eSentire
Pure-play MDR with a public 15-minute mean time to contain claim. Atlas XDR platform correlates endpoint, network, log, cloud, and identity telemetry across 300+ integrations. Isolates 99.3% of threats at first host. Named a Leader in The Forrester Wave MDR Services in Europe Q3 2025. Serves 2,000+ organizations across 80+ countries.
Buyer fit
Good fit when
- ✓Organizations wanting a provider that publicly reports 15-minute containment with true active remediation
- ✓Mid-market and enterprise with complex multi-vendor security stacks needing 300+ integrations
- ✓Companies wanting unlimited incident response included in MDR (verify scope with vendor)
Watch out when
- ×Budget-constrained SMBs seeking the lowest-cost MDR option
- ×Organizations wanting APAC SOC coverage (no dedicated APAC SOC)
- ×Companies that prefer full response control in-house or want a reporting-only model
Coverage
EDR
SIEM
Cloud
Additional capabilities
Incident response
Pricing
What costs extra
- –Digital Forensics (beyond MDR scope)
- –Managed Vulnerability Service (Complete tier or add-on)
- –Managed Phishing and Security Awareness
Cost caveats
- –Tier differences are significant. Essentials may lack key response and advisory capabilities available in Advanced/Complete.
- –BYOL pricing differs from bundled Atlas Agent pricing. Custom pricing for 5,000+ endpoints.
- –MSP program uses inflexible per-customer purchasing model (criticized by partners)
Pricing compiled from public sources. Verify directly with the provider.
Team and access
Certifications
Reputation
G2 4.6/5 (272 reviews). Gartner Peer Insights 4.6/5 (83 reviews). PeerSpot 7.6/10. Forrester Wave Leader (Europe Q3 2025). Praised for public 15-minute containment metrics and true active remediation. Some price sensitivity for SMBs and occasional SOC response delays on non-emergency tickets.
What customers praise
- ✓Public 15-minute Mean Time to Contain metric with 99.3% first-host threat isolation
- ✓True active remediation with direct SOC analyst actions (endpoint isolation, account lockdown, network containment)
- ✓300+ technology integrations with vendor-agnostic BYOL approach for 4 EDR platforms
Common complaints
- ×Pricing can be higher than budget MDR options, especially for SMBs
- ×Atlas portal could offer more self-service query capabilities for teams wanting forensic independence
- ×Limited APAC SOC coverage (no dedicated APAC SOC, relies on regional analysts and InfoTrust partnership)
Limited Reddit discussion found. Practitioner praise on review platforms (G2, Gartner, PeerSpot) focuses on true active remediation and 15-minute MTTC. Price concerns for SMBs noted.
Questions to ask
- 1.
What specific response actions are included in each Atlas tier (Essentials vs. Advanced vs. Complete)?
- 2.
How does the 15-minute containment SLA apply when using third-party EDR vs. the eSentire Agent? What happens if the SLA is missed?
- 3.
What exactly does 'unlimited incident response' cover, just containment actions, or full forensics and recovery?
- 4.
If we leave eSentire, what data and detection logic can we export?
- 5.
How does the BYOL pricing compare to the bundled Atlas Agent option?
- 6.
Why hasn't eSentire participated in MITRE ATT&CK evaluations?
Evidence
Sources reviewed
Main public source used for the provider profile.
Detailed description of eSentire's active remediation and response capabilities
eSentire recognized as a Leader in The Forrester Wave™: MDR Services in Europe, Q3 2025
February 2022 announcement of eSentire's Series E funding and unicorn valuation achievement
Case study of how eSentire MDR services help scale security operations for insurance company policyholders
Public-data caveats
- –No public contractual response-time SLA is recorded for this profile.
- –No public breach warranty is recorded.
- –Response authority may depend on pre-approval and contract scope.
Also consider
Information compiled from public sources. Verify details directly with the provider before making decisions.