Deepwatch vs DTS Solution
Deepwatch is a Pure-play MDR that works with your existing tools. DTS Solution is a Services firm that works with your existing tools. Deepwatch targets Mid-market and Enterprise organizations; DTS Solution serves SMB, Mid-market, and Enterprise. Deepwatch includes 4 attack surfaces in base pricing (Cloud, SaaS, Identity, Network), compared to 3 for DTS Solution (Endpoint, Cloud, Network).
Buyer brief
Deepwatch is a Pure-play MDR that works with your existing tools. DTS Solution is a Services firm that works with your existing tools. Deepwatch targets Mid-market and Enterprise organizations; DTS Solution serves SMB, Mid-market, and Enterprise. Deepwatch includes 4 attack surfaces in base pricing (Cloud, SaaS, Identity, Network), compared to 3 for DTS Solution (Endpoint, Cloud, Network).
Deepwatch (Pure-play MDR) and DTS Solution (Services firm) serve different buyer profiles. Your decision depends on whether you prioritize Deepwatch's siem-centric, vendor-agnostic mdr with patented drs engine (98% fp reduction claim), dedicated sq... or DTS Solution's dts hawkeye is a useful regional option for buyers that want managed csoc, xdr, threat hunting an....
At a glance
| FIELD |  |  |
|---|---|---|
| Best fit | Mid-market to enterprise with existing Splunk, Sentinel, Google SecOps, or Securonix SIEM investments | Middle East and EMEA buyers that want a UAE-based managed CSOC and XDR provider |
| Price | Buyer benchmark: median $218,983/yr | Custom quote |
| Response authority | 6/6 actions · Configurable | 3/6 actions · Configurable |
| Stack | Works with existing stack | Works with existing stack |
| Data access | Full query access | Dashboards |
| Warranty | None listed | None listed |
- Best fit
- Mid-market to enterprise with existing Splunk, Sentinel, Google SecOps, or Securonix SIEM investments
- Price
- Buyer benchmark: median $218,983/yr
- Response authority
- 6/6 actions · Configurable
- Stack
- Works with existing stack
- Data access
- Full query access
- Warranty
- None listed
- Best fit
- Middle East and EMEA buyers that want a UAE-based managed CSOC and XDR provider
- Price
- Custom quote
- Response authority
- 3/6 actions · Configurable
- Stack
- Works with existing stack
- Data access
- Dashboards
- Warranty
- None listed
Detailed comparison
| FIELD | DeepwatchTECH-AGNOSTIC | DTS SolutionTECH-AGNOSTIC |
|---|---|---|
| Fit | ||
| Target size | Mid-market, Enterprise | SMB, Mid-market, Enterprise |
| Sentiment | Mixed | Mixed |
| Your stack | ||
| Approach | Works with your tools | Works with your tools |
| EDR integrations | CrowdStrike FalconSentinelOneMicrosoft Defender for Endpoint | CrowdStrikeMicrosoft endpoint securityHawkEye XDR AgentCustomer endpoint security tools |
| SIEM integrations | Splunk Enterprise & CloudGoogle SecOps (Chronicle)Microsoft SentinelSecuronix (added Feb 2026) | HawkEye NG-SIEMHawkEye Open XDRCustomer-owned SIEM |
| Coverage | EPEndpoint: Optional add-onCloudCloud: CoveredIDIdentity: CoveredSaaSSaaS: CoveredNetNetwork: CoveredOTOT/IoT: Optional add-on | EPEndpoint: CoveredCloudCloud: CoveredIDIdentity: LimitedSaaSSaaS: LimitedNetNetwork: CoveredOTOT/IoT: Optional add-on |
| Response | ||
| Response type | Active Remediation | Active Remediation |
| Approval policy | Configurable | Configurable |
| Response actions | IsolateKill processContainDisable accountsQuarantineCustom playbooks | IsolateContainCustom playbooks |
| IR included | Separate | Separate |
| Cost | ||
| Price range | Third-party buyer data reports a $218,983/year median buyer cost for Deepwatch, with a visible public range from $126,904 to $322,131/year. | Not published |
| Minimum seats | None | None |
| Breach warranty | – | – |
| More details | ||
| Requires own agent | No | No |
| Endpoints | + Optional | ✓ Included |
| Cloud workloads | ✓ Included | ✓ Included |
| Identity | ✓ Included | ~ Limited |
| SaaS apps | ✓ Included | ~ Limited |
| Network | ✓ Included | ✓ Included |
| OT/ICS | + Optional | + Optional |
| Threat hunting | ✓ Included | ✓ Included |
| Response SLA | Not disclosed | Not disclosed |
| 24/7 coverage | ✓ | ✓ |
| Pricing model | Volume-based (data ingestion volume in GB/TB per day or Splunk Virtual Compute units), not per-endpoint | Tiered subscription packages by log-source count and EPS, with custom-tailored packages for additional log sources, EPS and retention. Public prices are not published. |
| Hidden cost warnings | Volume-based pricing means unexpected data growth can cause cost spikes. Three platform tiers (Core, Advanced, Enterprise) may gate Active Response behind higher tiers.. MEDR (endpoint detection) is a separate add-on, not included in base MDR. MDR Essentials is a limited entry point with fewer capabilities than full platform tiers | Package limits are defined by log sources and events per second, so high-volume environments should model ingestion growth before contract.. Public pages do not publish prices, minimum terms, contractual SLAs, service credits or MTTD/MTTR metrics.. DFIR is included only in Premium Platinum in the package table; lower tiers list it as an add-on.. Managed SOAR and many adjacent managed services are add-ons rather than guaranteed base MDR scope.. The public AI SOC page says response actions are analyst-approved, so buyers should document which containment actions DTS can execute and whose approval is required. |
| Data portability | Partial | Partial |
| Contract terms | Custom enterprise | Lite Bronze, Baseline Silver, Advanced Gold, Premium Platinum, Custom-tailored package |
| Channels | SlackEmailPortalPhone | PortalEmailPhone |
| Data access | Full query access | Dashboards |
| Dedicated analyst | ✓ | – |
| SOC regions | North America | MEA |
| Onboarding | 30 days typical. MDR Essentials can launch SOC in under 1 hour. | HawkEye describes an onsite discovery workshop, package selection, secure onboarding, service delivery and secure offboarding. No standard calendar timeline was found. |
| Industry focus | HealthcareFinancial ServicesManufacturingRetailEnergy | Critical InfrastructureEnergyUtilitiesManufacturingGovernmentFinancial ServicesHealthcareRetailTechnologyTelecommunicationsSmart CitiesTransportation |
| MTTD | Not published | Not published |
| MTTR | Not published | Not published |
| Community view | Customer reviews are positive (Gartner Peer Insights 4.2/5 from 59 reviews, G2 High Performer Fall 2025), praising Squad team and DRS technology. Employee sentiment is concerning: Glassdoor 2.9/5 (215 reviews, 35% recommend). 42% headcount reduction (412 to 239 employees) across 2024-2025, founding CEO departed to competitor Mitiga Jan 2025. | HawkEye has strong vendor-controlled detail for package tiers, dashboard access, retention, CSOC/XDR capabilities and regional SOC positioning, but little independent MDR-specific review signal in public English-language communities. Buyers should validate analyst quality, response authority and pricing through references. |
| Compliance | SOC 2 Type IIISO 27001:2022PCI DSS Level 1 | ISO 27001ISO 9001ISO 45001SOC 2 Type IMITRE ATT&CK |
| Certifications | SOC 2 Type II (Security, Availability, Confidentiality, certified since inception)ISO 27001:2022 (first certified 2024)PCI DSS Level 1 Service Provider (since inception) | ISO 27001ISO 9001ISO 45001SOC 2 Type I logo shown on DTS siteSOC-CMM risk-driven certification logo shown on DTS siteSWIFT CSP logo shown on DTS site |
| Founded | 2019 | 2011 |
| Data retention | 12 months hot data retention (Platform Core tier) | HawkEye package pages publish 3 months hot storage, 6 months warm storage and 12 months cold storage across service tiers, with longer retention available through a custom-tailored package. Advanced and Premium tier pages also describe standard collected-log retention; buyers should reconcile final retention language in the contract. |
| API available | ✓ | – |
| Website | Visit → | Visit → |
FAQ
What is the main difference between Deepwatch and DTS Solution?
Deepwatch is a Pure-play MDR that is technology-agnostic (works with your existing tools). DTS Solution is a Services firm that is technology-agnostic (works with your existing tools). Deepwatch covers 4 attack surfaces in base pricing vs. 3 for DTS Solution.
How do Deepwatch and DTS Solution differ in response capabilities?
Deepwatch supports 6 autonomous actions (account disable, custom playbooks, endpoint isolation, file quarantine, network containment, process termination) and approval is configurable. DTS Solution supports 3 autonomous actions (custom playbooks, endpoint isolation, network containment) and approval is configurable.
How does Deepwatch pricing compare to DTS Solution?
Deepwatch pricing: Third-party buyer data reports a $218,983/year median buyer cost for Deepwatch, with a visible public range from $126,904 to $322,131/year.. DTS Solution pricing: Not published. Watch for with Deepwatch: Volume-based pricing means unexpected data growth can cause cost spikes. Three platform tiers (Core, Advanced, Enterprise) may gate Active Response behind higher tiers.; MEDR (endpoint detection) is a separate add-on, not included in base MDR. Watch for with DTS Solution: Package limits are defined by log sources and events per second, so high-volume environments should model ingestion growth before contract.; Public pages do not publish prices, minimum terms, contractual SLAs, service credits or MTTD/MTTR metrics..
Should I choose Deepwatch or DTS Solution?
Choose Deepwatch if: mid-market to enterprise with existing Splunk, Sentinel, Google SecOps, or Securonix SIEM investments. Choose DTS Solution if: middle East and EMEA buyers that want a UAE-based managed CSOC and XDR provider. Deepwatch is not ideal for sMBs or budget-constrained organizations ($220K-$315K/year is enterprise-oriented). DTS Solution is not ideal for buyers that need public MDR pricing or contractual MTTD/MTTR before sales.
Daylight Security
AI-native MDR for buyers comparing active remediation across endpoint, cloud, identity, and SaaS. Daylight works with existing EDR/SIEM stacks and uses ChatOps-native collaboration, so it can be a useful third reference point in this comparison.