Buyer fit
Good fit when
- ✓Google Cloud-heavy environments wanting deep Chronicle/Security Operations integration with MDR
- ✓Mid-market to enterprise wanting technology-agnostic MDR across existing CrowdStrike, SentinelOne, or Defender stacks
- ✓Organizations with significant identity security needs (SailPoint, CyberArk, Okta integrations)
Watch out when
- ×SMBs or buyers needing transparent, published pricing
- ×Buyers who weight community reviews heavily (virtually no public review data)
- ×Teams needing OT/ICS coverage or platform-native MDR with the vendor's own EDR
Coverage
5 of 6 attack surfaces in the base price; the rest are separately priced.
EDR
SIEM
Cloud
Additional capabilities
Incident response
Pricing
Custom quote-based, not publicly disclosed.
How pricing works+−
Not publicly disclosed.
Cost caveats
- –No public pricing at all. Expect an enterprise sales process with no self-serve benchmarks.
- –Google Chronicle license may be billed separately depending on delivery model. Clarify before signing.
- –DFIR is always a separate retainer, not included in base MDR.
1 more+−
- –Identity-first approach may require upfront IAM assessment and remediation work before MDR is fully operational.
What costs extra (5)+−
- –DFIR retainer (emergency or proactive, separate from MDR)
- –Exposure Management services
- –IAM / PAM services (SailPoint, CyberArk)
- –Offensive Security / Red Team engagements
- –Advisory and Professional Services
Team and access
Reputation
Gartner Peer Insights 5.0/5 from a single review. No G2 or Capterra listings. PeerSpot ranks #41 in MDR with 0 collected reviews. Glassdoor 3.2/5. Virtually no independent customer validation despite analyst recognition.
What customers praise
- ✓Reviewer-reported 30-minute SLA, not confirmed in public Cyderes materials
- ✓Google Cloud Security Partner of the Year 2025
- ✓Works with existing EDR/SIEM stack without rip and replace
Common complaints
- ×Almost no public customer reviews to validate claims
- ×Low Glassdoor and RepVue ratings suggest internal culture concerns
- ×Complex acquisition history (Herjavec + Fishtech + Lucidum + Ipseity) raises continuity questions
Questions to ask
- 1.
What is the all-in pricing for our environment size, and how do Client-Managed vs Co-Managed vs Fully Managed delivery models differ in cost?
- 2.
Is the Google Chronicle license included in MDR pricing, or billed separately?
- 3.
What specific response actions does the SOC take automatically vs requiring our approval, and how is this configured?
- 4.
How does the Howler Cell threat hunting team specifically benefit MDR customers vs being a separate service?
- 5.
What are the DFIR retainer terms, SLA, and cost, and what incident response capabilities are included in base MDR?
- 6.
With only one public review on Gartner Peer Insights and no G2 listing, can you provide direct customer references in our industry?
- 7.
What data do we retain access to if we terminate the MDR service, and what is the exit process?
- 8.
After the Herjavec/Fishtech merger and subsequent acquisitions (Lucidum, Ipseity), what has analyst retention looked like?
Evidence
Sources reviewed
Public-data caveats
- –No public contractual response-time SLA is recorded for this profile.
- –No public breach warranty is recorded.
- –Response authority may depend on pre-approval and contract scope.
- –MDR analyst headcount or analyst-to-customer ratio is not public.
Also consider
Further reading
Independent research. Verify details directly with the provider before making decisions.