Name: Critical Start Critical Start MDR
Brand: Critical Start

Buyer fit

Good fit when

✓Mid-market to large enterprises wanting technology-agnostic MDR that works with their existing security stack
✓Organizations suffering from alert fatigue wanting TBR's deterministic auto-resolution to reduce noise
✓Companies needing OT/ICS monitoring alongside IT MDR through Claroty, Dragos and Nozomi integrations

Watch out when

×SMBs or budget-conscious organizations, enterprise-focused pricing not published
×Organizations requiring native Slack integration for SOC communication
×Companies wanting a breach warranty or financial guarantee

Coverage

EndpointIncluded

Cloud workloadsIncluded

IdentityIncluded

SaaSIncluded

Network / NDRIncluded

OT / IoTAdd-on

5 of 6 attack surfaces in the base price; the rest are separately priced.

EDR

CrowdStrikeSentinelOneMicrosoft DefenderPalo Alto Cortex

SIEM

Microsoft SentinelSplunkSumo Logic

Cloud

AWS (CloudTrail, GuardDuty, VPC, Lambda, S3, Route 53, EC2, EKS)Microsoft AzureGoogle Cloud PlatformAlibaba CloudOracle Cloud Infrastructure

Additional capabilities

Trusted Behavior Registry (TBR)MobileSOC AppMITRE ATT&CK MappingOT/ICS MonitoringVulnerability ManagementDFIR (via Cyber Incident Response Team)

Incident response

Monitoring

24/7 · 24/7/365 coverage across two US-based SOCs (Plano TX, Lehi UT). Software engineering COE in Pune, India (not a SOC). Vendor claims 90%+ analyst retention rate

First response

Configurable: auto-act per your playbook, or escalate for approval · Custom playbooks supported

Containment

Endpoint isolation · Process kill · Network containment · Account disable · File quarantine

Notification

Email · Portal · Phone

Response SLA

≤1 hour · Contractual 60-minute or less time-to-resolution for all alerts.

IR included

No, separate retainer

Pricing

Indicative cost

Not published

Minimum

Not published

Trial

None

Warranty

None

Custom enterprise pricing (annual subscription, tiered by coverage depth).

Cost caveats

–No public pricing at all, requires sales call for any ballpark
–OT/ICS monitoring and vulnerability management are separate purchases on top of base MDR
–Full IR/DFIR requires separate CIRT engagement, not included in MDR contract

1 more+

–Annual contract commitment typically required with no published minimum seat count

What costs extra (3)+

–IR/DFIR via Cyber Incident Response Team (CIRT), separate from base MDR
–Vulnerability management (Qualys VMDR-powered)
–OT/ICS monitoring (Claroty, Dragos, Nozomi, Otorio integrations)

Team and access

Analysts

Direct employees · Part of ~300 total employees. SOC-specific headcount not published.

Channels

Email · Portal · Phone

Data access

Dashboard Access

Portal

CORR platform with Risk Overview, Team Performance, Detection and Security Stack dashboards. CSV/XLSX export and API access. Events mapped to MITRE ATT&CK. Peer benchmarking available. Some reviewers report UI responsiveness issues.

Account manager

Dedicated

Certifications

8-week (300+ hour) internal training program10 hours biweekly ongoing education

Reputation

Positive

Gartner Peer Insights 4.8/5 (53 reviews). PeerSpot 9.4/10, skewing large enterprise. Glassdoor 4.3/5 (140 reviews, some concerns about RIFs and turnover). IDC MarketScape Major Player (Emerging MDR, 2024). Praised for TBR noise reduction and SOC analyst accessibility. Criticized for onboarding communication gaps, missing Slack integration and opaque pricing.

What customers praise

✓TBR cuts false positives and alert fatigue from day one with deterministic auto-resolution
✓Easy direct access to SOC analysts and leadership for support, no tiered gatekeeping
✓24/7 monitoring with high confidence, reviewers trust it to catch things

Common complaints

×Onboarding communication breakdowns during complex enterprise rollouts
×No Slack integration despite years of customer requests
×Completely opaque pricing requires sales engagement for any ballpark

Questions to ask

1.
What is the exact pricing for our environment size, and how do costs scale with additional log sources or integrations?
2.
How does the TBR auto-resolution work in practice? Can we review what it resolves automatically and how does it adapt over time?
3.
What specific response authorizations can we pre-approve and how granular is the control?
4.
How does the two-person approval process work for response actions? Does it add meaningful latency?
5.
What is included in the base MDR vs. what requires separate purchase (OT/ICS, vulnerability management, IR/DFIR)?
6.
How does CORR platform integrate with our specific SIEM and EDR (CrowdStrike/SentinelOne/Defender)?
7.
What data and detection content do we retain access to if we terminate the relationship?
8.
How does the MobileSOC app integrate with our existing alerting and on-call workflows?

Evidence

This profile verified

Mar 31, 2026

This profile updated

Mar 31, 2026

Sources reviewed

Primary source

Critical Start public MDR page

Main public source used for the provider profile.

Public-data caveats

–SLA caveat: Contractual 60-minute or less time-to-resolution for all alerts. 10-minute notification for critical alerts. Two-person analyst validation adds safety before response actions are executed.
–No public fixed price is recorded; compare only after a scoped quote.
–No public breach warranty is recorded.
–Response authority may depend on pre-approval and contract scope.
–MDR analyst headcount or analyst-to-customer ratio is not public.

Also consider

Buyer fit

Good fit when

✓Mid-market to large enterprises wanting technology-agnostic MDR that works with their existing security stack
✓Organizations suffering from alert fatigue wanting TBR's deterministic auto-resolution to reduce noise
✓Companies needing OT/ICS monitoring alongside IT MDR through Claroty, Dragos and Nozomi integrations

Watch out when

×SMBs or budget-conscious organizations, enterprise-focused pricing not published
×Organizations requiring native Slack integration for SOC communication
×Companies wanting a breach warranty or financial guarantee

Coverage

EndpointIncluded

Cloud workloadsIncluded

IdentityIncluded

SaaSIncluded

Network / NDRIncluded

OT / IoTAdd-on

5 of 6 attack surfaces in the base price; the rest are separately priced.

EDR

CrowdStrikeSentinelOneMicrosoft DefenderPalo Alto Cortex

SIEM

Microsoft SentinelSplunkSumo Logic

Cloud

AWS (CloudTrail, GuardDuty, VPC, Lambda, S3, Route 53, EC2, EKS)Microsoft AzureGoogle Cloud PlatformAlibaba CloudOracle Cloud Infrastructure

Additional capabilities

Trusted Behavior Registry (TBR)MobileSOC AppMITRE ATT&CK MappingOT/ICS MonitoringVulnerability ManagementDFIR (via Cyber Incident Response Team)

Incident response

Monitoring

24/7 · 24/7/365 coverage across two US-based SOCs (Plano TX, Lehi UT). Software engineering COE in Pune, India (not a SOC). Vendor claims 90%+ analyst retention rate

First response

Configurable: auto-act per your playbook, or escalate for approval · Custom playbooks supported

Containment

Endpoint isolation · Process kill · Network containment · Account disable · File quarantine

Notification

Email · Portal · Phone

Response SLA

≤1 hour · Contractual 60-minute or less time-to-resolution for all alerts.

IR included

No, separate retainer

Pricing

Indicative cost

Not published

Minimum

Not published

Trial

None

Warranty

None

Custom enterprise pricing (annual subscription, tiered by coverage depth).

Cost caveats

–No public pricing at all, requires sales call for any ballpark
–OT/ICS monitoring and vulnerability management are separate purchases on top of base MDR
–Full IR/DFIR requires separate CIRT engagement, not included in MDR contract

1 more+

–Annual contract commitment typically required with no published minimum seat count

What costs extra (3)+

–IR/DFIR via Cyber Incident Response Team (CIRT), separate from base MDR
–Vulnerability management (Qualys VMDR-powered)
–OT/ICS monitoring (Claroty, Dragos, Nozomi, Otorio integrations)

Team and access

Analysts

Direct employees · Part of ~300 total employees. SOC-specific headcount not published.

Channels

Email · Portal · Phone

Data access

Dashboard Access

Portal

Account manager

Dedicated

Certifications

8-week (300+ hour) internal training program10 hours biweekly ongoing education

Reputation

Positive

What customers praise

✓TBR cuts false positives and alert fatigue from day one with deterministic auto-resolution
✓Easy direct access to SOC analysts and leadership for support, no tiered gatekeeping
✓24/7 monitoring with high confidence, reviewers trust it to catch things

Common complaints

×Onboarding communication breakdowns during complex enterprise rollouts
×No Slack integration despite years of customer requests
×Completely opaque pricing requires sales engagement for any ballpark

Questions to ask

1.
What is the exact pricing for our environment size, and how do costs scale with additional log sources or integrations?
2.
How does the TBR auto-resolution work in practice? Can we review what it resolves automatically and how does it adapt over time?
3.
What specific response authorizations can we pre-approve and how granular is the control?
4.
How does the two-person approval process work for response actions? Does it add meaningful latency?
5.
What is included in the base MDR vs. what requires separate purchase (OT/ICS, vulnerability management, IR/DFIR)?
6.
How does CORR platform integrate with our specific SIEM and EDR (CrowdStrike/SentinelOne/Defender)?
7.
What data and detection content do we retain access to if we terminate the relationship?
8.
How does the MobileSOC app integrate with our existing alerting and on-call workflows?

Evidence

This profile verified

Mar 31, 2026

This profile updated

Mar 31, 2026

Sources reviewed

Primary source

Critical Start public MDR page

Main public source used for the provider profile.

Public-data caveats

–SLA caveat: Contractual 60-minute or less time-to-resolution for all alerts. 10-minute notification for critical alerts. Two-person analyst validation adds safety before response actions are executed.
–No public fixed price is recorded; compare only after a scoped quote.
–No public breach warranty is recorded.
–Response authority may depend on pre-approval and contract scope.
–MDR analyst headcount or analyst-to-customer ratio is not public.

Also consider

Critical Start MDR

Buyer fit

Good fit when

Watch out when

Coverage

EDR

SIEM

Cloud

Additional capabilities

Incident response

Pricing

Cost caveats

Team and access

Certifications

Reputation

What customers praise

Common complaints

Questions to ask

Evidence

Sources reviewed

Public-data caveats

Also consider

Browse related

By size

By region

By compliance

By integration

By industry

Further reading

Critical Start MDR

Buyer fit

Good fit when

Watch out when

Coverage

EDR

SIEM

Cloud

Additional capabilities

Incident response

Pricing

Cost caveats

Team and access

Certifications

Reputation

What customers praise

Common complaints

Questions to ask

Evidence

Sources reviewed

Public-data caveats

Also consider

Browse related

By size

By region

By compliance

By integration

By industry

Further reading