Buying an EDR platform is the easy part. The hard part arrives at three in the morning, when an alert fires and somebody has to decide within minutes whether it is a false positive or the first hour of a ransomware incident. Arrosoft’s MDR service puts a security operations team behind SentinelOne, so detection turns into containment without your own team being woken up.

Why organizations hand detection and response to someone else

IBM’s 2025 Cost of a Data Breach report puts the global average breach at USD 4.44 million, and the average time to identify and contain one at 241 days. That is a nine-year low, and it is still eight months.

ISC2’s 2025 Workforce Study found that 95% of security teams report at least one skills gap, that 59% describe those gaps as critical or significant — up from 44% a year earlier — and that 88% had at least one security incident or operational problem they attribute to a skills shortage.

The gap is not tooling. It is the hours and the people to act on what the tooling finds.

What the service covers

• 24x7x365 support coverage
• Critical detections escalated by phone, not left in an inbox
• Endpoint monitoring
• Incident alerting
• Remediation and rollback
• Alert and false-positive tuning
• Endpoint isolation
• Pro-active cyber threat hunting
• Agent patching and updates

What happens when we find something

Every detection is scored and triaged before it reaches you, so what lands with your team is sorted by what it actually means rather than by which tool shouted loudest. How fast we move depends on severity, and the targets for each are set out in your service agreement.

A critical alert is phoned through immediately and escalated to the SOC manager. High severity is emailed, and phoned if the situation calls for it. Medium and low are raised as tickets.

How we classify what we find

Severity	What it means	Typical signals
Critical	A successful compromise, or an attack that stops the business operating	Malicious user activity, C2 traffic, data exfiltration, malware establishing itself, ransomware exploitation, denial of service
High	A failed compromise, or an interruption a workaround can absorb	Suspected malicious user activity, suspicious privileged account activity, malware infection, spoofing and phishing
Medium	Limited interruption, no workaround needed	Suspicious non-privileged account activity, reconnaissance and probing, environmental awareness
Low	No business effect	False positives and informational alerts

What happens when we detect something

1. Continuous monitoring and threat detection, around the clock.
2. The alert is triaged and analyzed.
3. False positives are closed and tuned out, so the same noise does not return.
4. Anything real goes to deep-dive investigation.
5. Containment: suspend processes, isolate the system, kill processes, quarantine the file, run an EDR scan, retrieve the file, or connect to the machine directly.
6. A report is generated and sent to you.
7. The ticket is logged and closed.

Response actions can be run by us, by your own IT team, or by the vendor, depending on what your agreement says.

Pro-active threat hunting

Detection waits for a signal. Hunting goes looking for the attacker who has not tripped one yet — the credential that is being used at odd hours, the process that only runs on one machine, the lateral movement that looks like administration.

This matters because the slowest incidents to find are the quiet ones. An attacker who is established and patient does not generate the alerts an endpoint product is built to catch, which is how a breach reaches 241 days before anyone notices.

MDR with SentinelOne

The service runs on SentinelOne. See SentinelOne Endpoint Protection and Remediation for the platform itself, including what its ransomware warranty covers and what it requires you to do.

Frequently asked questions

Do we need to buy SentinelOne separately? Not usually. Most customers take the licenses and the service from us together, which is simpler to run and simpler to budget. If you already own SentinelOne, we can run MDR on top of the licenses you have instead.

Who can act on our machines, and how far does that go? Containment actions are agreed with you up front and scoped in the agreement, rather than set by a blanket policy. How far we go without checking in first — isolating a host on a critical detection, for instance — is part of that conversation. It is worth settling before an incident rather than during one.

What happens outside business hours? Coverage is 24x7x365. Critical alerts are phoned through whatever the hour.

Is threat hunting included? Yes.