Northwave
Dutch MDR with a Utrecht SOC, a named Security Operations Manager and detection logic drawn from its own incident response work
Quick Overview
| Company | Northwave Group B.V. |
|---|---|
| Category | Managed Detection and Response (MDR) |
| Headquarters | Utrecht, Netherlands |
| Founded | Not stated |
| EU Presence | Yes - Netherlands (EU) |
| Data Location | Not stated on the MDR page |
| Open Source | No |
| GDPR Compliant | Yes |
| Self-Hosting | No |
| Main Features | 24/7 SOC, dedicated Security Operations Manager, risk-based detection tuning, log, endpoint and network monitoring, threat intelligence feeds, NW-CERT response |
| Pricing | Pricing on request |
| Best For | Dutch and EU mid-sized and large organisations that want a named contact and tailored detection |
| Replaces | Arctic Wolf, Expel, CrowdStrike Falcon Complete |
Detailed Review
Northwave sells MDR as a service built by people who also respond to breaches. Its page states that the service draws on a multidisciplinary team of more than 60 specialists across the SOC, red team, forensics, threat analysis and CERT.
Delivery comes from a security operations centre in Utrecht. Analysts monitor log data, endpoint telemetry and network traffic, and each customer gets a Security Operations Manager who works on the threat landscape together with them.
Onboarding starts with a risk assessment
Instead of switching on generic rules, Northwave begins with an assessment of the business and its security risks, and tunes detection to that profile. The vendor says this keeps alerts about irrelevant events away from the customer.
The implementation plan lists service elements, phases and threat-based use cases, and the customer helps with log source onboarding and process set-up.
Detection logic from incident work
Findings from incident response engagements, adversary simulations and threat research feed a proprietary detection library. Northwave says it does not rely only on vendor technology to spot threats.
Neighbouring services
The same SOC connects to managed EDR, managed NDR, vulnerability management, a threat intelligence service and a rapid response service, so MDR can be extended without another supplier.
Limitations to Consider
Northwave publishes no prices and the MDR page does not state where telemetry is stored, so both need a conversation with sales. The onboarding model asks for customer time during log source and process set-up. It is a company of about 275 people, which is smaller than the global MDR vendors, and the sales material is English, Dutch and German only.
Who Should Use Northwave
Organisations in the Netherlands and neighbouring countries that want a SOC with a named manager, tailored detection and an incident response team behind it.
Pros and Cons
Pros
- Dedicated Security Operations Manager
- Detection shaped by the customer risk profile
- SOC and CERT work together
- Independent and self-financed (per its about page)
- Utrecht SOC under Dutch jurisdiction
Cons
- No public pricing
- Data location not stated on the MDR page
- Onboarding needs customer involvement
- Smaller than global MDR providers
Alternatives to Northwave
Other European managed detection and response (mdr) worth comparing before you decide:
Eye Security
Netherlands · MDR for mid-market firms with response and insurance bundled
NVISO
Belgium · Brussels CSIRT team running 24/7 MDR on your own tooling
WithSecure
Finland · Elements MDR with SLA-backed analysts working inside Europe
Integrity360
Ireland · CyberFire MDR on an in-house platform with endpoint-based pricing
See all European managed detection and response (mdr) or compare them directly against Arctic Wolf on our alternatives page.
Frequently Asked Questions
The MDR page states that the service is delivered from its security operations centre in Utrecht.
No. It says detection logic also comes from its incident response engagements, red team work and threat research.
No, the MDR page invites visitors to book a consultation and shows no price.