Overview
Updated May 26, 2026
European MDR from Nomios with two delivery paths: Guardian xMDR, a tiered service built on Palo Alto Networks Cortex XDR and operated from Nomios' in-house SOC in Zoeterwoude, Netherlands; and Custom MDR for larger environments that need Microsoft, Splunk, QRadar, CrowdStrike or other existing tooling. Public materials describe 24/7 monitoring, analyst validation, automated response playbooks, threat hunting, EU data hosting, ISO 27001 and SOC 2 Type II certification. Public price amounts, response-time SLAs, breach warranty terms and analyst staffing ratios are not published.
Buyer fit
Good fit when
- ✓European buyers that need EU-hosted MDR data and a local SOC relationship
- ✓Organizations standardizing on Cortex XDR or considering a Cortex XDR-backed MDR service
- ✓Teams that want a packaged MDR tier but may later need custom detection engineering
- ✓Regulated organizations preparing for NIS2, DORA or GDPR data-residency scrutiny
- ✓Enterprises with OT, network or custom log sources that may need managed SIEM extension
Watch out when
- ×Buyers that need public per-endpoint price amounts before a sales call
- ×Organizations that want a published breach warranty
- ×Teams requiring a public fixed response-time SLA and service-credit terms
- ×Buyers outside Europe that need a local SOC in their region
Coverage
4 of 6 attack surfaces in the base price; the rest are separately priced.
EDR
SIEM
Cloud
Additional capabilities
Incident response
Pricing
Tiered Guardian xMDR pricing and custom pricing for tailored MDR.
How pricing works+−
Public materials state Guardian xMDR has Essential, Core, Advanced and Elite tiers, with scoping starting from endpoint count and expanding by coverage needs. Public price amounts are not listed.
Cost caveats
- –Nomios says Guardian xMDR has transparent tier-based pricing, but public price amounts are not listed.
- –Guardian xMDR is built on Cortex XDR, so buyers should price Palo Alto licensing and migration effort if they are not already on that stack.
- –Coverage outside Cortex XDR's native library may require the Sovereign Managed SIEM extension.
2 more+−
- –Custom MDR can keep existing tools, but SIEM, EDR and data-retention costs remain part of total cost.
- –No public breach warranty, trial or fixed response-time SLA was found.
What costs extra (6)+−
- –Optional SIEM coverage for log sources outside Cortex XDR native library
- –Sovereign Managed SIEM extension
- –Custom MDR for Microsoft Sentinel, Splunk, QRadar, CrowdStrike or other existing tools
- –Incident response beyond MDR coordination
- –Penetration testing, vulnerability management and security assessments
- –Additional detection engineering and custom playbooks beyond packaged tiers
Warranty conditions+−
No public breach warranty found for Nomios MDR.
Team and access
Reputation
Nomios has a European infrastructure and security-services footprint, but public MDR-specific peer review volume is limited. The clearest public evidence is from Nomios' own MDR page and Guardian xMDR launch material rather than independent managed-service evaluations.
What customers praise
- ✓In-house Dutch SOC with EU-hosted data
- ✓Guardian xMDR gives a structured Cortex XDR path while Custom MDR supports existing tools
- ✓Public materials separate packaged Guardian xMDR from Custom MDR
- ✓Broader Nomios group can provide incident response, testing, vulnerability management and OT security
Common complaints
- ×No public price amounts despite tiered-pricing language
- ×No public response-time SLA or breach warranty
- ×MDR-specific independent reviews and analyst metrics are limited
- ×Guardian xMDR buyers may need Palo Alto licensing or a migration from their current stack
No useful MDR-specific Reddit signal found during verification.
Questions to ask
- 1.
What are the exact prices for Essential, Core, Advanced and Elite, and which features move between tiers?
- 2.
Which response actions can Nomios take automatically, and which require approval?
- 3.
Does our scope require Cortex XDR, Sovereign Managed SIEM, Custom MDR, or a combination?
- 4.
What contractual SLA applies to critical incidents, containment and notification?
- 5.
Which data remains hosted in the EU, and what retention period is included?
- 6.
Are incident response hours included in MDR or sold separately?
- 7.
What customer portal, ticketing integration and raw-query access are included by tier?
- 8.
Can Nomios provide MDR-specific references for our industry and country?
Evidence
Sources reviewed
Public-data caveats
- –No public contractual response-time SLA is recorded for this profile.
- –No public fixed price is recorded; compare only after a scoped quote.
- –No public breach warranty is recorded.
- –Response authority may depend on pre-approval and contract scope.
- –MDR analyst headcount or analyst-to-customer ratio is not public.
Also consider
Further reading
Independent research. Verify details directly with the provider before making decisions.