Overview
Updated Nov 13, 2026
BitLyft is a US MDR provider based in St. Johns, Michigan, that serves small and mid-sized organizations, including banks, utilities, colleges, healthcare providers and defense suppliers. BitLyft publishes material on MDR for small banks and a case study for a small-town utility, and its Agentic MDR (AMDR) is built for lean IT teams that do not have a SOC of their own. AMDR, generally available since September 2026, runs on BitLyft's AIR investigation and response layer, with Graylog as its SIEM partner. AI agents investigate cases and run approved containment in all 3 tiers (Standard, Plus and Premium), and Premium adds BitLyft's US-based SOC, Tier 3 analysts and an included incident response engagement. Every tier includes Microsoft 365, Entra, Okta and Google log sources with 365 days of retention. Pricing is per user per month and quoted on request. BitLyft also sells through MSPs and VARs, and offers its earlier True MDR service to defense contractors working toward CMMC.
Buyer fit
Good fit when
- ✓Small and mid-sized organizations with lean IT teams and no in-house SOC, such as small banks, utilities and colleges, that want a US-based SOC on the Premium tier
- ✓Microsoft 365, Entra, Okta and Google Workspace environments that want automated response to phishing and account compromise, with 365 days of log retention in every tier
- ✓IT teams that want AI triage and automated containment on Standard or Plus while keeping escalated decisions in-house
- ✓Defense suppliers working toward CMMC, which BitLyft serves through its True MDR service with US-based staff and GovCloud hosting options
- ✓MSPs and VARs that want to resell BitLyft's service, either behind the scenes or co-branded
Watch out when
- ×Buyers that want human SOC escalation on an entry-level tier, since BitLyft includes its analysts on Premium
- ×Buyers that need a contractual response-time SLA, service credits or a breach warranty, which are not published
- ×Teams that require published MTTD and MTTR figures or MITRE ATT&CK evaluation results
- ×Environments that need OT/ICS monitoring or network sensors, as BitLyft's documented coverage centers on identity, Microsoft 365, endpoint and log sources
Coverage
3 of 6 attack surfaces in the base price; the rest are separately priced.
EDR
SIEM
Cloud
Additional capabilities
Incident response
Pricing
Per-user, per-month subscription in 3 tiers (Standard, Plus and Premium).
How pricing works+−
The quote reflects tier, user count, log volume and contract length, with a 12-month commitment billed monthly or annually and discounts for 36-month terms. A minimum number of users applies. Standard includes 2 AI-investigated cases per user per month and Premium includes 4.
Not published. AMDR is sold by quote, per user per month.
Cost caveats
- –BitLyft's human SOC and Tier 3 analysts are part of Premium. When comparing against MDR services that include analyst-led response on every plan, compare against the Premium quote.
- –Premium includes an incident response engagement and Plus includes incident response advisory. Confirm what your tier includes in the order form.
- –A minimum number of users applies and the price scales with log volume, so ask for a quote based on your own user count and log sources.
2 more+−
- –Each tier includes a monthly allotment of AI-investigated cases (2 per user on Standard, 4 on Premium), and extra cases are billed as an add-on.
- –BitLyft's earlier True MDR plans were listed at $25.99 to $38.99 per user per month. AMDR is priced separately, by quote.
What costs extra (6)+−
- –Managed EDR, with no EDR vendor named on the pricing page
- –Vulnerability management for Mac, Windows and Linux endpoints, priced by device count and scan frequency
- –Attack surface management, data discovery and classification, and privileged access management
- –AI-investigated cases beyond the monthly allotment (2 per user per month on Standard, 4 on Premium)
- –Syslog log sources, which the pricing table lists from the Plus tier up
- –Onboarding fees, scoped per environment
Team and access
Reputation
Gartner Peer Insights search results show 7 reviews of the BitLyft AIR Platform averaging 4.6 out of 5, seen 2026-11-13. AMDR became generally available in September 2026. No reviews were found on G2, PeerSpot or Clutch.
No Reddit discussion of BitLyft was found.
Questions to ask
- 1.
Which incident response services and add-ons are included in our tier, and can they be listed in the order form?
- 2.
On Standard or Plus, who makes the containment call at 3am when a case falls outside the automated policy?
- 3.
Which response actions run without our approval by default, and can we restrict them by action type, user group or asset?
- 4.
What is the minimum number of users, what would Premium cost for our user count and log volume, and what onboarding fee applies?
- 5.
How is the SOC staffed overnight and at weekends, and can acknowledgement and containment times for escalated cases go into the contract?
- 6.
Which tiers include a dedicated lead engineer?
- 7.
Which EDR does the Managed EDR add-on use, and which EDRs besides SentinelOne can AIR isolate hosts through?
- 8.
How are AI-investigated cases beyond the monthly allotment counted and priced during an active incident?
- 9.
Can we see your current SOC 2 Type II report and its audit period, and what does your CMMC Level 2 equivalent description cover?
Evidence
Sources reviewed
Public-data caveats
- –No public contractual response-time SLA is recorded for this profile.
- –No public fixed price is recorded; compare only after a scoped quote.
- –No public breach warranty is recorded.
- –Response authority may depend on pre-approval and contract scope.
- –MDR analyst headcount or analyst-to-customer ratio is not public.
Also consider
Further reading
Independent research. Verify details directly with the provider before making decisions.