Buyer fit
Good fit when
- ✓European mid-market companies wanting a GDPR-native provider with local SOC coverage
- ✓Italian businesses needing Italian-language support and in-country SOC operations
- ✓Organizations with existing security tools wanting MDR that integrates rather than replaces their stack
Watch out when
- ×Global enterprises needing follow-the-sun SOC coverage outside Europe
- ×Buyers who need published detection metrics or MITRE-validated performance data
- ×Companies that require transparent pricing to compare MDR providers without a sales call
Coverage
2 of 6 attack surfaces in the base price; the rest are separately priced.
EDR
SIEM
Cloud
Additional capabilities
Incident response
Pricing
Custom pricing based on environment size and integrated tools.
How pricing works+−
Pricing model not publicly disclosed. SaaS delivery.
Cost caveats
- –No public pricing. You cannot compare costs without a sales call.
- –Cypeer Agent X deployment required on endpoints, adding rollout overhead to onboarding.
- –International expansion is recent (Spain 2024, Poland via partners). Support quality outside Italy may vary.
2 more+−
- –Detection rules and threat intel are proprietary. If you leave, none of it transfers.
- –IR is described as included, but scope is not documented. Clarify whether it covers full DFIR or just triage and escalation.
What costs extra (3)+−
- –Log Management Module (compliance-focused log tracking)
- –Additional technology integrations beyond standard scope
- –Custom threat intelligence feeds
Team and access
Certifications
Reputation
Gartner Peer Insights 4.6/5 (25 reviews). Named Gartner Representative Vendor for MDR in 2021, 2023, and 2024, the only Italian company among 40 vendors in the 2024 guide. Strong reputation in Italian mid-market. Very limited English-language community discussion, likely due to European-centric customer base.
What customers praise
- ✓Technology-agnostic. Works with existing EDR, SIEM, and firewall investments.
- ✓Threat hunting and IR included in base MDR, not add-ons.
- ✓Gartner-recognized three years running for an Italian SME-scale provider
Common complaints
- ×No published MTTD/MTTR metrics and no MITRE evaluation participation
- ×~105 total employees. Small team relative to US-based MDR leaders.
- ×Zero public pricing. Requires sales engagement for any cost comparison.
Essentially no Reddit discussion. Cyberoo's customer base is European mid-market, so English-language practitioner communities have almost no signal on them.
Questions to ask
- 1.
What is the exact per-endpoint pricing, and what falls outside the base Cypeer MDR service?
- 2.
With ~105 total employees, how many are dedicated SOC analysts on shift at any given time?
- 3.
You don't publish MTTD or MTTR. Can you share internal metrics or results from any third-party detection validation?
- 4.
What is the data retention period, and what is the export process if we leave?
- 5.
Your Spain and Poland SOC presence is new. What Tier 1 vs. Tier 2 capabilities exist in each region today?
- 6.
Can you provide written SLA commitments for response time and escalation, not just best-effort targets?
- 7.
What specific automated response actions does Cypeer Keera take? Can it isolate endpoints directly, or does it depend on the customer's EDR API?
- 8.
What does included IR actually cover? Is it full DFIR, or triage and escalation guidance for major incidents?
- 9.
What OT/ICS protocols and environments does Cypeer actually monitor, and do you have a named OT technology partner?
Evidence
Sources reviewed
Public-data caveats
- –No public contractual response-time SLA is recorded for this profile.
- –No public fixed price is recorded; compare only after a scoped quote.
- –No public breach warranty is recorded.
- –Response authority may depend on pre-approval and contract scope.
Also consider
Further reading
Independent research. Verify details directly with the provider before making decisions.