Obrela MDR
Works with your toolsIntegrates with your existing security tools via APIs. You keep your current EDR, SIEM, and cloud tools.European services firm delivering technology-agnostic MDR through its proprietary SWORDFISH Open XDR platform. Founded in Athens in 2010 and expanded via the Encode acquisition in 2022, Obrela now operates from London with ROCs across Europe and the Middle East. Unusual among MDR providers for offering dedicated OT/ICS and maritime vessel monitoring as separate services.
Best For
Ideal for
- European or MENA organizations wanting local SOC presence and data residency
- Maritime or OT/ICS operators needing MDR built for those environments
- Microsoft-centric shops wanting Sentinel/Defender MDR from a MISA member
Not ideal for
- North American or APAC organizations needing local SOC presence
- Buyers who need transparent, published pricing before engaging sales
- Teams expecting threat hunting included in base MDR
Coverage
Endpoint
Cloud
Identity
SaaS
Network
OT / IoT
Compatible Tools
EDR
SIEM
Cloud
Additional Capabilities
Incident Response
Obrela publishes a mean response time of under 15 minutes.
Detection Quality
Threat Hunting
Pricing
Custom pricing. Four tiers: MDR Core Lite, Core Plus, CoreX Max, and CoreX Elite, with increasing detection content and hunting capabilities. Specialized modulespriced separately.. Not published contracts.
Pricing compiled from public sources. Verify directly with the provider.
The Team
Reputation
Named in the Gartner Market Guide for MDR four times (2021, 2023, 2024, 2025) and included in Forrester Wave MDR Services Europe Q3 2025. Virtually no customer reviews on G2, PeerSpot, or Reddit. Glassdoor 3.7/5 (52 reviews, 63% recommend). Strong analyst recognition but almost no independent customer validation.
What customers praise
- Gartner Market Guide (4 editions) and Forrester Wave MDR Europe Q3 2025 inclusion
- Publishes operational metrics (11.2-minute MTTR claim) when most competitors do not
- OT/ICS and maritime vessel MDR serve verticals most MDR providers ignore
Common complaints
- Virtually no public customer reviews anywhere (G2, PeerSpot, Reddit)
- Opaque four-tier pricing with no published feature boundaries between tiers
- Threat hunting is an add-on at every tier, unlike competitors who include it
Reddit (r/sysadmin, r/msp)
No mentions found in r/msp, r/cybersecurity, or r/sysadmin.
What to Ask Obrela (6 questions)▼
- 1.
What specific capabilities differ between MDR Core Lite, Core Plus, CoreX Max, and CoreX Elite? Can we see a feature comparison?
- 2.
Threat hunting is listed as an add-on. What does it cost, how many hunts per quarter, and what triggers a proactive hunt versus a reactive one?
- 3.
The 11.2-minute MTTR for critical incidents on your website, how is that measured and what percentage of incidents does it cover?
- 4.
We do not use Microsoft Sentinel. What detection coverage gaps exist when SWORDFISH integrates with a non-Microsoft SIEM?
- 5.
If we leave Obrela, what happens to detection content, playbooks, and historical data stored in SWORDFISH?
- 6.
You have virtually no public customer reviews. Can you provide three references in our industry and region?
Browse Related
Information compiled from public sources. Verify details directly with the provider before making decisions.