In short: ThreatDown MDR is a 24/7 managed detection and response service in which ThreatDown analysts monitor your endpoints, hunt for threats, investigate alerts and contain confirmed attacks by terminating processes, isolating devices and removing malware. Managed Threat Hunting is a lighter option with prioritised alerts and remediation guidance. Through Forever Systems both are licensed per endpoint, monthly.
What ThreatDown MDR is
EDR produces detections, but someone still has to look at them, including at three in the morning and on bank holidays. ThreatDown MDR provides that cover. ThreatDown's analysts watch your endpoints around the clock, every day of the year, investigate and triage alerts, hunt for signs of compromise that have not triggered an alert, and pass on confirmed threats rather than raw alerts.
Once a threat is confirmed, analysts can terminate processes, isolate endpoints and remove malware themselves, or give your IT team step-by-step guidance. Files hit by ransomware can be restored with the seven-day rollback built into the agent. ThreatDown enriches its detections with integrated SIEM and SOAR tooling and third-party threat intelligence, and each incident is written up so you can see what happened, what was done and what is still outstanding.
Options compared
| Option | Who watches | What you get |
|---|---|---|
| Managed Threat Hunting | ThreatDown threat hunters, 24/7 | Proactive hunting for indicators of compromise, prioritised alerts for critical threats and step-by-step remediation guidance; you or we carry out the fix |
| ThreatDown MDR | ThreatDown analysts, 24/7 | Monitoring, investigation, threat hunting and hands-on response: process termination, isolation, malware removal and rollback, plus incident reports |
Both run on the ThreatDown agent alongside ThreatDown EDR. Through Forever Systems, we sit between you and ThreatDown's analysts: escalations come to our team, and we coordinate the response with you.
If you buy direct, ThreatDown also sells MDR Plus in its Ultimate bundle. It adds a hands-on malware removal service, root cause analysis after an incident, credential exposure intelligence and contract-backed response and containment times. Ask us if you need that level of service and we will set out the options.
How it is licensed
| Item | How it works |
|---|---|
| Unit | Each endpoint covered by the service |
| Term | Monthly, billed on usage from our OneView console |
| Coverage | Can be applied to every endpoint, or only to servers and critical devices |
| Works with | The ThreatDown agent with EDR on the covered endpoints; we quote the two together |
| Bought direct | Managed Threat Hunting is in the Advanced bundle, MDR in Elite and MDR Plus in Ultimate, all on annual terms |
Prices depend on the number of endpoints and the modules you choose, so ask us for a quote. If you are comparing managed services, our EDR, XDR and MDR category explains the differences.
Requirements and deployment
MDR needs the ThreatDown agent on Windows, macOS or Linux endpoints; there are no hardware appliances or network changes. ThreatDown says its agent can run alongside existing endpoint security, so MDR can start before a full antivirus replacement if that suits your timetable.
Onboarding with us:
- Deploy or confirm the agent and EDR on every endpoint to be covered.
- Agree an escalation plan: who is contacted, when, and which actions analysts may take without asking.
- Record critical systems, admin tools and maintenance windows so normal activity is not mistaken for an attack.
- Go live, then review the first month's incidents and tune together.
Who it suits
MDR suits organisations without their own security operations centre. It is particularly useful where an attack overnight or at a weekend would go unnoticed until Monday, where cyber insurers ask for round-the-clock monitoring, or where the IT team is small and stretched. Managed Threat Hunting suits organisations with an in-house team that is happy to act on guidance but wants experts looking for threats.
Read more on endpoint security and XDR on our Cloud Security site.
How we help
We deploy the agent, agree your escalation plan with ThreatDown, receive escalations and work with you through every incident, from containment to clean-up and lessons learned. Coverage changes are a console setting, and your invoice follows. Contact us for a quote.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the difference between ThreatDown MDR and Managed Threat Hunting?
Managed Threat Hunting finds threats and gives you prioritised alerts with remediation steps. MDR adds full monitoring, investigation and hands-on response by ThreatDown analysts.
Is ThreatDown MDR really 24/7?
Yes. ThreatDown states its MDR analysts monitor endpoints 24 hours a day, 365 days a year, including nights, weekends and holidays.
Do I need ThreatDown EDR for MDR?
In ThreatDown's own bundles MDR is only sold with EDR included, because analysts investigate and respond using the agent's EDR data and response tools. Through us, we quote EDR and MDR together for the endpoints you want covered.
Can MDR take action without asking us?
Yes, if you allow it. Analysts can terminate processes, isolate endpoints and remove malware, or give guidance for your team to act. We agree the rules with you at onboarding.
Is ThreatDown MDR billed per endpoint?
Yes. Through Forever Systems it is counted per covered endpoint and billed monthly.