Todyl is a cybersecurity platform from Todyl, Inc. that runs on a single agent and dashboard, combining SASE-style network security, endpoint detection and response, SIEM, managed extended detection and response (MXDR) and governance, risk and compliance (GRC) into three tiers, Essentials, Advanced and Complete, priced on request to MSP partners.
Listing updated . Checked by MSP Software .
Todyl is a cybersecurity platform from Todyl, Inc. that runs on a single agent and one dashboard, combining a secure network built in a SASE style, endpoint detection and response, a cloud SIEM, managed extended detection and response (MXDR), and governance, risk and compliance (GRC) tooling. As of Todyl's September 2025 packaging, the platform is sold as three fixed tiers, Essentials, Advanced and Complete, rather than as separate modules an MSP mixes and matches: every tier includes all five components with 24/7 MXDR support run by Todyl's own analyst team, and the tiers differ mainly in data retention (from 30 days up to a year for forensics), the number of SOAR playbooks, and how much network security and compliance depth is included, such as SSL inspection, LAN segmentation and unlimited IPSEC tunnels at the Complete tier. It suits MSPs who want to consolidate several overlapping security point products, plus a separate MDR service, into one agent, one bill and one 24/7 SOC run by the vendor, rather than staffing detection and response themselves.
Pricing for all three tiers is quote only; Todyl's site directs buyers to request pricing rather than publishing a per-user or per-endpoint rate (checked September 2026). Todyl offers a free trial. The platform includes identity threat detection and response for Microsoft 365, Google Workspace and Azure, watching for anomalous sign-ins and account compromise as part of MXDR and SIEM, and its SASE module integrates with identity providers including Microsoft Entra ID, Google Workspace and Duo to enforce zero trust network access; Todyl is not itself an identity provider and does not sell standalone MFA, SSO or privileged access management. On the PSA side, Todyl integrates with Autotask PSA for account sync and automated service ticket creation from SOC and SIEM alerts.
Todyl was founded in 2015 and is headquartered in the United States, with its main office in Denver, Colorado. Before buying, confirm which of the three tiers actually covers the data retention and compliance framework a given client needs, since the difference between Essentials, Advanced and Complete is depth rather than which security capabilities are switched on, and check whether having Todyl's own MXDR team run detection and response, rather than the MSP's own staff, fits the security service the MSP wants to sell.
Field Effect MDR MDR from Field Effect for endpoints, cloud and network, priced $5 to $25 per user a month via quote. No reviews yet · from US$5.00 vs Field Effect MDR
UnderDefense MAXI Vendor-agnostic MDR platform from UnderDefense, starting at $11 per endpoint per month. No reviews yet · from US$11.00 vs UnderDefense MAXI| Feature | Supported | Note |
|---|---|---|
| 24-hour human-staffed SOC | yes | Bundled into every tier; run by Todyl's own analyst team, not optional. |
| Managed threat response and isolation | yes | Automated containment: isolating endpoints, quarantining files, killing malicious processes. |
| Own endpoint telemetry agent | yes | Own EDR/NGAV agent feeds telemetry into the platform. |
| Identity threat detection | yes | ITDR for Microsoft 365, Google Workspace and Azure, watching for anomalous sign-ins and account compromise. |
| Network monitoring | yes | Covered via the SASE and SIEM components of the platform. |
| Microsoft 365 monitoring | yes | SIEM ingests Microsoft 365 logs; ITDR explicitly covers M365 identities. |
| Monthly threat reporting | yes | Todyl describes monthly or quarterly strategic reviews with an account manager. |
| PSA integration for ticketing | yes | Autotask PSA integration confirmed; other PSAs not confirmed. |
| Multi-tenant console | yes | MXDR portal gives partners visibility across all client cases. |
| Works with third-party EDR | no | MXDR is built on Todyl's own SIEM, SASE and endpoint agent stack; no confirmed support for third-party EDR agents. |
| Dedicated incident response | yes | Named Detection and Response Account Manager coordinates containment and remediation. |
| Feature | Supported | Note |
|---|---|---|
| Behavioural detection | yes | ML-driven behavioural analytics and dynamic detection rules. |
| Automated remediation | yes | Automated isolation, quarantine and process termination. |
| Rollback to pre-attack state | unknown | |
| USB and device control | unknown | |
| Application allow-listing | unknown | |
| Offline protection | unknown | |
| Threat hunting console | yes | Proactive threat hunting described as part of MXDR. |
| Managed MDR add-on | yes | MXDR ships bundled in every tier rather than as a separate add-on purchase. |
| SIEM and SOAR integration | yes | SIEM is a native component of the same single-agent platform. |
| RMM integration | unknown | |
| macOS support | yes | |
| Linux support | no | No Linux agent found on Todyl's site; agent covers Windows and macOS. |
| Feature | Supported | Note |
|---|---|---|
| Multi-factor authentication | yes | MFA enforced via SASE's identity integration with providers such as Azure AD and Duo, not a standalone Todyl MFA product. |
| Single sign-on | no | Todyl is not itself an identity provider; it consumes identity from third-party IdPs rather than issuing SSO. |
| Conditional access and device trust | yes | Zero trust network access enforcement with device- and location-aware conditional policies. |
| Privileged access management | unknown | |
| Passwordless and passkey support | unknown | |
| Directory sync | yes | SASE integrates with Microsoft Entra ID and Google Workspace to enforce access, not a dedicated directory-sync product. |
| Session and risk monitoring | yes | Anomaly Detection Framework flags risky account activity as part of ITDR. |
| Legacy VPN and app support | unknown | |
| Self-service password reset | unknown | |
| Breach monitoring | unknown | |
| RADIUS and SAML support | unknown | |
| Admin audit log | unknown |
| Feature | Supported | Note |
|---|---|---|
| DNS-layer blocking | yes | Secure DNS module blocks malicious hostnames as part of SASE. |
| Content category filtering | unknown | |
| Roaming agent for off-network devices | yes | Single agent gives always-on secure connectivity for remote and roaming devices. |
| Secure web gateway | yes | Secure web gateway listed among SASE prevention features. |
| Multi-tenant dashboard | unknown | |
| Per-site policy | unknown | |
| RMM integration | unknown | |
| Threat intelligence feed | yes | Threat intelligence feeds into the anomaly detection framework. |
| SafeSearch enforcement | unknown | |
| Reporting and audit log | yes | Reporting available through the shared platform portal. |
| Custom block and allow lists | unknown | |
| Network-wide router deployment | no | Deployed via an endpoint agent, not a router or network-wide appliance. |
No. As of Todyl's September 2025 packaging, every tier, Essentials, Advanced and Complete, includes all five components: SASE, endpoint security, SIEM, MXDR and GRC, with 24/7 support from Todyl's own analysts. The tiers differ in data retention, the number of automated response playbooks and compliance framework depth, not in which security capabilities are switched on, so an MSP cannot buy, for example, EDR alone without the rest of the platform.
Todyl's MXDR service is run by Todyl's own 24/7 team of security analysts, with a named Detection and Response Account Manager on each account; Todyl does not describe an option to hand this function to the MSP's own staff. Every one of Todyl's three tiers includes this managed SOC as standard, so buying any tier means contracting Todyl's analysts to handle detection and response rather than running that function in-house.
Todyl integrates with Autotask PSA for account sync between the two platforms and automated service ticket creation from Todyl's SOC and SIEM alerts. Todyl's own site does not publish a full list of other supported PSAs, so an MSP using a different PSA should confirm current integration support directly with Todyl before buying.
It depends on the tier and client size, since Todyl's Essentials, Advanced and Complete tiers are priced on request rather than published, and each already bundles SASE, EDR, SIEM, MXDR and GRC rather than being billed per module. For an MSP currently paying for several overlapping security tools plus a separate MDR service, consolidating onto one Todyl tier can simplify billing, but a direct cost comparison needs a quote for the specific tier required.
Yes, Todyl offers a free trial of its platform. MSP partners request trial access or a product demo through Todyl's website rather than signing up self-service, and Todyl does not publish a genuinely free ongoing version of the platform for continued use beyond the trial period.
Reviews are moderated. How reviews work.
Share what it is like to use this product day to day. Your experience helps other MSPs choose with confidence.
Write the first review
