Name: ThreatDown ThreatDown MDR
Brand: ThreatDown

Buyer fit

Good fit when

✓SMBs and IT-constrained organizations wanting affordable MDR with published pricing
✓MSPs wanting channel-first MDR with OneView multi-tenant console and RMM integrations
✓Environments prioritizing ransomware protection with 7-day rollback capability

Watch out when

×Enterprise organizations needing multi-surface coverage (cloud, SaaS, identity, network)
×Organizations wanting vendor-agnostic MDR that works with existing EDR investments
×Buyers wanting formal MTTD/MTTR SLA commitments or dedicated analyst support

Coverage

EndpointIncluded

Cloud workloadsNot offered

IdentityNot offered

SaaSNot offered

Network / NDRNot offered

OT / IoTNot offered

1 of 6 attack surfaces in the base price; the rest are separately priced.

Platform

ThreatDown EDR Platform (Patented Linking Engine)Internal MDR SIEM and SOAR platform7-day ransomware rollbackThree-level endpoint isolation (network/process/desktop)Flight Recorder SearchNebula console (direct customers)OneView console (MSP multi-tenant)

Additional capabilities

7-Day Ransomware RollbackPatch Management (Advanced+ tier)DNS Filtering (Ultimate tier)

Incident response

Monitoring

24/7 · 24/7/365 SOC. Specific locations not disclosed beyond Santa Clara, California headquarters with offices in Europe and Asia

First response

Configurable: auto-act per your playbook, or escalate for approval

Containment

Endpoint isolation · Process kill · File quarantine

Notification

Slack · Teams · Portal · Email · Phone

Response SLA

Not disclosed · No formal MTTD/MTTR SLA published.

IR included

No, separate retainer

Pricing

Indicative cost

$99/endpoint/yr

vendor list

Minimum

Trial

15 days

Warranty

None

Per-endpoint, published pricing.

Checked Jun 2026

$99/endpoint/yr

Vendor-published Elite endpoint tier includes MDR at $99/endpoint/year; Ultimate is…

ThreatDown · checked Jun 2026

Vendor list

How pricing works+

Four bundles: Core ($69), Advanced ($79), Elite ($99, includes MDR), Ultimate ($119, MDR+DNS+Premium). Server: $129-179/year. Mobile: $10/device. 5-endpoint minimum. 10% discount for 2-year commitment.

MDR at $99/endpoint/year (Elite) or $119/endpoint/year (Ultimate). Server: $129-179/year. Mobile: $10/device.

Cost caveats

–Endpoint-only coverage, no cloud workload, SaaS, identity, or network monitoring
–Platform-native lock-in, cannot BYO CrowdStrike, SentinelOne, or Defender
–No dedicated analyst or account manager, pooled SOC model

What costs extra (3)+

–DNS Filtering (Ultimate tier only, $119)
–Server protection ($129-179/year per server)
–Mobile protection ($10/device, Android/iOS/ChromeOS)

Figures from named sources only (vendor pages, marketplaces, resellers, public procurement records, buyer reports), each dated. Nothing here is our estimate.

Team and access

Analysts

Direct employees · Not disclosed. Malwarebytes has ~600-800 employees total. ThreatDown division size and MDR analyst count not publicly stated.

Channels

Slack · Teams · Portal · Email · Phone

Data access

Dashboard Access

Portal

Nebula console (direct customers) or OneView console (MSP multi-tenant). Dashboards for threat visibility, case management, and compliance reporting. Mobile app available.

Account manager

Shared / pooled

Reputation

Positive

G2 4.6/5 (1,074 reviews) with multiple Leader awards (Best ROI, Easiest to Use). Gartner Peer Insights 4.6/5 (904 reviews) for EDR, though MDR-specific reviews are fewer. MRG Effitas EPP Product of the Year 2025. IDC MarketScape 2024: Leader for endpoint security (Small Business). Praised for simplicity and price transparency. Main knock: endpoint-only with platform lock-in.

What customers praise

✓Published pricing ($99/endpoint/year for MDR), most vendors require sales calls
✓Deploys in minutes with minimal IT involvement
✓7-day ransomware rollback and three-level endpoint isolation

Common complaints

×Endpoint-only coverage, no cloud, SaaS, identity, or network monitoring
×Platform-native lock-in, cannot use with other EDR vendors
×Support can be slow per some reviewers, no dedicated analyst

In r/msp, Malwarebytes/ThreatDown is well-regarded as cost-effective SMB endpoint protection but considered less feature-rich than SentinelOne or CrowdStrike for advanced use cases.

Questions to ask

1.
What is the actual analyst-to-customer ratio in the SOC?
2.
How does the 7-day ransomware rollback work technically, and what are the failure scenarios?
3.
What happens if we need IR beyond endpoint isolation, do you have IR partners?
4.
What is the upgrade path if we outgrow endpoint-only coverage and need cloud/identity/network monitoring?

Evidence

This profile verified

Feb 27, 2026

This profile updated

Feb 27, 2026

Sources reviewed

Primary source

ThreatDown public MDR page

Main public source used for the provider profile.

Public-data caveats

–No public contractual response-time SLA is recorded for this profile.
–No public breach warranty is recorded.
–Response authority may depend on pre-approval and contract scope.

Also consider

Buyer fit

Good fit when

✓SMBs and IT-constrained organizations wanting affordable MDR with published pricing
✓MSPs wanting channel-first MDR with OneView multi-tenant console and RMM integrations
✓Environments prioritizing ransomware protection with 7-day rollback capability

Watch out when

×Enterprise organizations needing multi-surface coverage (cloud, SaaS, identity, network)
×Organizations wanting vendor-agnostic MDR that works with existing EDR investments
×Buyers wanting formal MTTD/MTTR SLA commitments or dedicated analyst support

Coverage

EndpointIncluded

Cloud workloadsNot offered

IdentityNot offered

SaaSNot offered

Network / NDRNot offered

OT / IoTNot offered

1 of 6 attack surfaces in the base price; the rest are separately priced.

Platform

Additional capabilities

7-Day Ransomware RollbackPatch Management (Advanced+ tier)DNS Filtering (Ultimate tier)

Incident response

Monitoring

24/7 · 24/7/365 SOC. Specific locations not disclosed beyond Santa Clara, California headquarters with offices in Europe and Asia

First response

Configurable: auto-act per your playbook, or escalate for approval

Containment

Endpoint isolation · Process kill · File quarantine

Notification

Slack · Teams · Portal · Email · Phone

Response SLA

Not disclosed · No formal MTTD/MTTR SLA published.

IR included

No, separate retainer

Pricing

Indicative cost

$99/endpoint/yr

vendor list

Minimum

Trial

15 days

Warranty

None

Per-endpoint, published pricing.

Checked Jun 2026

$99/endpoint/yr

Vendor-published Elite endpoint tier includes MDR at $99/endpoint/year; Ultimate is…

ThreatDown · checked Jun 2026

Vendor list

How pricing works+

MDR at $99/endpoint/year (Elite) or $119/endpoint/year (Ultimate). Server: $129-179/year. Mobile: $10/device.

Cost caveats

–Endpoint-only coverage, no cloud workload, SaaS, identity, or network monitoring
–Platform-native lock-in, cannot BYO CrowdStrike, SentinelOne, or Defender
–No dedicated analyst or account manager, pooled SOC model

What costs extra (3)+

–DNS Filtering (Ultimate tier only, $119)
–Server protection ($129-179/year per server)
–Mobile protection ($10/device, Android/iOS/ChromeOS)

Figures from named sources only (vendor pages, marketplaces, resellers, public procurement records, buyer reports), each dated. Nothing here is our estimate.

Team and access

Analysts

Direct employees · Not disclosed. Malwarebytes has ~600-800 employees total. ThreatDown division size and MDR analyst count not publicly stated.

Channels

Slack · Teams · Portal · Email · Phone

Data access

Dashboard Access

Portal

Nebula console (direct customers) or OneView console (MSP multi-tenant). Dashboards for threat visibility, case management, and compliance reporting. Mobile app available.

Account manager

Shared / pooled

Reputation

Positive

What customers praise

✓Published pricing ($99/endpoint/year for MDR), most vendors require sales calls
✓Deploys in minutes with minimal IT involvement
✓7-day ransomware rollback and three-level endpoint isolation

Common complaints

×Endpoint-only coverage, no cloud, SaaS, identity, or network monitoring
×Platform-native lock-in, cannot use with other EDR vendors
×Support can be slow per some reviewers, no dedicated analyst

In r/msp, Malwarebytes/ThreatDown is well-regarded as cost-effective SMB endpoint protection but considered less feature-rich than SentinelOne or CrowdStrike for advanced use cases.

Questions to ask

1.
What is the actual analyst-to-customer ratio in the SOC?
2.
How does the 7-day ransomware rollback work technically, and what are the failure scenarios?
3.
What happens if we need IR beyond endpoint isolation, do you have IR partners?
4.
What is the upgrade path if we outgrow endpoint-only coverage and need cloud/identity/network monitoring?

Evidence

This profile verified

Feb 27, 2026

This profile updated

Feb 27, 2026

Sources reviewed

Primary source

ThreatDown public MDR page

Main public source used for the provider profile.

Public-data caveats

–No public contractual response-time SLA is recorded for this profile.
–No public breach warranty is recorded.
–Response authority may depend on pre-approval and contract scope.

Also consider

ThreatDown MDR

Buyer fit

Good fit when

Watch out when

Coverage

Platform

Additional capabilities

Incident response

Pricing

Cost caveats

Team and access

Reputation

What customers praise

Common complaints

Reddit

Questions to ask

Evidence

Sources reviewed

Public-data caveats

Also consider

Browse related

By size

By region

By compliance

By integration

By industry

Further reading

ThreatDown MDR

Buyer fit

Good fit when

Watch out when

Coverage

Platform

Additional capabilities

Incident response

Pricing

Cost caveats

Team and access

Reputation

What customers praise

Common complaints

Reddit

Questions to ask

Evidence

Sources reviewed

Public-data caveats

Also consider

Browse related

By size

By region

By compliance

By integration

By industry

Further reading