In short: Todyl MXDR (managed extended detection and response) is Todyl's 24/7 managed service. Its analysts monitor the Todyl SIEM, endpoint and SASE data, investigate cases, recommend or take response actions and cover identity threats such as account takeover in Microsoft 365 and Google Workspace. It is licensed per device and billed monthly.
What Todyl MXDR is
Detection tools are only useful if someone acts on what they find, at any hour. Todyl MXDR (listed as Todyl Managed XDR) is a managed service in which Todyl's own analysts watch your environment around the clock, investigate what the platform detects and help contain it. It gives you security operations centre (SOC) style coverage without building and staffing a SOC of your own.
MXDR runs on Todyl SIEM and draws on the rest of the platform: Endpoint Security on devices, SASE on network traffic and integrations with Microsoft 365, Google Workspace and third-party tools.
What is included
| Included | What it means for you |
|---|---|
| 24/7 analyst team | Detection and response around the clock, every day of the year |
| Proactive notification | You are told about potential and confirmed threats, not just sent alerts |
| Identity threat detection and response | Continuous monitoring of cloud identities for account takeover and adversary-in-the-middle phishing |
| Response actions | Recommended playbooks, one-click actions and automated responses to secure endpoints and identities |
| Full case transparency | Every case visible in the console with event context and MITRE ATT&CK mapping |
| Posture reviews | Ongoing recommendations and monthly or quarterly strategic planning sessions |
| Named account manager | A dedicated Detection and Response Account Manager |
| Direct access | The team is reachable through channels such as Teams, Slack and email |
Identity coverage includes Microsoft 365 and Azure environments and Google Workspace, which is where business email compromise usually starts.
How Todyl MXDR is licensed
Todyl MXDR is licensed per device, billed monthly in arrears on the devices covered, with no annual contract. It is designed to be combined with other modules: Todyl says MXDR has full insight into your environment when paired with SASE, Endpoint Security and SOAR, and third-party tools can feed the SIEM to widen coverage.
All three Todyl packages (Essentials, Advanced and Complete) include MXDR alongside SASE, Endpoint Security, SIEM and GRC, so for many organisations a package is the simplest route. Ask us for a quote and we will compare a package with the individual modules you need.
How it works with Forever Systems
Todyl's team investigates and responds; we make sure it fits how your organisation works:
- Onboard: we deploy the agent, connect Microsoft 365 or Google Workspace and other sources, and agree which response actions can run automatically.
- Agree escalation: who is contacted for which kind of incident, and when, including out of hours.
- Respond: when Todyl raises a case, we work with its analysts on remediation, from resetting accounts to rebuilding devices.
- Review: we go through posture recommendations with you and track the fixes.
Who Todyl MXDR suits
Todyl MXDR suits organisations that need 24/7 detection and response, often because a cyber insurer or customer asks for it, but cannot justify an in-house SOC. It is a particular fit if you rely on Microsoft 365 or Google Workspace and worry about account takeover, or if you are adopting Todyl SASE and Endpoint Security and want them watched around the clock.
Compare other services in EDR, XDR and MDR. See all vendors on our vendors A to Z, or go back to the Todyl overview.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What does Todyl MXDR monitor?
Endpoints, network traffic and cloud identities, using Todyl SIEM data fed by the Todyl agent, Microsoft 365, Google Workspace and integrated third-party tools.
Does Todyl MXDR include identity threat detection?
Yes. The MXDR team provides identity threat detection and response, continuously monitoring cloud identities for account takeover and adversary-in-the-middle attacks.
Do I need other Todyl modules for MXDR?
MXDR runs on Todyl SIEM and works best with Todyl SASE, Endpoint Security and Security Automation. We scope the right combination with you, and every Todyl package includes them.
How is Todyl MXDR priced?
It is licensed per device and billed monthly in arrears. Ask us for a quote for your device count and the modules you want.