In short: Check Point MDR is a 24/7 managed detection and response service in which Check Point's analysts monitor endpoints, email, network, cloud and identity, hunt threats, contain attacks and include incident response. Through Forever Systems it is licensed per endpoint as a standalone service, or as an add-on to Harmony Endpoint licences, billed monthly.
What Check Point MDR is
Check Point MDR is a managed security service, not software you run yourself. Check Point's analysts watch the telemetry from your security tools around the clock, decide which alerts are real, investigate them and act: isolating a device, blocking an indicator or escalating to incident response when an attacker is active. It is delivered by Check Point's own services organisation, working alongside Check Point Research and drawing on ThreatCloud AI intelligence.
Check Point describes the service as covering endpoints, email, network, cloud and identity, with:
- 24/7 detection and response, including automated containment
- Proactive threat hunting for activity that has not triggered an alert
- Incident response included in the service
- Identity threat detection, which Check Point says has native support for Microsoft Active Directory, Microsoft Entra ID and Okta
It is positioned as vendor-neutral, integrating with third-party EDR, firewalls and cloud services as well as Check Point products, so you do not have to replace everything to get a 24/7 service. For the difference between EDR, XDR and MDR, see endpoint security and XDR on our cloud security site.
Ways to buy MDR
We supply MDR in two forms, depending on where you start:
| Option | Licensed by | Best for |
|---|---|---|
| Check Point MDR | Per endpoint | Organisations that want the managed service across their estate, including where some tools are from other vendors |
| Harmony Endpoint MDR | As an add-on to your endpoint licences | Harmony Endpoint customers who want analysts triaging and responding to their EDR detections |
Check Point sells MDR as subscription packages and lists further capabilities beyond the core service, including an identity threat detection platform, extended data integrations with an MDR security data lake, access to its XDR and Playblocks platform, and a fully managed SIEM. Which of these a package includes is set out in the service description for your contract, and we go through it with you before you sign.
How MDR is licensed
MDR is a subscription. The standalone service is counted per endpoint monitored; the Harmony Endpoint add-on is licensed alongside your endpoint licences, and we confirm the unit on your quote. Through Forever Systems both are provisioned in your Check Point Portal tenant and billed monthly on what is covered. If you would rather commit for a year, ask us and we will set out the options.
Price depends on the number of endpoints or users, the tools to be connected and the scope of the service, so ask us for a quote. We never quote response-time targets on Check Point's behalf; those come from the service description.
Requirements and onboarding
To onboard, Check Point needs telemetry: usually the Harmony Endpoint agent on your devices, plus API connections to email, identity and other tools in scope. If you already run Harmony Endpoint or Harmony Email & Collaboration, the data is already in your Check Point Portal tenant, so onboarding is mostly connecting the analysts to it.
You also agree escalation contacts and what the analysts may do without asking, such as isolating a laptop out of hours. Check Point lists MDR data residency options in the UK, the EU, the US, Australia, Canada, India and the UAE; we confirm the region for your contract and check it matches where your other Check Point products store data, which matters for UK GDPR and for public sector and regulated customers.
Who it suits and how we help
MDR makes most sense if you have security tools but not the people to watch them at night, at weekends and during holidays, which is a common position for smaller UK organisations. It is also a practical answer to cyber insurance and supply chain questionnaires that ask who monitors your environment around the clock.
We scope the service, connect your Check Point and third-party tools, agree escalation contacts and run onboarding, then stay involved as your day-to-day support and handle licence changes. Ask us for a quote, or compare other services on our EDR, XDR and MDR page.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Check Point MDR?
A 24/7 managed detection and response service in which Check Point's own analysts monitor your endpoints, email, network, cloud and identity, hunt for threats, contain attacks and provide incident response.
How is Check Point MDR licensed?
Through Forever Systems, either per endpoint as a standalone service or as an add-on to Harmony Endpoint licences, billed monthly. The scope and inclusions are set out in the service description for your contract.
Does Check Point MDR only work with Check Point products?
No. Check Point describes MDR as vendor-neutral, integrating with third-party EDR, firewalls and cloud services as well as its own products.
Is Check Point MDR data held in the UK?
It can be. Check Point lists the UK among its MDR data residency options, alongside the EU, the US, Australia, Canada, India and the UAE. We confirm the region for your contract before onboarding.