Mandiant Managed Defense
Services-firm MDR powered by 500+ Mandiant threat intelligence analysts from 30+ countries, acquired by Google Cloud for $5.4B in 2022. Works with your existing EDR (CrowdStrike, Microsoft Defender, SentinelOne) without requiring a proprietary agent. Expert-led response with single-click endpoint containment, but full incident response requires a separate retainer.
Buyer fit
Good fit when
- ✓Enterprise organizations wanting threat intelligence integrated directly into MDR from 500+ frontline analysts
- ✓Multi-vendor EDR environments (CrowdStrike, Microsoft Defender, SentinelOne all supported without agent swap)
- ✓Google Cloud Platform customers wanting native SecOps integration
Watch out when
- ×SMBs or budget-constrained organizations (~$83K+/year estimated pricing)
- ×Companies wanting incident response included in MDR (IR is a separate retainer)
- ×Buyers wanting published contractual detection/response SLAs (portal uptime is the only formal SLA)
Coverage
EDR
SIEM
Cloud
Additional capabilities
Incident response
Pricing
What costs extra
- –Incident Response retainer (separate service, 2-hour response time, pre-negotiated rates)
- –OT/ICS coverage (dedicated Managed Defense for OT offering)
- –Google Security Operations platform licensing (may be bundled or separate)
Cost caveats
- –~$83K+/year estimated, premium enterprise pricing
- –IR retainer is separate and must be purchased independently for full incident response
- –Managed Defense for Google SecOps currently GA in US only, international customers face limitations
Pricing compiled from public sources. Verify directly with the provider.
Team and access
Reputation
Mandiant brand is synonymous with threat intelligence and incident response. TrustRadius 6.9/10 (11 reviews). PeerSpot 8.4/10 (Mandiant Advantage, not MDR-specific). Limited public reviews for Managed Defense specifically. Primary criticism: premium pricing, dashboard complexity, and IR being a separate retainer despite Mandiant's IR reputation.
What customers praise
- ✓Unmatched threat intelligence operation (500+ analysts, 30+ countries, M-Trends report)
- ✓Expert-led response with deep attacker knowledge from frontline IR engagements
- ✓Google Cloud backing provides scale, infrastructure, and long-term viability
Common complaints
- ×Premium pricing (~$83K+/year) not accessible to mid-market or SMBs
- ×Dashboard complexity for new users, designed for enterprise teams
- ×IR is a separate retainer despite Mandiant's IR reputation being its primary brand asset
Mandiant is widely respected in the cybersecurity practitioner community for threat intelligence and incident response expertise. No Reddit discussions specifically about the MDR service found.
Questions to ask
- 1.
What specific detection and response SLA commitments can you provide in writing beyond 'minutes, not hours'?
- 2.
How does Managed Defense pricing interact with Google Security Operations licensing, are they bundled or separate costs?
- 3.
What is the actual MTTD and MTTR for Managed Defense customers (not industry-wide M-Trends data)?
- 4.
For non-US customers, when will Managed Defense for Google SecOps be GA internationally?
- 5.
What is the handoff process between Managed Defense and the separate IR retainer during a major incident?
- 6.
What data do we retain access to if we leave, and in what format can we export our security data?
Evidence
Sources reviewed
Public-data caveats
- –No public contractual response-time SLA is recorded for this profile.
- –No public breach warranty is recorded.
- –Response authority may depend on pre-approval and contract scope.
- –MDR analyst headcount or analyst-to-customer ratio is not public.
Also consider
Information compiled from public sources. Verify details directly with the provider before making decisions.