Overview
Updated Mar 6, 2026
Microsoft-native MDR provider specializing in Critical National Infrastructure (CNI) protection across energy, transport, utilities, and government sectors. Built on Microsoft Sentinel and Defender XDR with deep OT/ICS expertise. Merged with I-Tracing in May 2025 under common ownership to form a ~1,000-person European cybersecurity services group. Holds more NCSC assured services (7) than any other UK provider. CREST-accredited SOC with security-cleared analysts.
Buyer fit
Good fit when
- ✓UK and European Critical National Infrastructure organizations (energy, transport, utilities, government) needing NCSC/CREST-assured MDR
- ✓Organizations with Microsoft 365 and Azure footprints wanting native Sentinel/Defender XDR managed services
- ✓Regulated entities requiring security-cleared analysts and compliance with ISA/IEC 62443, NCSC frameworks, and UK government standards
Watch out when
- ×Organizations requiring multi-vendor, platform-agnostic MDR beyond the Microsoft ecosystem
- ×North American companies wanting established US-based SOC presence (UK/Europe-focused historically)
- ×Budget-conscious buyers needing transparent pricing, published metrics, or breach warranty backing
Coverage
5 of 6 attack surfaces in the base price; the rest are separately priced.
EDR
SIEM
Cloud
Additional capabilities
Incident response
Pricing
Custom pricing based on environment size, coverage areas.
How pricing works+−
Offered via Azure Marketplace as managed service. Pricing model not publicly disclosed.
Cost caveats
- –Incident response is NOT included in base MDR, it is a separate 24/7 service
- –Requires Microsoft Sentinel and Defender XDR licensing (customer cost)
- –OT/ICS coverage requires specialist engagement beyond standard MDR
2 more+−
- –UK/Europe focus, US expansion underway but limited North American SOC presence historically
- –I-Tracing merger (May 2025) introduces integration risks during transition period
What costs extra (7)+−
- –24/7 Incident Response (separate service, not included in base MDR)
- –OT/ICS security consulting and monitoring (specialist engagement)
- –Penetration testing (NCSC CHECK-approved)
- –Cyber security consultancy (NCSC assured)
- –Risk assessments and audits
- –Microsoft Funded Engagement programs (discounted/subsidized services)
- –Vulnerability management services
Warranty conditions+−
No breach warranty offered. Bridewell positions NCSC/CREST accreditations and security clearances as their assurance model instead.
Team and access
Certifications
Reputation
Limited public reviews due to CNI/government client base where testimonials are restricted. Published case studies from Northern Gas Networks and Manchester Airport Group praise technical depth and organized delivery. No G2/Gartner Peer Insights presence and zero Reddit mentions suggest limited visibility outside UK CNI and public sector markets. Hard to assess independently.
What customers praise
- ✓Deep technical expertise in CNI, OT/ICS, and regulated environments. Case study clients recommend Bridewell to peers.
- ✓Most NCSC assured services of any UK provider (7 services), CREST SOC and CSIR accredited, security-cleared analysts for government work
- ✓Sentinel deployment in customer's own tenant with detection rules treated as customer IP. Verified Microsoft MXDR partner.
Common complaints
- ×No publicly disclosed pricing, metrics, or breach warranty makes evaluation difficult compared to transparent competitors
- ×Microsoft platform lock-in limits flexibility for organizations with multi-vendor stacks
- ×Merged with I-Tracing (May 2025) under common ownership, creating uncertainty around service continuity during integration
No Reddit discussions found. Brand awareness appears limited outside UK CNI and government sectors.
Questions to ask
- 1.
24/7 incident response is a separate service. What is the additional cost, and does it integrate with the MDR service or operate independently?
- 2.
What specific response actions will your analysts take autonomously in our Microsoft environment, and which require our approval?
- 3.
How has the I-Tracing merger (May 2025) changed service delivery, analyst teams, and account management? Are UK SOC analysts the same team?
- 4.
What is the exact pricing for our Microsoft footprint (Sentinel data ingestion, Defender licensing, and MDR services)?
- 5.
Do you offer a North American SOC presence, or will our environment be monitored exclusively from the UK?
- 6.
What happens to our Sentinel workspace, detection rules, and custom configurations if we decide to transition to another MDR provider or bring SOC in-house?
- 7.
For OT/ICS environments, what is the pricing model and analyst expertise for operational technology monitoring beyond standard IT MDR?
- 8.
Can you provide references from non-CNI commercial organizations outside the UK government and utilities sectors?
Evidence
Sources reviewed
Public-data caveats
- –No public contractual response-time SLA is recorded for this profile.
- –No public fixed price is recorded; compare only after a scoped quote.
- –No public breach warranty is recorded.
- –Response authority may depend on pre-approval and contract scope.
Also consider
Further reading
Independent research. Verify details directly with the provider before making decisions.