Deepwatch MDR
Pure-play, SIEM-centric MDR with a patented Dynamic Risk Scoring engine claiming 98% false positive reduction. Squad Delivery Model assigns a named team of analysts, hunters, and engineers per customer, working on top of your existing Splunk, Google SecOps, Microsoft Sentinel, or Securonix SIEM. Significant organizational instability: 42% headcount reduction (412 to 239 employees) across 2024-2025, CEO replaced July 2024, founding CEO departed to competitor Mitiga Jan 2025, Glassdoor 2.9/5.
Buyer fit
Good fit when
- ✓Mid-market to enterprise with existing Splunk, Sentinel, Google SecOps, or Securonix SIEM investments
- ✓Companies wanting a dedicated named team (Squad model) rather than rotating analysts
- ✓AWS-heavy environments leveraging Level 1 MSSP Competency partnership
Watch out when
- ×SMBs or budget-constrained organizations ($220K-$315K/year is enterprise-oriented)
- ×Companies requiring global follow-the-sun SOC coverage (US-based only)
- ×Organizations concerned about provider stability given 42% headcount reduction, CEO change, and Glassdoor 2.9/5
Coverage
EDR
SIEM
Cloud
Additional capabilities
Incident response
Pricing
What costs extra
- –MEDR (Managed Endpoint Detection & Response, separate service)
- –Managed Vulnerability Management (separate service)
- –Managed Firewall (separate service)
Cost caveats
- –Volume-based pricing means unexpected data growth can cause cost spikes. Three platform tiers (Core, Advanced, Enterprise) may gate Active Response behind higher tiers.
- –MEDR (endpoint detection) is a separate add-on, not included in base MDR
- –MDR Essentials is a limited entry point with fewer capabilities than full platform tiers
Pricing compiled from public sources. Verify directly with the provider.
Team and access
Certifications
Reputation
Customer reviews are positive (Gartner Peer Insights 4.2/5 from 59 reviews, G2 High Performer Fall 2025), praising Squad team and DRS technology. Employee sentiment is concerning: Glassdoor 2.9/5 (215 reviews, 35% recommend). 42% headcount reduction (412 to 239 employees) across 2024-2025, founding CEO departed to competitor Mitiga Jan 2025.
What customers praise
- ✓Squad Delivery Model provides dedicated, named experts who learn your environment
- ✓Vendor-agnostic approach with broad SIEM and log source support (800+)
- ✓Patented DRS engine effectively reduces false positives
Common complaints
- ×Organizational instability: CEO change, 80 layoffs (42% headcount cut), founding CEO departed to competitor
- ×Customer support can be slow on simple requests. Slack channel 'tends to be quiet'.
- ×High cost ($220K-$315K/year average) limits accessibility to mid-market and enterprise only
Questions to ask
- 1.
What is the specific SLA for initial response time, and what are the credit-back terms if it is missed?
- 2.
How does volume-based pricing work, and what happens if we exceed our contracted GB/TB tier mid-year?
- 3.
Given recent layoffs (80 employees, 42% headcount reduction) and CEO transition, how are you ensuring continuity of our dedicated Squad team?
- 4.
What is included in Core vs. Advanced vs. Enterprise tiers, specifically, are Active Response capabilities included in Core?
- 5.
What happens to our detection content, playbooks, and DRS configurations if we terminate the contract?
- 6.
Can you provide documented MTTD and MTTR metrics from a customer environment comparable to ours?
Evidence
Sources reviewed
Public-data caveats
- –No public contractual response-time SLA is recorded for this profile.
- –No public breach warranty is recorded.
- –Response authority may depend on pre-approval and contract scope.
Also consider
Information compiled from public sources. Verify details directly with the provider before making decisions.