Overview
Updated Mar 2, 2026
UnderDefense runs an agentic AI SOC that works on top of the EDR and SIEM you already own rather than replacing them. The platform automates enrichment, correlation, and triage, verifies suspicious activity with end users over Slack or Teams, and routes containment decisions to your team or UnderDefense's 24/7 incident responders. Data stays in your infrastructure and you keep full query access to the underlying SIEM. Founded in Ukraine in 2017 and headquartered in New York, UnderDefense reports more than 200 enterprise customers across the US and EU (its own figure, not independently verified) and says its agents handle routine investigations in about 2 minutes per alert. No independent detection benchmarks exist, but pricing is transparent and data is portable on exit.
Buyer fit
Good fit when
- ✓Mid-market teams with existing EDR/SIEM that want MDR layered on top without ripping and replacing
- ✓Budget-conscious buyers who value transparent per-device pricing and full data ownership on exit
- ✓Organizations comfortable with a smaller, newer vendor in exchange for flexibility and no lock-in
Watch out when
- ×Organizations that require independently validated detection metrics (MITRE, Forrester, etc.) before committing
- ×Buyers that need a large, established vendor with deep bench strength and hundreds of published case studies
- ×Teams wanting month-to-month flexibility or a free trial before annual commitment
Coverage
5 of 6 attack surfaces in the base price; the rest are separately priced.
EDR
SIEM
Cloud
Additional capabilities
Incident response
Pricing
Per-device pricing, vendor-agnostic (same rate for all asset types).
Checked Jun 2026
Vendor-published starting per-device monthly price for UnderDefense MAXI MDR…
UnderDefense · checked Jun 2026
How pricing works+−
Starts at $11/device/month (vendor-published)
Cost caveats
- –$11/device is a starting price for marketing. Actual cost varies by scope, and annual contract is required.
- –3-year contract required for $1M breach warranty. Not available on 1-year deals.
- –IR retainer is separate from MDR. $0 upfront but billed per-incident, so budget for breach costs on top of subscription.
1 more+−
- –Custom integrations beyond pre-built connectors may require professional services fees.
What costs extra (4)+−
- –Incident response beyond 120-hour retainer
- –Penetration testing (separate service)
- –Compliance auditing services (separate service)
- –Custom security consulting
Warranty conditions+−
Requires 3-year MDR contract. Covers ransomware attacks and business email compromises. Does not cover regulatory fines or compliance failures. Who underwrites the warranty (UnderDefense directly or a third-party insurer) is not publicly documented.
Figures from named sources only (vendor pages, marketplaces, resellers, public procurement records, buyer reports), each dated. Nothing here is our estimate.
Team and access
Certifications
Reputation
Gartner Peer Insights 4.9/5 (7 reviews). G2 shows 5/5 but across only 31 total reviews for all products. 66 reviews on Clutch with strong ratings. PeerSpot mindshare is 0.0% in the MDR category. No Reddit or independent practitioner forum discussion found.
What customers praise
- ✓Fast onboarding (30 days) and responsive analyst communication per Gartner Peer Insights reviews
- ✓Vendor-agnostic approach preserves existing EDR and SIEM investments without forced replacement
- ✓Transparent starting pricing at $11/device with no data egress fees and full portability on exit
Common complaints
- ×Very small market presence (~128 employees, 0% PeerSpot mindshare) with limited independent review data
- ×All published metrics (2-min MTTD, 15-min MTTC, 90% FP reduction) are vendor-claimed with no third-party validation
- ×Annual contract required, 3-year commitment for breach warranty, no free trial for MDR
No Reddit or practitioner forum discussion found. Limited visibility in independent communities makes it hard to gauge real-world satisfaction beyond vendor-curated review platforms.
Questions to ask
- 1.
What specific remediation actions will your analysts take autonomously vs. requiring our approval, and how do we configure those thresholds?
- 2.
Your MTTD and MTTR figures come from marketing materials. Have you participated in MITRE ATT&CK Evaluations or any third-party benchmark? If not, why?
- 3.
How does the $1M breach warranty work in practice? Who underwrites it, what are the exact exclusions, and have you ever paid a claim?
- 4.
How many SOC analysts would cover our account, and what is the analyst-to-customer ratio? This is not published anywhere.
- 5.
The 500+ client count includes all services. How many active MDR-only customers do you have today?
- 6.
You market 250+ integrations. Can you share the full list and clarify which are pre-built vs. custom API work, and what custom work costs?
- 7.
Your OT/ICS coverage appears in blog posts but not as a formal product. What does OT monitoring actually include, and do you have manufacturing customer references?
- 8.
Detection rules are written in Sigma format. If we leave, do we retain full ownership of custom rules built during our engagement?
Evidence
Sources reviewed
Public-data caveats
- –No public contractual response-time SLA is recorded for this profile.
- –Response authority may depend on pre-approval and contract scope.
- –MDR analyst headcount or analyst-to-customer ratio is not public.
Also consider
Further reading
Independent research. Verify details directly with the provider before making decisions.