Every European managed detection and response (MDR) tool reviewed
Utrecht, Netherlands
Pricing on request
Demo on request
Best for: Dutch and EU mid-sized and large organisations that want a named contact and tailored detection
Northwave runs its managed detection and response from a SOC in Utrecht, and the people reading your alerts sit next to the colleagues who run incident response and red team engagements. The vendor says more than 60 specialists across SOC, forensics, threat analysis and CERT contribute to the service, and every customer gets a Security Operations Manager who reviews the threat picture with them.
Northwave Group B.V. is a Dutch company of about 275 people that describes itself as independent and self-financed. Onboarding starts with a risk assessment and an implementation plan, and the customer helps connect log sources and agree processes. Pricing is on request and the MDR page does not state where telemetry is stored, so both belong in the first call.
What Northwave does well
- Named Security Operations Manager for each customer
- Detection tuned to a risk assessment of the business
- SOC and in-house CERT sit in one organisation
- Stated as independent and self-financed in its about page
- Utrecht SOC under Dutch law
Where Northwave falls short
- Prices only on request
- MDR page does not give a data location
- Customer time is needed during onboarding
- Smaller than the global MDR vendors
Standout feature. Northwave feeds its detection library from its own breach response and red team work instead of vendor rules alone.
The Hague, Netherlands
Founded 2020
Pricing on request
Demo on request
Best for: Mid-sized companies wanting detection, response and insurance from one party
Eye Security packages MDR for mid-market companies that have no SOC of their own. The service reads EDR data from endpoints and servers plus log data from Microsoft 365 and Google Cloud, and its analysts decide what counts as an incident and can isolate systems when one is confirmed.
Eye Security B.V. is based in The Hague and was founded in 2020. Its FAQ says telemetry without a detection is deleted after 7 days, that file content is collected only after a validated incident and that a full rollout can take as little as two hours. The pages read give no price, SOC city or storage location, and the insurance policy sits with a separate legal entity.
What Eye Security does well
- Monitoring, response and insurance under one supplier
- Rollout in as little as two hours per its FAQ
- Telemetry without a detection deleted after 7 days
- Dutch company with a European SOC
- Microsoft 365 and Google Cloud logs covered with the endpoints
Where Eye Security falls short
- Prices only on request
- SOC city and data location not stated
- Aimed at the mid-market, not large custom estates
- Insurance handled by a different entity
Standout feature. Eye Security pairs MDR with a cyber insurance product that follows the same defence model.
Brussels, Belgium
Founded 2013
Pricing on request
Demo on request
Best for: Belgian and EU organisations that run Microsoft or Palo Alto security tooling and want a European operator
NVISO is a Brussels security firm, founded in 2013, whose 24/7 MDR is backed by its CSIRT. It says its approach is technology-agnostic and holds a place in the Microsoft Intelligent Security Association and a Palo Alto Networks Cortex XMDR specialisation, so those two ecosystems get the most detailed material.
The service portal shows SLA status, open cases and an ATT&CK coverage view of the detection analytics, and ITSM integration handles ticket follow-up. NVISO adds proactive threat hunting beside alert handling. With more than 200 staff and offices in Belgium, Germany, Greece and Austria, it is a consulting firm first, and the pages give no prices or data location.
What NVISO does well
- CSIRT with forensics and malware analysis behind the MDR
- Portal exposes SLA status and ATT&CK coverage
- Operates on the tooling the customer already owns
- Ticket follow-up through ITSM integration
- Belgian company with offices in four countries
Where NVISO falls short
- Prices only on request
- No data location on the pages read
- MDR is one service in a consulting portfolio
- Fewer people than the global MDR vendors
Standout feature. NVISO lets customers inspect which ATT&CK techniques its detection analytics cover, in the portal.
Helsinki, Finland
Founded 1988
Per seat, quoted through partners
Demo on request
Best for: Mid-sized and larger European organisations that already buy security through an IT partner
WithSecure Corporation in Helsinki separated from F-Secure in 2022 and sells almost everything through partners and managed service providers. Its Elements MDR works from Elements EDR telemetry, offers an identity add-on and a DFIR retainer option, and the tagline on this site describes SLA-backed analysts working inside Europe.
Response is included in the Elements MDR subscription, though large multi-device breaches are referred to separate services. WithSecure has existed since 1988 and lists ISO 27001 and EU processing on its tool page. Pricing is per seat and quoted through partners, which means the quality of your day-to-day service depends on the reseller you pick.
What WithSecure does well
- Analysts monitor alongside your own team
- Finnish company founded in 1988
- Identity add-on and DFIR retainer option
- Partner and managed-service channel across Europe
- EU data processing
Where WithSecure falls short
- Experience depends on the partner you buy through
- Per-seat quotes instead of published prices
- Large multi-device breaches sit outside the subscription
- Not set up for small companies buying direct
Standout feature. WithSecure frames MDR as co-monitoring, with its analysts watching next to yours.
Dublin, Ireland
Endpoint-based pricing, amounts on request
Demo on request
Best for: Companies that want a flat, endpoint-based model rather than SIEM ingestion charges
Integrity360 delivers CyberFire MDR from its own platform, with analysts in several security operations centres triaging alerts, hunting threats and passing validated incidents on with response guidance. The company also sells managed EDR, XDR, NDR, SIEM and incident response retainers, so a customer can add layers over time.
The legal entity is Integrity Communications Ltd, based in Dublin, and its privacy policy names an Irish data controller. The pricing page text describes an endpoint-based model, with amounts on request. Integrity360 reports a SOC 2 certification and a Gartner Representative Vendor listing, both in its own words, and with offices from Dublin to Nairobi and Calgary you should confirm which SOC serves you.
What Integrity360 does well
- Pricing counted per endpoint, not per log volume
- CyberFire platform developed in-house
- EDR, XDR, NDR, SIEM and IR retainers from one firm
- SOC 2 certification reported by the company
- Irish data controller named in the privacy policy
Where Integrity360 falls short
- No amounts per endpoint published
- Data location not stated on the pages read
- Remediation described as guidance and containment
- Office spread complicates SOC allocation
Standout feature. Integrity360 builds its price on endpoints rather than on the data volume sent to a SIEM.
London, United Kingdom
Founded 2013
Pricing on request
Demo on request
Best for: UK organisations running Microsoft security tools that want regulatory-grade accreditation
Bridewell is a British security firm that stands up a Microsoft Sentinel based SOC first and then wires in the EDR and XDR products the customer already operates. The vendor says that after an engagement starts it can deliver MDR capability in less than a week, covering endpoints, cloud, networks and on-premise systems.
Bridewell Consulting Limited was founded in 2013 and is registered in England and Wales. It states that its analysts hold NCSC, CREST, SANS and ASSURE certifications and that its SOC carries CREST accreditations, and a separate OT SOC page covers industrial sites. UK jurisdiction applies rather than EU law, the SOC has expanded to the US, and no prices or data location appear on the pages read.
What Bridewell does well
- CREST and NCSC credentials stated by the company
- Onboarding in under a week, per the vendor
- OT SOC option for industrial sites
- Integrates the EDR and XDR you already run
- Sentinel deployment and management included
Where Bridewell falls short
- Prices only on request
- UK law rather than EU law
- Fits Microsoft estates best
- SOC expansion into the US needs a contract check
Standout feature. Bridewell operates a dedicated OT SOC next to its IT SOC for industrial environments.
Bochum, Germany
Founded 1985
Per seat per year, published
Demo on request
Best for: German and German-speaking organisations whose procurement rules ask where software is built and data processed
G DATA offers MXDR from a managed SOC and sells it in three service levels, with German-language support and data processed in Germany. The managed layer builds on a company that has existed in Bochum since 1985 and publishes a no-backdoor guarantee alongside the TeleTrusT "IT Security made in Germany" seal.
G DATA CyberDefense AG is a German company, which puts the contract under EU law and German jurisdiction. Its endpoint product has published per-seat pricing and a 30-day trial, though the pages we reviewed show no price for the MDR layer. Independent testing places its detection a step behind ESET and Bitdefender, and the partner network is thinner outside German-speaking markets.
What G DATA does well
- Data processed in Germany
- No-backdoor guarantee and TeleTrusT seal
- German-language analysts and support
- Three service levels to choose from
- Independent company dating from 1985
Where G DATA falls short
- MDR price not shown on the pages read
- Detection a step behind ESET and Bitdefender in tests
- Interface is functional rather than modern
- Fewer partners outside German-speaking markets
Standout feature. G DATA puts a no-backdoor guarantee in writing, a commitment few MDR vendors make.
Bratislava, Slovakia
Founded 1992
Per seat per year, published for business tiers
Demo on request
Best for: Organisations already running ESET endpoints that want tiered MDR with regular reporting
ESET sells PROTECT MDR in two tiers, MDR and MDR Ultimate, layered on ESET Inspect telemetry. Reports arrive weekly and monthly, threat hunting is part of the Ultimate tier, and the customer can set handling for critical assets anywhere from notify-only to full remediation.
ESET, spol. s r.o. has built detection software in Bratislava since 1992 and processes data in the European Union under ISO 27001. Business pricing for the endpoint products is published per seat, with a 30-day trial, while the EDR tier is priced apart from base protection. ESET is not the deepest threat-hunting platform in this group, which suits general IT teams better than mature security departments.
What ESET does well
- Two MDR tiers with threat hunting in Ultimate
- Weekly and monthly reports
- Per-asset handling from notify-only to full remediation
- Light agent and a console a general IT team can run
- Slovak company processing in the EU
Where ESET falls short
- Requires the ESET Inspect connector
- EDR tier priced separately from base protection
- Hunting only in the higher tier
- Aimed at usability more than at mature security teams
Standout feature. ESET lets you decide per critical asset how far the analysts may go, from notifying you to full remediation.
Bucharest, Romania
Founded 2001
Per seat per year, published
Demo on request
Best for: Companies without security staff that want a large managed service with pre-approved response actions
Bitdefender runs MDR on GravityZone from SOCs on three continents and says it employs 285+ analysts. Customers can pre-approve response actions, so analysts contain common threats without waiting for a call, and a breach warranty is part of the offer, although amounts differ between the vendor pages and are not quoted here.
S.C. Bitdefender S.R.L. in Bucharest has operated since 2001 and processes data in the European Union under ISO 27001. Per-seat pricing for the endpoint products is public and a free trial exists. The product range is wide, some capabilities sit behind tiers that the pricing page does not make obvious, and the SOC locations mean you should confirm who answers during your night hours.
What Bitdefender does well
- 285+ analysts stated by the vendor
- Pre-approved response actions
- Breach warranty offered with the service
- Deep MSP channel
- Romanian company processing in the EU
Where Bitdefender falls short
- Warranty amounts conflict between pages
- SOCs on three continents, so confirm the centre serving you
- Tiers are hard to read from the pricing page
- Console offers more than a small team uses
Standout feature. Bitdefender lets customers pre-approve response actions, so containment starts without a phone call.
Abingdon, United Kingdom
See website
Demo on request
Best for: Companies with a mixed security stack that want incident response included without hourly caps
Sophos sells MDR that ingests telemetry from more than 500 integrations, so the SOC can work with security tools bought from other vendors. The service documents response modes, including a notify mode and an act-first mode, and the company states that critical incident response is included without hourly caps.
Sophos Limited, with its registered office in Abingdon, UK, is the contracting party for customers outside the US, Canada and Latin America, which puts the contract under UK law and outside the EEA. Customers in those other regions contract with Sophos Technology Limited. The MDR page we read names no tiers, and warranty amounts are not stated, so verify both in a quote.
What Sophos does well
- Critical incident response included, no hourly caps
- Telemetry from 500+ integrations
- Notify and act-first response modes
- Works with a stack bought from other vendors
- UK contracting entity for most customers
Where Sophos falls short
- UK law, outside the EEA
- No tiers named on the MDR page
- Warranty amounts not stated
- US customers contract with a different Sophos entity
Standout feature. Sophos includes critical incident response in the MDR subscription without hourly caps.
Tel Aviv, Israel
See website
Demo on request
Best for: Organisations already running Check Point products that want vendor-neutral MDR with some incident response hours
Check Point sells MDR 360 and MXDR 360 through Check Point Infinity Global Services and describes them as open, vendor-neutral services with 160+ integrations. The offer comes in three subscription tiers and includes 10 incident response hours a year, which is a fixed allowance rather than an open commitment.
Check Point Software Technologies Ltd. has its principal office in Tel Aviv, Israel, outside the EU and EEA, and is eligible for this directory under its rules. Our facts come from the vendor's launch post only. Pricing, the relationship to the earlier Horizon MDR, and the contracting entity per region were not confirmed.
What Check Point does well
- Vendor-neutral telemetry with 160+ integrations
- Three subscription tiers from MDR to MXDR
- Ten incident response hours included each year
- Israeli vendor, eligible under EP rules
Where Check Point falls short
- Israeli law, outside the EU and EEA
- Incident response capped at 10 hours a year
- No published prices
- Regional contracting entity not confirmed
Standout feature. Check Point includes a fixed block of 10 incident response hours in the MDR 360 service.
