# Cybereason Defense Platform > XDR and EDR solution with AI-powered MalOps detection, cloud or on-premises, pricing on request. Cybereason Defense Platform is an XDR and EDR solution from Cybereason featuring operation-centric attack detection through MalOps technology. Deployed cloud or on-premises with pricing available on request; managed detection and response services also available. Listing updated 6 September 2026. Checked by MSP Software 6 September 2026. - Page: https://mspsoftware.net/software/cybereason - Vendor: Cybereason, https://mspsoftware.net/vendors/cybereason, website https://www.cybereason.com/platform - Categories: EDR and XDR (primary), MDR and SOC - Free version: no. - Deployment: cloud and on-premises. - Support: email, phone, 24/7 and help desk. ## From the vendor Cybereason Defense Platform is an AI-powered XDR and EDR solution from Cybereason designed to detect and remediate endpoint threats through operation-centric security visualization. The platform distinguishes itself from alert-based competitors by using proprietary MalOps technology to present complete attack narratives that connect the full story of an attack from root cause across affected endpoints and users, rather than isolated, low-context security alerts. This approach enables security teams to reduce investigation time by as much as 93% according to vendor materials, moving from days of alert triage to minutes of focused response. The platform consolidates prevention, detection, and response capabilities in a single lightweight agent and console, delivering multi-layered defenses including behavioral detection powered by machine learning, automated remediation, and rollback-to-pre-attack capabilities. Cybereason offers three enterprise service tiers: Enterprise for prevention-focused deployments, Enterprise Advanced for medium-sized deployments, and Enterprise Complete for large enterprises requiring advanced features and threat hunting. Pricing is available only by request; Cybereason does not publish per-endpoint rates on its website. The platform integrates with major third-party security platforms including Okta, Microsoft Entra ID, Duo, and CyberArk for identity and access management, Mimecast and Proofpoint for email security, Splunk and IBM QRadar for SIEM platforms, and ServiceNow for SOAR and workflow automation, among others across network security, cloud, and threat intelligence categories. Cybereason supports both cloud-based SaaS deployment and on-premises deployment models, including air-gapped environments for disconnected networks where customer data is never exposed to internet connectivity. Cybereason is now owned by LevelBlue. MSPs evaluating Cybereason should confirm whether their organization fits the enterprise-focused positioning of the platform, verify that required integrations with existing RMM, PSA, and security tools are available, understand whether managed detection and response services, such as MDR Essentials or MDR Complete, are preferable to self-managed EDR licensing, and confirm support hour requirements align with the vendor's 24/7 incident response availability. ## Our take Cybereason Defense Platform competes in the XDR space alongside CrowdStrike Falcon, Microsoft Defender for Endpoint, and SentinelOne, distinguishing itself through operation-centric attack visualization using MalOps rather than alert-heavy dashboards. It suits organizations wanting to consolidate detection, response, and threat hunting capabilities in one platform with unified response workflows. Because Cybereason focuses on enterprise deployments and does not publish pricing, smaller and mid-market MSPs should request a trial or demo to understand per-endpoint costs and whether the feature set matches their needs. Before committing, confirm operating system support (Windows, macOS, Linux availability not explicitly stated on their public website), verify that integrations with your RMM, PSA, or SIEM are included in the current integration list, and clarify whether managed MDR services or self-managed EDR licensing better suits your operational model and budget. ## Pricing Cybereason Defense Platform does not publish a list price. ## Features | Feature | Supported | Note | | --- | --- | --- | | Behavioural detection | yes | Multi-layered behavioral defenses with machine learning detection capabilities | | Automated remediation | yes | Single-click automated and guided remediation capabilities | | Rollback to pre-attack state | yes | Rollback to pre-attack state capability included | | Threat hunting console | yes | Proactive threat hunting and analysis capabilities included | | Managed MDR add-on | yes | MDR services available in three tiers: MDR Core, MDR Essentials, MDR Complete | | SIEM and SOAR integration | yes | Integrates with Splunk, IBM QRadar, Rapid7 IDR, Exabeam, Sumo Logic, Google Chronicle, Devo | | 24-hour human-staffed SOC | yes | 24/7/365 global Security Operations Center monitoring included in MDR services | | Managed threat response and isolation | yes | Managed threat detection and response as a service with MDR tiers | | Own endpoint telemetry agent | yes | Single lightweight agent provides endpoint telemetry | | Monthly threat reporting | yes | Threat reporting, MalOp reports, hunting reports, and threat intelligence reports included | | Dedicated incident response | yes | Incident response retainer and extended response capabilities available | ## Integrations - Okta, https://mspsoftware.net/software/okta - Microsoft Entra ID, https://mspsoftware.net/software/microsoft-entra-id - Duo, https://mspsoftware.net/software/duo - CyberArk, https://mspsoftware.net/software/idira - Mimecast, https://mspsoftware.net/software/mimecast - Proofpoint Essentials, https://mspsoftware.net/software/proofpoint-essentials - Splunk, https://www.splunk.com - IBM QRadar, https://www.ibm.com/products/qradar-siem ## Alternatives - Todyl: A single agent bundling SASE, EDR, SIEM and MXDR, sold in three tiers priced on request. https://mspsoftware.net/software/todyl - ThreatDown: EDR and MDR combining AI-powered detection, ransomware rollback and 24/7 managed response. https://mspsoftware.net/software/threatdown - FortiEDR: Endpoint detection and response integrated with the Fortinet Security Fabric, quote-only pricing. https://mspsoftware.net/software/fortiedr - Huntress: Managed detection and response for MSPs, priced per endpoint from $7.99 a month direct. https://mspsoftware.net/software/huntress. Compare: https://mspsoftware.net/compare/cybereason-vs-huntress ## FAQ ### How much does Cybereason Defense Platform cost? Cybereason Defense Platform does not publish a list price. No MSP price reports have been approved yet. ### Does Cybereason Defense Platform offer a free trial? There is no free version. ### What does Cybereason Defense Platform integrate with? Cybereason Defense Platform lists integrations with Okta, Microsoft Entra ID, Duo, CyberArk, Mimecast and Proofpoint Essentials. ### Is Cybereason Defense Platform cloud or on-premises? Cybereason Defense Platform can be run in the cloud or on-premises. ### How is Cybereason Defense Platform priced? Cybereason Defense Platform is priced on a quote-only basis rather than having published per-endpoint rates on the vendor website. Interested organizations must contact Cybereason sales for a custom quote. Cybereason offers three enterprise service tiers (Enterprise, Enterprise Advanced, and Enterprise Complete) at different price points, and also offers managed detection and response services in separate packages (MDR Core, MDR Essentials, and MDR Complete) alongside self-managed EDR licensing. ### What deployment options does Cybereason Defense Platform support? Cybereason Defense Platform supports both cloud-based SaaS deployment and on-premises deployment, including air-gapped environments for disconnected networks. Cloud deployment uses dedicated virtual private clouds where customer environments and data are segmented for isolation. The platform uses a single lightweight agent across all deployment types for simplified management and consistency. ### What is MalOps technology in Cybereason Defense Platform? Cybereason Defense Platform uses proprietary MalOps technology to consolidate security alerts and generate high-fidelity detections that present complete attack narratives rather than isolated, low-context alerts. MalOps visualizes the full attack story from root cause across every affected endpoint and user, enabling security teams to understand the full scope of a threat. The platform analyzes approximately 9.8 petabytes of threat intelligence weekly and can reduce investigation time by as much as 93% compared to traditional alert-based approaches. ### Does Cybereason Defense Platform offer managed detection and response? Cybereason Defense Platform can be deployed as a self-managed EDR platform, or organizations can purchase managed detection and response services including MDR Core, MDR Essentials, and MDR Complete tiers. The MDR offering includes 24/7/365 global Security Operations Center monitoring, threat hunting, remediation services, and incident response. Cybereason aims to detect threats within 1 minute, triage within 5 minutes, and remediate within 30 minutes. ### What third-party integrations does Cybereason Defense Platform support? Cybereason Defense Platform integrates with a comprehensive ecosystem of third-party security tools including identity platforms (Okta, Azure AD, Duo, CyberArk), email security (Mimecast, Proofpoint), SIEM and analytics tools (Splunk, IBM QRadar, Rapid7 IDR), SOAR platforms (ServiceNow, Google Chronicle XSOAR), and cloud providers (AWS, Google Cloud, Oracle Cloud). The platform also integrates with endpoint management tools like Microsoft Defender and network security solutions from major vendors.