Passeca - Governance, Risk management, and Compliance support
Under attack?
Managed Detection & Response

24/7 threat detection and active response

Already have tooling — and maybe a team? Passeca adds 24/7 detection engineering, threat hunting, and active response on top of the tools you already use.

Book a free consultationNeed a SOC? See SOC-as-a-Service
Glowing orange mechanical bee perched on a radar scanner sweeping a world map

Managed Detection and Response (MDR) by Passeca is 24/7 monitoring, detection engineering, threat hunting, and active response delivered on top of the security tools you already run.

For organisations in scope of NIS2, MDR can support incident-handling and cybersecurity risk-management processes with continuous detection, investigation, response and documented incident evidence.

We tune your detections, hunt for threats your tools miss, and contain confirmed threats under an agreed response playbook.

Which do you need?

SOC-as-a-Service vs MDR: which do I need?

Both provide 24/7 detection and response. The difference is what you already have in place.

 SOC-as-a-ServiceMDR
What you already haveLimited security tooling or no SOCOwn tooling and/or a security team
Who provides the security platformPasseca (PassIRP, CrowdStrike, Deception, and others)Passeca works with your existing tools
What Passeca doesRuns the whole SOC for youAdds detection engineering, threat hunting, and response to your existing tools
Best forBuilding from scratchGetting more from your existing security stack

Not sure which fits? If you don't have a SIEM or security team, start with SOC-as-a-Service. If you already have security tools and a team, MDR adds 24/7 monitoring and response.

The work

Detection engineering & threat hunting

Security tools generate alerts. The real value comes from tuning those detections and hunting for what they miss.

Detection engineering continuously improves your existing detections. Passeca writes, tunes and retires rules so your alerts focus on real threats. Our analysts maintain detection content against MITRE ATT&CK, map it to your assets, and suppress the noise that overwhelms in-house teams.

Threat hunting looks beyond those detections for threats your tools may miss — including malware-free intrusions, living-off-the-land techniques, and lateral movement that can precede ransomware encryption. Each hunt starts with a hypothesis, and its findings can lead to new detections in the platform.

Detection console with a list of rules and a highlighted threat alert
Clarity

What "response" actually means

Before we respond autonomously, we agree exactly which actions Passeca can take and which require your approval.

When a confirmed threat requires immediate containment, Passeca can act within the limits you approve in advance:

  • Isolate a compromised device to stop further network activity.
  • Disable an account — stop a compromised user account from accessing systems.
  • Block an indicator — block a malicious IP address, domain, or file hash.

Actions that could affect business availability, delete data, or have broader operational impact require your approval. We define and regularly review the boundary for autonomous response with each client, so you always know what Passeca can do and when we escalate to your team. These agreed response boundaries also give your organisation a documented incident-handling and escalation process that can support NIS2 readiness.

Network diagram showing a compromised device isolated, an account disabled and a malicious address blocked
Technology-agnostic

Bring your own tools

We work across the security stack you already have.

CrowdStrike

Endpoint security (EDR/XDR)

CrowdStrike logo

Wiz

Cloud security (CNAPP)

Wiz logo

Rapid7

Attack surface management

Rapid7 logo

Tenable

Exposure management

Tenable logo

Enginsight

Vulnerability management

Enginsight logo

Your SIEM / SOAR

We work within your existing platform

Whatever your stack, PassAI-Guard adds an AI-powered triage layer. It classifies, deduplicates and scores alerts, then runs playbooks for routine containment. This lets analysts focus on genuine threats.

Accountability

SLAs & reporting cadence

Performance against these targets is reviewed through regular operational reporting.

Detection & Containment

MetricTarget
MTTD — High severity15–30 min
MTTR — Critical / High≤ 2 hrs

Severity-based response

SeverityResponse target
Critical / P1~15–30 min
High / P2~30 min–4 hrs
Medium / P3~4–24 hrs
Low / P4~24–72 hrs
FAQ

MDR, answered

Clear answers to the questions that matter before you put your existing security stack under managed detection and response.

What is the difference between MDR and SOC-as-a-Service?
SOC-as-a-Service is for organisations with no SOC: Passeca supplies the SIEM, EDR, deception and analysts as a complete package. MDR is for organisations that already own security tooling — and sometimes a team — and want 24/7 detection engineering, threat hunting and active response layered on top of their existing stack.
What can Passeca do without waking us up?
Under an agreed playbook, Passeca can isolate a compromised host, disable a compromised account or block a malicious IP, domain, or file hash. These actions help contain an attack quickly. Actions that could affect business availability, delete data, or have a wider business impact require your approval. The exact boundaries are agreed with you in advance.
Which tools can you manage for us?

Passeca works with the security tools you already use, including:

  • CrowdStrike — Endpoint security (EDR/XDR)
  • Wiz — Cloud security (CNAPP)
  • Rapid7 — Attack surface management
  • Tenable — Exposure management
  • Enginsight — Vulnerability management
  • Your SIEM / SOAR — We work within your existing platform
  • PassIRP — Passeca's SIEM and incident response platform
  • PassAI-Guard — Passeca's AI-powered alert triage and security automation

The service is technology-agnostic, which means we can easily integrate your tools.

Do we still need our own security team?
Many MDR clients keep an internal security lead who owns strategy, vendor relationships and business-context decisions. Passeca provides the round-the-clock monitoring, detection engineering, hunting and response execution, so your team is not doing shift work or investigating every alert.
What are the MDR SLAs?
Passeca's MDR service includes committed targets for threat detection, response and containment based on incident severity. High-severity threats have an MTTD target of 15–30 minutes, while critical and high-severity incidents have an MTTR target of ≤2 hours. Severity-based response targets range from ~15–30 minutes for Critical/P1 incidents to ~24–72 hours for Low/P4 incidents, with performance reviewed through regular operational reporting.
How does PassAI-Guard fit into MDR?
PassAI-Guard is the AI triage layer that sits between your tools' alerts and the human analyst. It classifies, deduplicates and scores alerts, enriches them with threat-intel and asset context, and runs SOAR playbooks for routine containment. Analysts can then focus on genuine threats.
How much does MDR cost?
Passeca MDR starts from €8.99 per asset/month. Your final price depends on the size of your environment, the security technologies you use, and the scope of monitoring and response you require. We'll review your environment during the consultation and provide a service scope based on your needs.
Once we start MDR, how does Passeca keep us informed?
With Passeca MDR, you receive regular reports on detection activity, alerts, response actions and service performance. Passeca notifies you immediately about confirmed incidents and reviews the service with your account team regularly.
What should we look for in an MDR provider?
Look for more than 24/7 alert monitoring. A strong MDR provider should offer detection engineering, threat hunting, active response, clear response authority, integration with your existing tools, and measurable service commitments. You should also know who investigates an alert and what happens when a real threat is found.
How is MDR different from antivirus or EDR?
Antivirus and EDR are security technologies. MDR is a managed service that puts people and processes around your security tools. Passeca monitors alerts 24/7, improves detections, hunts for threats, and takes response actions when needed.
What does MDR take off our internal team's workload?
MDR takes care of the continuous work your team may not have the capacity to cover: 24/7 monitoring, alert investigation, detection tuning, threat hunting, and incident response. Your team can focus on strategy and business priorities instead of watching security alerts around the clock.
What should we look for in an MDR provider in Germany?

Look for an MDR provider that understands your regulatory and operational environment, can work with your existing security stack, and offers clear responsibilities for detection and response. For German organisations, also consider data residency, security certifications, contractual requirements, and the provider's ability to support regulated environments.

For instance, Passeca also provides compliance services to help organisations address European regulatory requirements such as DORA and NIS2 and connect them with their wider security and governance programme.

What challenges should I expect when implementing an MDR solution?
The main challenges are usually integration, defining response responsibilities, and tuning the service to your environment. A good MDR provider should handle most of the technical setup and agree the response process with you before the service goes live.
How does Passeca MDR support NIS2 readiness?
NIS2 requires organisations in scope to establish appropriate cybersecurity risk-management and incident-handling measures. MDR by Passeca supports the operational side of those requirements with continuous detection, investigation, threat hunting, response processes and documented incident records. MDR is one part of NIS2 readiness; governance, policies, business continuity, supply-chain security and other requirements also need to be addressed.
Can Passeca MDR help with Cyber Resilience Act requirements?
For manufacturers in scope of the Cyber Resilience Act, MDR can support the detection and investigation of security incidents and provide evidence for incident assessment and reporting. However, CRA compliance goes beyond monitoring and response: it also covers areas such as product cybersecurity risk assessment, secure development, vulnerability handling, security updates and technical documentation.
Always-on defence

Already invested in tooling? Make it work 24/7.

We'll review your stack, show you where detection and response gaps remain, and outline an MDR approach that fits your environment.

Book a free consultationSee SOC-as-a-Service

Related

Services hubAll four Passeca service familiesSOC-as-a-ServiceFor organisations with no SOC yetManaged EDR (CrowdStrike)Endpoint-focused managed servicePassAI-Guard platformThe AI triage layer behind MDRIncident ResponseEmergency responsePartnersThe technology-agnostic stackBook a consultationScope your MDR engagement