UnderDefense vs Red Canary (a Zscaler company)

UnderDefense is a managed security services firm offering 24/7 managed detection and response, managed SOC and SIEM, incident response, penetration testing and compliance services. Delivery is vendor-agnostic: the firm's MAXI platform layers alert triage, automation and reporting on top of a client's existing EDR and SIEM tools, and it operates co-managed SIEM on Elastic, Splunk, QRadar, LogRhythm and Sumo Logic. Founded in 2017, it is headquartered in New York and runs delivery teams from Jacksonville in the US, Krakow in Poland and Lviv in Ukraine. Its own site states 120 certified security engineers across three continents.

Pros

• Clutch lists UnderDefense at 4.9 out of 5 across 66 verified reviews, with a stated minimum project size of $5,000 and an hourly range of $50 to $99 (source: Clutch profile)
• The firm publishes an entry MDR rate of $11 per device per month on its own pricing page, which is more than most MSSPs disclose publicly
• MDR is designed to run on tools the client already owns rather than requiring replacement, with co-managed SIEM support named for five SIEM products (source: UnderDefense MDR services page)
• UnderDefense states it achieved SOC 2 Type I attestation on 25 November 2024, audited by Prescient Assurance (source: UnderDefense company news)

Things to check

Pricing: MDR published from $11 per device per month; Standard, Enhanced and Professional tiers are custom quoted and all MDR plans are sold as annual contracts. A free tier gives 14 days of platform access. Penetration testing engagements are stated at $5,000 to $30,000 depending on scope.

Red Canary delivers managed detection and response built on detection engineering rigor and broad telemetry ingestion (Microsoft Defender, CrowdStrike, SentinelOne, Palo Alto, Zscaler, AWS, Google Cloud, 200+ tools). It is widely regarded as a reference partner for organisations standardising on Microsoft Defender for Endpoint and Sentinel. Zscaler closed the $692M acquisition on August 1, 2025; Red Canary operates as a separate business unit within Zscaler.

Pros

• Reputation as one of the strongest MDR partners for Microsoft-centric security stacks
• Industry-recognised detection engineering and public threat research (annual Threat Detection Report)
• Vendor-broad integrations — does not require ripping out incumbent EDR
• Strong public research output keeps customer detections current

Things to check

• Future roadmap will be shaped by Zscaler's strategy; long-term independence uncertain
• Premium positioning; not the cheapest option in mid-market deals
• Limited public pricing

Pricing: Custom (contact sales)