The SOC that never sleeps,built for the teams who never quit.

• 71% false alarm rate reported by independent MDR trackers citing the vendor’s own 2025 data — alert fatigue before any real response.
• Customers can’t query their own raw data or view active threat feeds directly — telemetry is visible only through the windows the platform provides.
• "Guided" model: the concierge advises, but doesn’t act — hands-on-keyboard containment lands back on your team.

Where they genuinely lead: The named Concierge Security Team model and breadth of integrations (200+) for organizations that want a technology-agnostic advisory layer.

• Requires deploying Rapid7's proprietary InsightAgent — one more agent on every endpoint for IT teams trying to consolidate.
• Endpoint detection quality trails CrowdStrike and SentinelOne in independent reviews.
• Support responsiveness and response-time consistency flagged by reviewers as weaker than top-tier MDR peers.

Where they genuinely lead: Combining MDR with vulnerability management from a single vendor, with unified risk context — a real advantage for teams that want both from one contract.

• GreyMatter is middleware — a correlation layer stitched over the SIEM and tools you already pay for, adding integration surface rather than removing it.
• Roughly half its buyer base is large enterprise — built for Fortune 1000 complexity, over-built for mid-market and partner-led deployments.
• Users cite unclear documentation and steep UI and integration learning curves — for a product whose pitch is simplification.

Where they genuinely lead: Cross-tool correlation for large enterprises committed to keeping a heterogeneous, multi-SIEM estate.

• $200K–$500K/year for 100 GB/day deployments — ingest billed uncompressed, and pricing is their #1 user complaint.
• Proprietary SPL creates deep lock-in; correlation searches and dashboards don’t port — migration typically costs 2–4 months of retraining.
• Roadmap ambiguity since Cisco’s $28B acquisition — procurement teams report treating renewals as de facto re-evaluations.

Where they genuinely lead: Raw analytical power and search depth for teams with dedicated Splunk engineering staff.

• Per-GB ingest billing on Log Analytics — SIEM cost scales with every log source, and non-Microsoft telemetry is billed at full rate.
• A SIEM you operate, not a service: detection engineering, triage and 24/7 response are your team’s job — or a separately contracted MSSP’s.
• Assumes KQL fluency and a Microsoft-centric estate — analytics rules, hunting queries and workbooks all need Kusto skills and ongoing tuning.

Where they genuinely lead: Native depth across Microsoft 365, Azure and Defender XDR — with E5 data grants that make eligible Microsoft-source ingestion effectively free.

• Multi-signal model centers on its own platform and network sensors — technology that parallels, rather than builds on, an existing CrowdStrike deployment.
• MSP program described by partners as convoluted — "It should be made much more simple" is a direct partner quote.
• No dedicated APAC SOC — regional coverage relies on distributed analysts and a third-party partnership.

Where they genuinely lead: A contractual 15-minute mean-time-to-contain SLA — one of the few in the market — and genuinely hands-on remediation.

• Threat hunting is a paid add-on — not included in base MDR pricing.
• Incident response is a separate add-on too — the capabilities you need most in a crisis sit behind upsells.
• API-first overlay by design — Falcon is driven through an external console rather than operated natively.

Where they genuinely lead: Operational transparency — every analyst action visible in Workbench — and very fast API-based onboarding across 160+ integrations.

• Per-endpoint + per-user + per-cloud-resource billing (published starting points near $120, $100 and $250 on Core) — every line item grows with your footprint.
• Deeper hands-on forensics sits in upgraded tiers — buyers are advised to clarify what IR the base service actually includes.
• Zscaler disclosed elevated post-acquisition churn in its February 2026 earnings — vendor-neutrality over the contract term is the renewal question to ask.

Where they genuinely lead: Detection engineering reputation and Slack-native SOC collaboration, with strong marks for accuracy.