Buyer fit
Good fit when
- ✓MSPs and resellers that want a white-label 24/7 SOC behind their own brand without building one in-house
- ✓MSPs serving CMMC and other regulated clients that need a SOC with its own C3PAO-verified CMMC Level 2 assessment and compliance evidence
- ✓Partners who want to keep clients' existing EDR and SIEM tools rather than rip and replace
Watch out when
- ×Organizations that want to buy directly from the SOC vendor, since CyFlare positions itself as partner-delivered and publishes no direct purchase path
- ×Buyers who need public per-seat pricing or independent detection benchmarks such as a MITRE ATT&CK evaluation
- ×Teams wanting a large, deeply staffed SOC or a dedicated threat-hunting team. CyFlare is a small provider of roughly 60 employees.
Coverage
4 of 6 attack surfaces in the base price; the rest are separately priced.
EDR
SIEM
Cloud
Additional capabilities
Incident response
Pricing
Per-user and per-endpoint, custom quote sold only through MSP and reseller partners.
Checked Aug 2026
How pricing works+−
CyFlare advertises 40%+ partner margins. No public per-endpoint or per-user rate is disclosed.
Not published. Quoted through MSP and reseller partners.
Cost caveats
- –No direct purchase path is published. Pricing and final markup are set by the MSP or reseller partner.
- –No public per-endpoint or per-user rate. Cost depends on partner markup and selected modules.
- –Managed email security, vulnerability scanning, and compliance support are separate line items on top of core MDR.
2 more+−
- –The underlying EDR and SIEM licenses are billed separately from the SOC service.
- –The $500,000 warranty is a service warranty with unpublished terms and exclusions, not a ransomware breach-loss payout.
What costs extra (6)+−
- –Managed email security (separate module)
- –Vulnerability scanning (separate module)
- –Compliance and CMMC evidence support (separate service)
- –mEDR Complete US-only SOC tier for regulated MSPs
- –Underlying EDR and SIEM licensing (SentinelOne, CrowdStrike, Microsoft, and others) billed separately
- –Professional services and deep forensic incident response beyond SOC-led containment
Warranty conditions+−
CyFlare advertises a $500,000 service warranty that backs SOC service performance, not a traditional ransomware breach-loss warranty that pays out on a breach. Specific triggers, conditions, and exclusions are not published. A separate $0 breach-response retainer gives partners on-call access to privileged legal counsel through a law firm partnership. Confirm terms in the partner agreement.
Team and access
Certifications
Reputation
CyFlare has almost no public buyer reviews. It is absent from Gartner Peer Insights, G2 (no product reviews), PeerSpot, TrustRadius, and Capterra, which is common for a white-label SOC that operates behind MSP brands. Industry recognition such as MSSP Alert's Top 250 (ranked 38 in 2025) and the Channel Partners MSP 501 (ranked 18 in 2025) is analyst ranking, not practitioner sentiment. The only public first-person signal is employee reviews.
Common complaints
- ×Glassdoor: employees rate compensation 2.8/5 and cite below-market pay, a retention risk worth probing for a small SOC where analyst continuity affects service quality
No substantive Reddit or r/msp discussion of CyFlare was found as of August 2026. As a white-label SOC sold under partner brands, CyFlare rarely surfaces by name in practitioner threads.
Questions to ask
- 1.
CyFlare's public SOC 2 Type II announcement dates to 2023. Can we see the current report, its scope, and the audit period, and is it renewed annually?
- 2.
Which response actions does your SOC take autonomously at 3am, and which require our approval as the MSP before execution?
- 3.
Is our coverage delivered from the global SOC or the US-only SOC (mEDR Complete), and what determines which one we get?
- 4.
What exactly does the $500,000 service warranty cover, what triggers it, and what are the exclusions?
- 5.
What is our per-endpoint and per-user rate, and how do the advertised 40%+ partner margins work at our volume?
- 6.
What is included in base MDR versus separate modules like managed email security, vulnerability scanning, and compliance support?
- 7.
What is your SOC analyst headcount, tenure, and retention, given you are a roughly 60-person company running a 24/7 SOC?
- 8.
If we leave, what case history, detections, and reports can we export, and what stays with CyFlare?
Evidence
Sources reviewed
Public-data caveats
- –SLA caveat: CyFlare publishes a tiered response-time SLA it calls Service MTTD, measured from when its SOC ingests a detection to disposition or a customer ticket. The Advanced tier commits to an initial response within 1 hour for critical, 4 hours for high, and 12 hours for medium. The Premiere tier tightens these to 30 minutes, 2 hours, and 4 hours, with low-severity items informational only. No public service-credit table was found. CyFlare separately markets operational averages of an 8.3-minute mean time to respond on critical cases and a sub-10-minute response to verified threats, which are vendor-reported and faster than the contractual targets, and backs service performance with a $500,000 service warranty.
- –No public fixed price is recorded; compare only after a scoped quote.
- –No public breach warranty is recorded.
- –Response authority may depend on pre-approval and contract scope.
- –MDR analyst headcount or analyst-to-customer ratio is not public.
Also consider
Further reading
Independent research. Verify details directly with the provider before making decisions.