Managed options from AI SOC vendors: between software and MDR

What are these services?

Prophet Security describes Prophet AI Watchtower as a 24x7x365 human-in-the-loop expert service, sold alongside its AI SOC Analyst, AI Threat Hunter and AI Detection Engineer. 7AI describes PLAID ELITE as a service in which 7AI experts run the platform 24x7, and also offers on-demand DFIR. Among the 13 vendors profiled, 4 document an option of this kind.

How do they differ from classic MDR?

In a classic MDR arrangement, the provider usually brings its own tooling or connects to yours, and its analysts work in its systems. In these vendor options, the people work in the same AI SOC product your team uses, which means:

• One case record. Your day team and the vendor's people see the same verdicts, evidence and actions.
• The software does the first pass at all hours; the people review, approve or act on what it surfaces.
• Switching the service off leaves you with the software, not with nothing.

The trade-off is choice: you buy the people from the same vendor as the software.

What do the vendors say about response?

Prophet Security describes scoped Agent Actions that run autonomously or with your sign-off. 7AI describes concrete actions, such as revoking a session, resetting a password or isolating a host, run against existing tools with approval gates and a full audit trail. With a managed option, the key question becomes who gives the sign-off at night: your on-call lead or the vendor's people.

What should you ask?

1. Which response actions may the vendor's people approve or run without calling us?
2. How fast do they escalate a case that needs a business decision, and through which channel?
3. Do they tune detections or agent behavior, and who approves those changes?
4. What is the pricing basis for the service, separate from the software? Neither vendor publishes pricing on the pages we read.
5. If we stop the service, what changes in the product's behavior at night?

Who are these options for?

• Teams that want AI SOC software by day and people at night without a second vendor.
• Teams growing toward full in-house coverage that want a bridge.
• Teams that want to see every step of the work, because the people work in a product whose investigations are recorded. 7AI, for example, says you can read each agent's mission, the tools it ran, the exact request and response, and the conclusion it drew.

Who should still look at MDR?

Teams with no analysts at all, or teams that want a provider to bring its own tooling and take responsibility for detection as well as response. Five MDR providers now have lighter profiles on this site; none publishes a price, so compare offers on the questions in the primer lesson on what MDR buys.

What about the other vendors?

They sell software your team runs. Some describe settings that reduce the need for night staff, such as acting alone on trusted categories. That is a different answer to the same problem: it removes the need for a person on narrow actions, rather than supplying one.

How does the fit finder treat this?

When your answers ask for outside help, at night or entirely, the finder adds the managed service need, and vendors that document one appear first in the vendor list. It does not move them up for any other reason.

How do you compare a managed option with an MDR offer?

Use the same questions for both. Ask each to fill in the night column of your response action catalog, the escalation time for a business decision and the format of the morning hand-over. Then compare what is left over: with the managed option you keep the software if you stop the service; with MDR you usually keep only what the contract says you can export. Neither is better in general; the right answer depends on whether you expect to build your own night coverage later.