Choose NCC Group or Secureworks
Choose NCC Group if
- European enterprise and government organizations running Microsoft Sentinel or Splunk as their SIEM
- Buyers wanting MDR from a provider with deep incident response and consulting capability in one firm
- UK and Benelux organizations wanting a locally operated SOC with Dutch government security heritage
Choose Secureworks if
- Enterprise organizations wanting open XDR with existing CrowdStrike, Defender, SentinelOne, or Carbon Black EDR
- Organizations valuing deep threat intelligence from CTU (now Sophos X-Ops)
- Companies needing OT/ICS MDR coverage alongside IT MDR
What’s actually different
Buyer brief
Fit. NCC Group and Secureworks are both Services firms that work with your existing tools. NCC Group targets Mid-market and Enterprise organizations, while Secureworks serves Mid-market and Enterprise.
FAQ
What is the main difference between NCC Group and Secureworks?
NCC Group is a Services firm that is technology-agnostic (works with your existing tools). Secureworks is a Services firm that is technology-agnostic (works with your existing tools). SLA commitments differ: NCC Group offers Not disclosed, Secureworks offers ≤1 hour.
How do NCC Group and Secureworks differ in response capabilities?
NCC Group supports 5 autonomous actions (endpoint isolation, process termination, network containment, file quarantine, custom playbooks) and approval is configurable. Secureworks supports 4 autonomous actions (endpoint isolation, network containment, account disable, custom playbooks) and approval is configurable.
How does NCC Group pricing compare to Secureworks?
NCC Group pricing: Not published. Custom quotes only.. Secureworks pricing: Third-party buyer data reports a $91,350/year median buyer cost for Secureworks, with a visible public range from $15,200 to $421,751/year. PeerSpot reviews also report MDR/MXDR annual deals around $60K-$320K+ depending on environment.. Watch for with NCC Group: MXDR for Microsoft and MXDR for Splunk are separate offerings. Customers using both Sentinel and Splunk may face separate engagements.; Only Microsoft Defender and CrowdStrike EDR integrations are confirmed. Other EDR platforms may not be supported.. Watch for with Secureworks: Sophos acquisition completed Feb 2025, Taegis integration into Sophos Central underway with long-term platform consolidation likely; ~6% workforce reduction (~380 roles) in Feb 2025 post-acquisition, verify analyst continuity.