24×7 SOC monitoring
Your computers are not waiting for someone to notice an alert in the morning. The SOC watches endpoint activity continuously and can contain suspicious behavior before it spreads.
Computer protection
24×7 monitoring. Human review. Real response.
Obsidian Ridge provides Ridge Watch business MDR at $15 per device per month, month-to-month with no minimum and separate business onboarding. Huntress's SOC monitors and acts 24/7; Obsidian Ridge handles CISSP-led follow-through within one business day, serving the Research Triangle and businesses across the United States.
See the MDR cost examples and onboarding fees, or add account monitoring with Ridge Core at $25 per person per month, month-to-month.
TL;DR
What you get, what it costs, and when it pays for itself
We deploy and operate managed detection and response on every endpoint and server in your organization. The 24×7 SOC:
- Watches for the patterns that precede a breach
- Can take an affected host off the network to contain it
- Escalates confirmed incidents to Obsidian Ridge, who coordinates the response within one business day
The identity layer (Microsoft 365, Entra ID, Google Workspace) is covered by our dedicated Managed ITDR service, not this one.
Pricing starts at $25 per person per month with no minimum and no contract, for Ridge Core, which includes Managed ITDR as well.
What's included
Everything that goes into managed detection
Human alert review
You only hear about alerts that deserve attention. Analysts review isolation events, filter noise, and escalate confirmed threat activity with context.
Account takeover signal handoff
MDR treats endpoint activity that originates in a compromised account (impossible travel, MFA fatigue, suspicious app consent) as an incident and hands the identity-layer detail to the dedicated Managed ITDR service. See /services/managed-itdr for tenant-level identity coverage.
Incident response coordination
If something happens, you are not left translating tool alerts into next steps. We coordinate containment, investigation, leadership updates, and the debrief that turns the incident into a prevention plan.
Endpoint, server, and cloud coverage
Coverage follows the systems your business actually uses. The endpoint agent can be deployed across Windows, macOS, Linux, and supported cloud workloads with repeatable rollout steps.
Audit-ready reporting
You get usable proof, not screenshots dumped in a folder. Monthly summaries and quarterly reviews translate detection activity into evidence for SOC 2, ISO 27001, HIPAA, and cyber-insurance renewals.
Compare honestly
Computer protection vs. security software on its own vs. running your own security team
| Question | Managed Detection & Response | EDR license only | Build a full SIEM team |
|---|---|---|---|
| 24×7 monitoring with human review | Yes — every alert triaged by an analyst | Software alerts; you triage | Yes, but you operate it |
| Time to first response | Minutes | Whenever someone notices | Depends on your team |
| Total cost (50-person practice, year 1) | $15,000, with no infrastructure to run | The license, plus an analyst's time to triage the alerts yourself | The tools, plus the team to run them around the clock |
| Compliance-ready evidence | Built in | You assemble it | You configure it |
| Best fit | 5–500 employees, no internal SOC | Tech-mature teams, dedicated security staff | Regulated, 1000+ employees, dedicated team |
Most small and mid-market organizations land on MDR because EDR-only leaves the alert queue with someone who can't reasonably be on-call at 2 am, and a full internal SOC costs more than a year of your security budget. MDR splits the difference.
How computer protection works
From antivirus to managed detection — the short version
A 60-second walkthrough of how endpoint defense evolved from signature antivirus to managed detection and response, what a real ransomware kill chain looks like, and the controls that stop it before it spreads.
Pricing
Three concrete tiers, operated end to end
Prices in USD · per person
Tier 01 · Ridge Core
Ridge Core
$25/ person / mo
A shared computer with no named user counts as one person.
Month-to-month · no minimum
Every computer and every email login watched 24/7, with a real person reviewing alerts.
What's included
- Always-on protection on every endpoint.MDR / EDR: endpoint activity is watched 24/7 by a real security team, so a compromised workstation is not left waiting for the next business day.
- Human review before alerts reach you.SOC triage: analysts review suspicious activity first, filter noise, and escalate confirmed threats with context.
- Quarterly posture check-in.Posture review: we look at what changed, what improved, and what still needs attention before small gaps become expensive problems.
- Direct email support from a senior analyst.Security advisory: a person to ask when something feels off, not a generic ticket queue.
- Install or remove agents at any time.Agent-based deployment: coverage can follow the devices you actually use without locking you into unused seats.
- Email and cloud account monitoring.ITDR: Microsoft 365 or Google Workspace accounts are watched for break-in attempts and identity-based attacks.
- Automatic software updates.Patching: software updates are installed automatically on your business computers. We confirm the supported software and update schedule with you during setup.
Replaces or complements
- Antivirus subscriptions that flag everything and stop nothing
- Generic IT-installed protection with no one reviewing alerts
- Monthly log review your team never finds time for
Cyber insurance baselineSOC 2 readinessHIPAA Security Rule
Tier 02 · Ridge Plus
Ridge Plus
$50/ person / mo
Annual term · billed monthly
Adds the email and Microsoft 365 / Google Workspace identity monitoring attackers actually target — plus the documentation your auditor or insurer will ask for.
Everything in Ridge Core, plus
- Security training for staff.security awareness training: short lessons and realistic phishing simulations help people recognize common attacks before they become incidents.
- Training records for audits and insurance.Compliance evidence: you have documentation ready when SOC 2, ISO 27001, HIPAA, client questionnaires, or insurers ask what staff received.
- Monthly security review and stakeholder report.Executive reporting: leaders see what was watched, what was investigated, and what needs a decision without learning another console.
- Senior analyst included.the same email channel as Ridge Core, scoped for the wider Ridge Plus program.
- Email protection, configured and monitored.Email Security: the anti-phishing, link and attachment protection in your Microsoft 365 or Google Workspace license, configured for your practice, with SPF, DKIM and DMARC set up and monitored.
- A secure browser for your work apps.Island Enterprise Browser: company apps open in a browser that controls what can be copied, pasted, downloaded, uploaded, printed or captured on screen, on company or personal computers.
Replaces or complements
- Standalone antivirus or endpoint subscriptions
- Separate phishing-training tools you bought and forgot to roll out
- One-off compliance gap assessments with no follow-through
Cyber insurance baselineSOC 2 readinessHIPAA · add-on
Tier 03 · Ridge Reserve
Ridge Reserve
$70/ person / mo
Annual term · billed monthly
Ridge Plus, plus more of what carriers ask about: a written incident response plan with a yearly ransomware tabletop, quarterly admin-access reviews, and monthly patch reporting you can put on an application.
Everything in Ridge Plus, plus
- An incident response plan, and a ransomware tabletop every year.IR plan + tabletop: a written plan your team can follow, reviewed each year, and a walkthrough of a ransomware attack before the pressure is real.
- Quarterly admin-access review.Privileged access: every quarter we check who holds admin rights and whether they still should, and that admin accounts stay separate from everyday ones.
- Monthly patch report, with a 14-day deadline for known-exploited vulnerabilities.Patch reporting: every vulnerability in CISA's Known Exploited Vulnerabilities catalog is remediated, mitigated, or documented as an exception you accept, within 14 days of CISA listing it. Fourteen days is the longest deadline CISA's current directive, BOD 26-04, gives federal agencies for a catalogued vulnerability. It does not apply to private businesses; we use it as the benchmark.
- Microsoft 365 security settings applied and kept in place.Managed ISPM: Microsoft 365 only. The recommended identity settings are applied on a schedule we agree with you, and a managed setting that someone changes is put back.
- Your insurance questionnaire, refreshed every year.Questionnaire refresh: the Readiness Sprint's evidence pack, updated each year so your renewal answers stay true.
Replaces or complements
- An incident response plan that lives in a drawer
- Patching nobody reports on until the renewal asks
- A patchwork of security tools that don’t talk to each other
Cyber insurance baselineSOC 2 log retention with the log-collection add-onSupports HIPAA and PCI-DSS evidence
From $25 / person / moStart with Ridge Core
Request a free reviewEndpoint posture
Want fewer preventable Computer protection alerts?
MDR is the detection and response layer. Managed ESPM decides what may run at all: App Control allows approved software and blocks the rest, and RMM Guard controls which remote-access tools may run. It is in early access, for eligible Windows endpoints.
Read the Managed ESPM page →Honest fit check
Who this is not for
Managed Detection & Response is the right fit for most small and mid-market businesses that want serious cybersecurity without building an internal team. It is not the right fit if:
- You want a ticket-only MSP that responds to your tickets but never tells you what to do.
- You're looking for a one-time PDF report you'll file and forget. Buy a consultant.
- You already have a fully-staffed internal SOC and you just need someone to procure tools. Buy a tool reseller.
- You expect cybersecurity to be a checkbox you do once. It's a practice, not a purchase.
If any of those describe you, we are not the right fit and we will tell you that on the triage call. No hard feelings.
What happens after you reach out
From first call to first alert handled — typically 14 days
Free 20-minute triage
A direct call with the senior analyst who would run your program. We confirm fit, scope, and whether you actually need MDR or something simpler. If it's not a fit, we tell you what is.
30-minute briefing & written proposal
Within one business day after the briefing, you get a fixed-fee proposal with scope, term, onboarding fee, and timeline. No surprise costs in the contract.
Onboarding (1-2 weeks)
Agent deployment, identity baseline, alert routing, and escalation paths. Most clients are fully operational within two weeks.
24×7 operation, ongoing
The SOC is watching from day one. You get a 30-day check-in, monthly reports, and a someone you can call when something feels off.
Budgeting for a small team? Compare MDR costs at 5, 10, 25 and 50 devices, including the minimum and onboarding.
Where this fits
Where this fits in your stack
MDR is the floor, not the ceiling. It is in all three tiers: Ridge Core ($25 per person per month) is MDR on every computer plus monitoring of every email login, with a monthly posture summary; Ridge Plus ($50 per person per month) and Ridge Reserve ($70 per person per month) keep the same detection engine and add training, email protection and the insurance controls on top. Log collection is an add-on on any tier.
Pairs with Managed ITDR, Endpoint Security Posture Management, and Managed SIEM.
Dental practices
The practice management server — Dentrix, Eaglesoft, Open Dental — is the highest-value endpoint in a dental office and the one general IT most often leaves off endpoint coverage. We treat it as the priority, alongside every operatory workstation and the imaging box.
How this works for dentalLaw firms
The document management server and every attorney laptop carry privileged matter files. MDR watches the lateral-movement path that ends with an encrypted DMS over a long weekend — the pattern that turns a Monday into a bar-confidentiality problem.
How this works for law firmsCPA & accounting firms
The tax software server running Lacerte, Drake, or UltraTax holds concentrated client financial data and gets hit hardest between February and April. MDR is the control that breaks the tax-season ransomware chain before it reaches the return database.
How this works for accountingThe insurance wedge
MDR is the control underwriters ask about first.
Managed EDR/MDR is at or near the top of every 2026 cyber-insurance questionnaire — carriers want to know it runs on every endpoint and that a human watches it around the clock. If your renewal application is asking and you cannot yet answer with evidence, the Readiness Sprint closes that gap.
From $1,500, delivered in 7 business days — final quote depends on scope, up to $3,500. Signed evidence pack mapped to your carrier's questionnaire — delivered, or we keep working at no additional cost until it is. We don't control underwriter decisions. We control whether you walk in with the evidence they ask for.
Obsidian Ridge is not an insurance producer, broker, or agent. We do not sell, place, or advise on insurance products.
Buyer guidance published . Updated . By Kfir Yair, CISSP.
Obsidian Ridge's Ridge Core includes endpoint MDR and Microsoft 365 or Google Workspace ITDR at $25 per person per month, month-to-month with no minimum and business onboarding separate. Huntress's SOC monitors and acts 24/7; Obsidian Ridge provides CISSP-led follow-through within one business day, serving the Research Triangle and businesses across the United States.
Replacing antivirus to meet cyber insurance requirements
Start with the wording on your carrier's form. Antivirus, endpoint detection and response (EDR), and managed detection and response (MDR) describe different capabilities and different people responsible for acting. Do not answer an MDR question solely because an antivirus product is installed.
Inventory the covered devices, monitoring hours and response permissions, then keep deployment and incident records that support the answer. Compare the small-business MDR costs and send the form for a questionnaire review. Only your carrier can confirm that the proposed scope meets its requirement.
FAQ
Questions that come up before signing
Can replacing antivirus with MDR satisfy my cyber-insurance application?
It depends on the carrier's exact requirement and the deployed scope. MDR adds a managed detection and response service around endpoint protection. Confirm every required device is covered, who responds and what evidence is available.
We help explain the controls; the carrier decides whether they meet its requirement.
What's the difference between EDR and MDR?
EDR is the software that detects threats on endpoints. MDR is EDR plus a 24×7 team that reviews and acts on what the software finds. Buying EDR alone means you own the alert queue. Buying MDR means we do.
Do you replace our existing antivirus?
Yes for most cases. The platform we deploy includes endpoint protection, ransomware canaries, and EDR — typically replacing legacy AV plus a separate MDR add-on. We confirm fit during the briefing.
How long does deployment take?
For most small and mid-market businesses: the agent rolls out within a day, alert routing is configured within the first week, and the first monthly report lands at day 30. No multi-month onboarding.
What if we already have Microsoft Defender?
Defender is a strong endpoint product. The gap most teams have is the human SOC behind it. Many organizations keep Defender and add managed detection on top — we coordinate the monitoring and response layer instead of forcing a replacement.
What does a real incident look like with you?
Two clocks, and they are not the same. The 24×7 SOC reviews the alert and acts on it around the clock — remediating it, noting it in the console, or taking the endpoint off the network to contain it.
Containment is one of those three outcomes, not what happens every time. Everything after that is ours: confirming what happened, coordinating remediation and communication, and the post-incident debrief.
We pick that up within one business day, a contained endpoint stays contained until we do, and a written report follows.
Can we cancel?
Ridge Core is month-to-month with no contract, cancel anytime. Ridge Plus and Ridge Reserve are typically annual because training, email protection and the insurance controls benefit from continuity, but the term is disclosed up-front in the proposal.
Related
Before the briefing, you might want to read
Next step
Stop watching your endpoints alone.
See where you stand in a few minutes, or talk with us. Both are free and we tell you when you don't need us. 30 minutes, real answers, no follow-up sales sequence.