Buyer fit
Good fit when
- ✓MSPs already in the ConnectWise ecosystem (PSA, RMM) who want MDR without a separate vendor relationship
- ✓MSPs serving SMB clients who need turnkey MDR without building their own SOC
- ✓MSPs that want to offer multiple EDR options (Bitdefender, SentinelOne, Microsoft Defender) across their client base
Watch out when
- ×Direct enterprise buyers, ConnectWise MDR is sold through MSP partners only
- ×Buyers who need analyst-validated MDR recognized by Gartner, Forrester, or MITRE
- ×Organizations that need reliable long-term log retention for compliance audits
Coverage
4 of 6 attack surfaces in the base price; the rest are separately priced.
Platform
Incident response
Pricing
Per-endpoint, MSP subscription.
How pricing works+−
Not publicly listed.
Not publicly disclosed. Requires custom quote through MSP channel.
Cost caveats
- –Pricing requires sales engagement, no self-serve
- –Ecosystem lock-in through ConnectWise RMM and PSA bundling
- –12-36 month agreements typical
1 more+−
- –Data export is difficult when switching providers
What costs extra (3)+−
- –Incident response (separate ConnectWise service)
- –ConnectWise SIEM (may be separately priced)
- –BCDR add-on (ConnectWise Cloud Backup)
Team and access
Reputation
ConnectWise SIEM has Capterra 4.6/5 from ~50 reviews. ConnectWise MDR has almost no independent reviews. PeerSpot ranks it #57 in MDR with 0.4% mindshare and zero collected reviews. Not included in Gartner or Forrester MDR evaluations.
What customers praise
- ✓Multi-EDR flexibility lets MSPs choose per client
- ✓Tight ecosystem integration with ConnectWise PSA and RMM
- ✓Proactive threat hunting focused on MSP-specific attacks
Common complaints
- ×SIEM described as not delivering on its promise, with an outdated UI
- ×Log retention flagged as problematic for audit compliance
- ×No independent analyst recognition (Gartner, Forrester, MITRE)
Almost no Reddit discussion about ConnectWise MDR specifically. Most threads discuss ConnectWise SIEM (Perch) and general platform frustrations. MSP community sentiment is mixed: appreciated for ecosystem integration, criticized for SIEM maturity.
Questions to ask
- 1.
What is the per-endpoint MDR price at our volume, and are there minimum seat requirements?
- 2.
What SIEM log retention do you provide, and does it meet SOC 2 or HIPAA audit requirements?
- 3.
What response actions does the SOC take automatically vs. requiring our approval?
- 4.
What is included in base MDR vs. the separate incident response service?
- 5.
What data can we export if we leave, and what does migration look like?
Evidence
Sources reviewed
Public-data caveats
- –SLA caveat: 15-minute initial threat assessment SLA announced at IT Nation Connect 2025 for Q1 2026 agentic MDR triage. Also claims under 14 minutes average ransomware response time (vendor-published).
- –No public fixed price is recorded; compare only after a scoped quote.
- –No public breach warranty is recorded.
- –Response authority may depend on pre-approval and contract scope.
- –MDR analyst headcount or analyst-to-customer ratio is not public.
Also consider
Further reading
Independent research. Verify details directly with the provider before making decisions.