring. Choose Sapphire if: uK organisations that want MDR from a UK-owned provider with a UK-based CREST-accredited SOC. DeepSeas is not ideal for organizations wanting fully autonomous remediation without pre-approved runbooks. Sapphire is not ideal for buyers that need public MDR pricing or contractual response SLAs before sales engagement.
Daylight Security
AI-native MDR for buyers comparing active remediation across endpoint, cloud, identity, and SaaS. Daylight works with existing EDR/SIEM stacks and uses ChatOps-native collaboration, so it can be a useful third reference point in this comparison.