Unit 42 MDR

Paid#16 of 31 in Managed Detection and Response Services

Unit 42 MDR: A Cortex-centered MDR service for continuous monitoring, hunting and managed response. Ranked #16 of 31 in Managed Detection and Response Services by our editors (7.9/10); pricing: Pricing on request; best for cortex-centered enterprise environments.

7.9/10★★★★☆Editor score

Contact Palo Alto

Unit 42 MDR7.9 Contact Palo Alto

At a glance

• Editor score
  7.9 / 10
• Pricing
  Pricing on request
• Best for
  Cortex-centered enterprise environments
• Monitoring coverage
  24_7
• Founded
  2005 · Santa Clara, California, USA
• Facts checked
  22 Sep 2026

• Where it wins

  • 24/7 monitoring, triage and proactive threat hunting
  • Investigates endpoint, network, cloud and identity telemetry
  • Managed response with Cortex incident, KPI and action views

• Where it doesn't

  • The buying process is sales-led and requires a discovery call
  • Its operating model is centered on Cortex XDR telemetry
  • May be more than needed for teams seeking narrow security coverage

Our verdict on Unit 42 MDR

Unit 42 MDR is Palo Alto Networks’ managed cybersecurity service for organizations that need continuous security operations coverage without building or expanding a full in-house SOC. It combines 24/7 threat monitoring and triage with proactive threat hunting, AI-powered threat detection, behavioral analytics, cross-environment investigation, managed response and remediation, and threat and impact reporting. Unit 42 analysts work as an extension of an organization’s security operations team, making the service a fit for teams that need ongoing detection and coordinated response across a broad security environment.

Its strongest technical fit is with organizations already centered on the Cortex ecosystem. The service uses Cortex XDR telemetry from endpoints, networks, cloud environments and identity sources, while the Cortex-integrated console provides incident, KPI and action views. This gives security teams a common operating view across multiple telemetry domains rather than a service focused only on endpoint alerts. AI-assisted detection and behavioral analytics add another layer to monitoring and investigation, while proactive hunting supports work beyond automatically generated detections.

Unit 42 MDR is most appropriate for organizations prioritizing continuous coverage, coordinated response and access to managed security operations. The service is sold through a discovery call, so evaluation is structured around the organization’s environment rather than a self-serve purchase. Its Cortex-centered model may be less suitable for teams seeking a standalone service built around a different security stack, or for organizations that only need a narrow point solution. Buyers should choose it when cross-environment investigation and managed remediation are central requirements, and look elsewhere when independent platform coverage or a smaller operational scope matters more.

Your product? Our editors can test Unit 42 MDR in depth and publish a review, labelled as paid · from $149/mo →

Unit 42 MDR pricing

Unit 42 MDR fact sheet

Unit 42 MDR integrations

Unit 42 MDR lists 2 integrations on its own site.

• Cortex XDR
• Cortex console

Alternatives to Unit 42 MDR

• eSentire MDRBroad MDR coverage for enterprises needing continuous monitoring, hunting, and coordinated response.9.4
• Arctic Wolf Managed Detection and ResponseA broad MDR service for enterprises that need continuous monitoring and coordinated response.9.3
• Red Canary MDRInvestigation-led MDR with 24/7 coverage, coordinated response, and broad telemetry analysis.9.2

See all Unit 42 MDR alternatives →

Featured on iTechGuides

Unit 42 MDR is listed in our Managed Detection and Response Services directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/unit-42-mdr/"><img src="https://www.itechguides.com/best/badge/unit-42-mdr.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 7 Oct 2026 · How we research and update