The job to be done
Turn a signal into a timely, accountable decision with a clear handoff.
Security operations combines tools, people and agreed response responsibilities. Security orchestration, automation and response (SOAR) platforms connect systems through playbooks for enrichment, approval and action. Managed detection and response (MDR) adds provider analysts operating within contracted telemetry and response boundaries. Incident-response retainers arrange access to specialist support and may include readiness work as well as incident assistance. A useful evaluation separates software capabilities from staffed services, verifies who may act and rehearses how evidence, approvals and recovery work pass between teams.
What goes in
- Alerts and investigation context
- Approved procedures and authority
- Business contacts and service expectations
What should come out
- Enriched cases and action proposals
- Approved response and verification
- Escalations, records, and lessons learned
Inside the segment
These capabilities answer different questions. Use the distinction to define the work before assembling a shortlist.
SOAR / automation software
License a platform the buyer configures and staffs so playbooks can enrich alerts, require human approval, and then act across connected tools.
Boundary: The operating team remains responsible for workflow credentials, maintenance and coverage. Automation software does not supply staffed monitoring or a managed response service.
Managed detection and response
Delegate monitoring, investigation, hunting, and contracted response against agreed telemetry to a provider's analysts.
Boundary: Hours, signals, and containment rights live in the statement of work. MDR is not unlimited digital forensics and is not the same commercial object as SOAR software.
Incident-response retainers
Arrange access to incident-response expertise and agreed services before an incident; the contract may also include readiness exercises or specialist support during a response.
Boundary: A retainer is a service agreement with defined scope and availability. Confirm whether preparation, response hours and specialist work are included rather than treating it as continuous monitoring.
SIEM and EDR tools
Security information and event management collects and correlates events; endpoint detection and response supplies host telemetry. Both feed playbooks and MDR services.
Boundary: A SIEM or EDR license does not provide a staffed investigation team. Confirm which response functions and managed services are included in each proposed offering.
Managed SIEM and MSSP operations
Broader managed operations such as log collection, device management, and ticketed alerting, which may or may not include active containment.
Boundary: Managed SIEM may store logs and still leave investigation to the customer. Defender Experts Plan 2 is explicitly not managed SIEM.
How the work flows
Choose tools, services and responsibilities
If the gap is inconsistent process across tools, evaluate automation. If the gap is staffed investigation, evaluate a managed service. Arrange specialist incident-response support according to the remaining need. These options can be combined, but their responsibilities and handoffs should be explicit.
Assign responsibilities and response authority
Before purchase, name who monitors, declares incidents, approves actions and executes responses. A responsibility matrix can identify who is responsible, accountable, consulted and informed. Specify who may isolate a host, disable an identity or make other disruptive changes, and during which hours.
Onboard telemetry and approved actions
Connect only the telemetry and actions in scope. Notify-only is a valid response mode that leaves action with the customer. Document excluded systems and test whether the remaining coverage meets the intended investigation and response needs.
Operate, hand off, and record evidence
Investigate, contain only what is authorized, hand remaining IT work to the customer, and keep tickets, timelines, and raw evidence exportable. Customer teams still patch, provide domain context, and execute actions the provider is not authorized to take.
Rehearse specialist handoffs and service exit
Tabletop a case beyond the managed-service scope. Confirm access to specialist support, evidence export and customer responsibilities. Rehearse exporting workflow definitions or case history, revoking delegated credentials and retaining access to the records the organization needs.
The environment changes the question
Use these scenarios to adapt the evaluation to your organization. They describe operational concerns, not a determination of compliance.
Finance ↗
A bank evaluates whether identity and privileged-access actions in playbooks or MDR are dual-controlled, whether investigation records meet its evidence-retention standard, and whether ATM or branch networks are in telemetry scope.
Evaluate: Dual-control identity actions and evidence retention before any auto-containment of privileged accounts.
Utilities ↗
A utility asks whether playbooks or MDR actions can touch safety-instrumented or Purdue-segmented networks, whether OT detections are read-only, and who authorizes process-impacting containment.
Evaluate: Keep OT detections read-only unless plant owners pre-authorize process impact.
Manufacturing ↗
A plant asks about engineering workstations, vendor remote access, disconnected sites, and whether MDR isolation of a workstation is pre-approved against plant change-control.
Evaluate: Pre-approve isolation of engineering workstations against plant change-control before go-live.
Healthcare ↗
A hospital asks about protected health information in case comments and vendor SOC access, whether medical-device networks are monitored or out of scope, and how downtime-sensitive clinical systems are treated before auto-isolation.
Evaluate: Confirm clinical-system isolation rules and health data handling in case comments before enabling auto-isolation.
What drives the operating cost
- Software cost follows platform subscription, any metered automation runtime, on-premises orchestrators, content packs, professional services to build playbooks, and the internal people who maintain them.
- Service cost follows asset or user count, which telemetry domains are in-scope, retention, custom detection sources, and whether the response mode is monitor or contain.
- Specialist incident-response hours may be included, capped or separately contracted. Any warranty has its own eligibility, conditions and limits to evaluate.
- Customer staff time for onboarding, business context, patching, approvals and actions outside the provider’s authorized scope.
Questions worth asking
- Who owns an incident at 2 a.m., and who can authorize disruption?
- What happens when an integration or escalation fails?
- Can we retrieve the full evidence and action history when the service ends?
Common assumptions to check
A playbook engine staffs a night shift.
SOAR and security automation are licensed software the buyer configures and staffs. Playbooks do not create around-the-clock analysts; night coverage still requires people, an MSSP, or a separate MDR contract.
MDR is unlimited incident response.
MDR provides monitoring, investigation and response within an agreed scope. Specialist forensics or recovery work may be included or separately contracted; check the agreement instead of inferring coverage from the service label.
A SIEM or EDR license is the same buy as SOAR or MDR.
SIEM collects and correlates events; EDR supplies endpoint evidence and supported response functions. Automation software and staffed MDR have different responsibilities even when they share a vendor or console.
APPLY THE IDEA / EVALUATION PLAN
Make the outcome observable.
Run a tabletop with an unavailable approver, an expired credential, and a failed response. Measure the handoff instead of assuming automation works.
Tabletop responsibilities for a synthetic ransomware and business-email-compromise incident.
A written record of who isolates hosts, who disables accounts, who calls legal, and what the vendor will actually do at 02:00, including notify-only versus pre-authorized containment.
Run an authorized telemetry proof in a lab or explicitly authorized test tenant.
Using the provider's supported validation method, time acknowledge to investigate to the recommended or executed action, with no production credentials and no attack code.
Prove automation gates on a synthetic phishing case with a disposable test identity.
A playbook or service action with a mandatory human step, limited permissions, rollback, and an exported audit trail that shows the gate fired.
Confirm the specialist response handoff and an evidence-preserving exit path.
A mock case exceeding the managed-service scope, an export of synthetic case records and playbook definitions, and a documented process for revoking access while preserving required evidence.
Use synthetic data and an authorized test environment. Record scope, product edition, permissions, results, and recovery behavior.
Vendors & products
18 profilesAn editorial selection of relevant offerings, with documented scope and practical evaluation questions. Atlas Fold provides a separate provisional documentation assessment for selected offerings; inclusion in this directory is not a ranking.
Palo Alto Networks / SOAR / automation software
Cortex XSOAR and XSIAM
These are two licensed software products, not one SKU. The buyer staffs playbooks and owns credentials. XSIAM automation is not a staffed MDR service, and Unit 42 MDR is sold separately.
Cisco / SOAR / automation software
Splunk SOAR
Buyers staff the platform and own connector credentials. Splunk apps can export events into SOAR. The product is software the customer operates, not a staffed SOC.
Google / SOAR / automation software
Google Security Operations SOAR
The SOAR component is part of the broader Security Operations portfolio. Confirm integration and deployment requirements independently of the SIEM; the customer or its service provider operates the playbooks.
Tines / SOAR / automation software
Tines
This is software the buyer operates. Governance controls and human approval exist so analysts can publish workflows under policy. MSSP features do not make Tines a staffed MDR service.
Torq / SOAR / automation software
Torq
This is licensed software the buyer configures and staffs. AI-assisted authoring still requires human control of go-live. Torq is not a managed detection and response service.
Swimlane / SOAR / automation software
Turbine
Software the buyer operates. Ask whether you need a system of record beyond incident playbooks. Test action permissions, workflow change control, and recovery from failed steps.
Fortinet / SOAR / automation software
FortiSOAR
Software the buyer or an MSSP staffs. Connector counts change over time. OT playbooks are a capability claim to test, not a plant-safety certification or sign-off.
Rapid7 / SOAR / automation software
Rapid7 Automation
No-code workflows connect supported services, while an Insight Orchestrator can execute actions within the customer’s network. This software has a different scope from Rapid7’s managed detection and response service.
CrowdStrike / Managed detection and response
Falcon Complete
This is a staffed service on Falcon, not Falcon Insight endpoint detection and response and not Next-Gen SIEM as a product buy. Warranty language is a separate legal instrument, not unlimited incident response.
Microsoft / Managed detection and response
Defender Experts MDR
Plan 1 covers Microsoft Defender workloads, hunting, and Ask Experts. Plan 2 extends selected third-party sources in Microsoft Sentinel and provides response guidance for those third parties. Defender products are sold separately.
Sophos / Managed detection and response
Sophos MDR
Confirm the specific Sophos or Taegis offering and the incident-response work included in its tier. Sophos documents additional response services and warranty terms whose scope and conditions require separate review.
Arctic Wolf / Managed detection and response
Aurora MDR
Incident response and Incident360 are other solutions, not automatic inside MDR. Managed containment depends on the customer's EDR and firewall access. IR hours may sit in a retainer rather than the MDR SKU.
Expel / Managed detection and response
Expel MDR
Optional managed SIEM is a distinct offer. Advertised mean time to respond is vendor-reported, not an independent result. The customer keeps existing tools and still must authorize auto-remediation.
Zscaler / Managed detection and response
Zscaler MDR
The service investigates integrated EDR, cloud, and identity threats. Do not assume Zero Trust Exchange coverage without the order form. Ask which EDR classes are supported in the purchased SKU.
eSentire / Managed detection and response
eSentire MDR
Package names are not proof of automatic containment. Digital forensics and incident response may be separate from the MDR SKU. Ask which signals sit in the chosen package.
Huntress / Managed detection and response
Huntress
Buying Managed EDR does not automatically include identity or log coverage. Define the purchased services and confirm any specialist forensics or incident-response support instead of inferring it from the managed stack.
Rapid7 / Managed detection and response
Rapid7 MDR
The Elite scope of service frames a collaboration and excludes anything not listed. Telemetry onboarding, supported detections, response prerequisites, and customer responsibilities limit what the service can do.
SentinelOne / Managed detection and response
Wayfinder MDR
Verify which endpoint, cloud, and identity signals and response actions are in the selected service tier. Confirm IR access, warranty conditions, and customer duties separately from the current datasheet.