Buyer fit
Good fit when
- ✓Large enterprises that want to keep their existing EDR, SIEM, and XDR stack and layer a global managed SOC on top
- ✓Organizations that want X-Force threat intelligence and an escalation path into IBM incident response, with optional OT coverage, under one services contract
- ✓Buyers already inside the IBM Consulting relationship, or migrating QRadar and Cortex environments, who want the vendor to run detection
Watch out when
- ×SMBs and cost-sensitive buyers who want transparent per-endpoint pricing and self-service onboarding
- ×Teams that rely on published MTTD/MTTR or MITRE managed-service results to compare vendors, since IBM publishes neither
- ×Buyers who want a large body of independent practitioner reviews before signing, since almost none exist for the MDR service
Coverage
4 of 6 attack surfaces in the base price; the rest are separately priced.
EDR
SIEM
Cloud
Additional capabilities
Incident response
Pricing
Custom quote only, scoped and delivered by IBM Consulting.
Checked Aug 2026
IBM Security X-Force Threat Management managed security services listing…
How pricing works+−
No public rate card. IBM's AWS Marketplace listing for X-Force managed security services notes recurring fees 'typically start between $10,000-$30,000' via private offer, with the actual fee varying by scope.
Not vendor-published as a rate card. AWS Marketplace private-offer guidance: recurring managed security services fees typically start between $10,000 and $30,000 (period not stated, scope-dependent).
Cost caveats
- –You supply and license your own EDR, SIEM, and XDR tools. IBM operates them, but that license cost sits on top of the MDR fee.
- –Quote-only with no public rate card, so budgeting requires a full IBM Consulting scoping engagement.
- –Enterprise contracting and onboarding run longer than platform-native MDR. Expect procurement and integration overhead.
2 more+−
- –IBM sold QRadar SaaS to Palo Alto in 2024. If you run QRadar, confirm whether detections stay on QRadar on-prem or migrate to Cortex XSIAM and what that costs.
- –Add-on X-Force services and extra data source onboarding are separate line items.
What costs extra (6)+−
- –Underlying EDR, SIEM, and XDR licensing (customer provides and licenses the tools IBM operates on)
- –X-Force incident response engagements and retainer hours (escalation access is included, the engagement is not)
- –OT/ICS monitoring scope (scoped add-on, not part of base TDR)
- –Add-on X-Force proactive services (penetration testing, red team, adversary simulation)
- –Exposure and vulnerability management
- –Additional log source and data source onboarding
Figures from named sources only (vendor pages, marketplaces, resellers, public procurement records, buyer reports), each dated. Nothing here is our estimate.
Team and access
Certifications
Reputation
IBM was named a Leader in the IDC MarketScape for Worldwide MDR/MXDR for the Enterprise 2026. Independent practitioner reviews of the MDR service are scarce: PeerSpot lists 0 reviews for IBM Managed Detection and Response and 1 review (4.5/5) for IBM Managed Security Services, Capterra shows 0, and no substantive Reddit discussion of IBM TDR was found. Analyst recognition is strong, but buyer-side validation is thin.
What customers praise
- ✓PeerSpot: advanced threat detection and real-time monitoring called out as standout features
- ✓PeerSpot: access to IBM's security experts helped a reviewer fine-tune incident response processes
Common complaints
- ×PeerSpot: the user interface and overall user experience need improvement
- ×PeerSpot: reviewer wanted more automated, AI-driven response than the service provided at the time
- ×Almost no MDR-specific practitioner reviews exist to validate the service independently
No substantive Reddit discussion of IBM's TDR or MDR service was found. IBM security tends to surface in enterprise procurement contexts rather than practitioner forums like r/msp or r/cybersecurity.
Questions to ask
- 1.
Which specific EDR, SIEM, and XDR platforms in our environment will ATOM and your SOC operate on, and are any of ours unsupported?
- 2.
Beyond auto-dispositioning alerts, which remediation actions will your analysts or ATOM take autonomously versus requiring our approval, and how are those playbooks agreed?
- 3.
The 'up to 85% of alerts handled by automation' figure is from IBM's own analysis. What automation rate should we realistically expect for our environment?
- 4.
What X-Force incident response scope is bundled into the TDR contract, and at what point do we need a separate IR retainer or extra hours?
- 5.
We run (or ran) QRadar. Given the 2024 sale to Palo Alto, do our detections stay on QRadar on-prem or migrate to Cortex XSIAM, and what does that cost?
- 6.
What contractual response-time commitments will you make, given that no standard MTTD or MTTR is published?
- 7.
Which SOC locations will handle our account, and how does follow-the-sun coverage work across our regions?
- 8.
What is the total cost including the underlying EDR and SIEM licensing we must provide, plus any add-on X-Force services and data source onboarding?
Evidence
Public-data caveats
- –No public contractual response-time SLA is recorded for this profile.
- –No public breach warranty is recorded.
- –Response authority may depend on pre-approval and contract scope.
- –MDR analyst headcount or analyst-to-customer ratio is not public.
Also consider
Further reading
Independent research. Verify details directly with the provider before making decisions.