TrendAI Vision One™ - Managed Detection and Response (MDR)

TrendAI Vision One Managed Detection and Response (MDR)

TrendAI Vision One MDR is a 24/7/365 service where TrendAI analysts monitor your environment, investigate high-risk alerts and give you a step-by-step remediation plan. It covers five attack surfaces from one console: email, endpoints, servers, cloud workloads and network.

What the service does

Detection

• 24/7 monitoring that filters alerts down to those needing investigation.
• Continuous sweeps for indicators of compromise and indicators of attack, including those shared through US-CERT and third-party disclosures.
• Follow-the-sun SOC coverage across North America, Europe and Asia-Pacific.

Investigation

• Analysts build a full picture of the attack: root cause, attack vector, dwell time, spread and impact.
• You receive detailed incident reports and can work directly with the analyst during the investigation.
• Backed by TrendAI global threat research.

Response

• Containment actions include endpoint isolation, process kill, network containment, account disable and file quarantine.
• First response is configurable: analysts can act automatically against your playbook, or escalate for your approval.
• Step-by-step remediation plans with custom cleanup tools, plus automatic IoC generation to block repeat attacks.
• Monthly reports summarizing case activity.

Which subscription you need

You still need the underlying TrendAI Vision One XDR licenses for the products being monitored. MDR is the managed service layer on top, not a replacement for the platform.

How it compares with Sophos MDR

Nuformat sells both, so here is the honest comparison rather than a pitch for one.

The short version: TrendAI covers more attack surfaces in the base price and gives you a single console across all five. Sophos commits contractually to a response time and does the cleanup for you. Which matters more depends on whether your constraint is breadth of coverage or having someone finish the job.

What you need to run it

• TrendAI Vision One XDR licenses on the products being monitored.
• A license count matching your users, servers or network sensors.
• Onboarding, which TrendAI runs as a defined process.

Note that extended data retention beyond the standard period is priced separately, as is incident response.

Frequently asked questions

What is TrendAI Vision One MDR?

It is a 24/7/365 managed detection and response service where TrendAI analysts monitor activity data from your TrendAI products, investigate high-risk threats, and provide recommended actions. It covers email, endpoints, servers, cloud workloads and network from the Vision One console.

Does TrendAI MDR include incident response?

No. TrendAI states that the MDR service does not include incident response services, either onsite or remote. Investigations are limited to data from the MDR-licensed products. Full incident response is a separate engagement. If you need the provider to carry out end-to-end remediation, compare this against Sophos MDR Plus, which includes it.

What is the difference between TrendAI MDR and Sophos MDR?

TrendAI covers five attack surfaces in the base price, email, endpoint, server, cloud and network, from one console. Sophos MDR Plus includes full incident response with no hourly caps and a contractual 60-minute response target for 90 percent of high-severity cases, which TrendAI does not publish. TrendAI provides Service Level Objectives rather than formal SLAs.

Does TrendAI MDR cover email?

Yes. Messaging is included in the MDR for Users, Servers and Workload Security subscription, and mailboxes are not counted separately in your license total. You do still need the XDR licenses for messaging.

Can TrendAI analysts act without asking me first?

Yes, if you configure it that way. First response is configurable: analysts can act automatically against a playbook you define, or escalate to you for approval before acting. Containment actions include endpoint isolation, process kill, network containment, account disable and file quarantine.

How long is alert history kept?

The Vision One console provides 180 days of alert history in the Workbench, with full query access to platform data. Extended data retention beyond the standard period is priced separately.

TrendAI Vision One range · Sophos MDR

Service details as published by TrendAI in product documentation and service FAQs. Coverage, subscriptions and response model confirmed against vendor sources. Pricing and availability confirmed by Nuformat at the time of quotation.