Indicative pricing for the four Sentry XDR service tiers — Build, Essential Protect, Advanced Guard, and Elite Shield. Every quote is honest-scoped against your estate and the threat landscape it actually sits in.
Get the foundations right — improve posture and report, before you add a SOC.
8×5 cover · no SOC monitoring.
Round-the-clock managed detection on Microsoft Defender + Sentinel.
From — indicative. Named UK analysts.
Essential Protect + faster response, IR retainer, and purple team.
From — indicative.
Advanced Guard + DV-cleared analysts and a UK delivery floor.
Annual contract · elevated clearance.
Per-seat for run; fixed price for onboarding (typically 30–60 days). All tiers include the Incident Response retainer — there's no separate IR fee on top. Annual contracts, one-month break clause after year one.
The IR retainer covers any security incident across your Microsoft cloud estate — whether it originated inside our perimeter or somewhere we don't monitor. We pick up the phone either way; that's the point of bundling it.
Can we use our own SIEM? No. Sentry XDR runs on Microsoft Defender XDR and Sentinel — that's how we keep response fast. If you have a legacy SIEM, the onboarding includes migration.
How do you handle response times? We track response time as a rolling average and report it monthly, and we can agree response-time targets in your contract on the higher tiers.
Whatever you spend, the same Microsoft-native detection spine runs underneath. The tiers change how fast we respond, how deep we hunt, and how much clearance and ring-fencing you get — never whether you're covered.
Bolt these onto any tier when your estate, your sector, or your auditors demand more. We'll tell you which ones you actually need and which you can skip.
The practice partner will help you scope to the right tier — and tell you honestly when you're already over-licensed.