01 ·
Valid accounts
T1078, credentials stolen via helpdesk vishing, MFA bypass through push-bombing. No malware, no signature: just one extra operator with the right credentials.
Managed Detection & Response services Containment in minutes, not weeks.
Fortgale delivers a threat intelligence-driven Managed Detection and Response service, operated by a European SOC active 24·7·365. The service integrates with the security platform your organisation already uses, with no vendor lock-in. The techniques of 287 hostile tools and actors targeting European organisations are translated into detection rules before the attack reaches your infrastructure. Artificial intelligence, built into the detection and response cycle, filters and correlates alerts: our analysts focus on real threats and retain control over every response decision. The result is median containment <30 min from confirmed alert and active defence from the first days of onboarding.
Compliance
ISO/IEC 27001
NIS2 ready
DORA aligned
GDPR · ENISA
European SOC
24·7·365
L2 / L3 in Europe
Decision authority
EU data residency
Managed Detection & Response · the service
Managed detection and response services: what you get.
Fortgale MDR is a managed security service: European analysts watch your telemetry around the clock, validate every alert and contain the attack on your behalf. If you need the basics first, read what MDR security is and how it works. The service is vendor-agnostic and runs on the platform you already use. The proprietary CTI behind it tracks 287 adversary groups and attack tools: that intelligence inside the defence lifecycle is what we call MDIR, Managed Detection, Intelligence and Response.
What is included in the Fortgale MDR service
- 24·7·365 monitoring from a European SOC, with L2 / L3 analysts and decision authority.
- Triage and alert validation: noise reduction >90% at day 30, so only real incidents reach you.
- Intel-driven detection and threat hunting, mapped to MITRE ATT&CK and fed by 287 profiled tools and actors.
- Investigation and remote containment: median detection <15 min, median containment <30 min from confirmed alert.
- Remediation guidance and, when needed, escalation to incident response.
- Defence Map, monthly reporting and the evidence you need for NIS2, DORA and ISO/IEC 27001 audits.
MDR vs MSSP vs EDR / XDR vs in-house SOC
| Model | Who operates | Who responds | Coverage |
|---|---|---|---|
| Fortgale MDR | Analysts in a European SOC 24·7·365 | Yes: they contain on your behalf | Endpoint, identity, cloud, network |
| MSSP | Provider staff, often device management | Usually notification, you act | Devices and logs it manages |
| EDR / XDR alone | Your team | Only if your team is awake and available | The vendor telemetry |
| In-house SOC | Your hires, in shifts | Yes, if staffed around the clock | What you build and maintain |
The full technical comparison is in MDR vs EDR vs XDR; the economics of staffing every shift yourself are in managed SOC vs in-house, and the difference from a monitoring-only SOC in why MDR is more than a SOC.
How to choose an MDR provider
- Response authority: does the provider contain the threat, or only send you an alert at 3 a.m.?
- Measured times: ask for median detection and containment, not generic SLAs.
- Vendor-agnostic stack: MDR on Microsoft Defender, CrowdStrike Falcon, SentinelOne and the platforms you already pay for.
- Analyst location and data residency: European SOC, EU data residency.
- Threat intelligence depth: own research on real adversaries, not only vendor feeds.
- Onboarding time, reporting and compliance support: defence active within days, NIS2 and DORA evidence ready.
- Exit and data ownership: your telemetry and your platform stay yours.
MDR service activation · defence active from day one
MDR service activation: defence active from day one.
No endless projects, no six-month discovery. Five verified steps reduced to the minimum viable for your stack. Access and security monitoring go live within the first days of onboarding: defence is operational from day one, and the first real alert is contained in <30 min, with detection mapped to MITRE ATT&CK against the TTPs of 287 profiled tools and actors. By Week 3: full platform access, Fortgale Console provisioning, L2/L3 analyst federation, service at full capacity with the European SOC running H24. From that moment on, monthly threat briefings, quarterly tabletop exercises, and runbooks kept alive against your posture. Protection is not a go-live event · it's a property that grows from day 1 of integration.
- Day 001Discovery
First meeting · NDA · stack & probable adversaries mapping
- First days02Onboarding
Telemetry connectors · access and monitoring live within days
Monitoring live - Week 303Provisioning
Fortgale Console tenant · CISO/IT access
- Week 304Federation
Fortgale analysts on customer platforms
- Week 305Full protection
SOC 24·7 · <30 min containment · European defence outpost
The problem · why intel-driven MDR is required
Why a managed detection and response service: signatures aren't enough, and never were.
Across European high-tier incidents in Q1 2026, valid accounts (T1078) and phishing (T1566) drive most initial access, before any malware-based detection fires. Source: ENISA Threat Landscape · MITRE ATT&CK telemetry.
02 ·
Zero-day
T1190, exploits of file transfer, VPN, identity broker. Actors like Cl0p acquire 0-days on criminal markets and use them in targeted campaigns before CVEs are issued.
03 ·
Multi-domain
Endpoint, identity, cloud, network, lateral movement shifts the target before a single-telemetry SIEM can correlate. You need multi-domain AI correlation, not silo alerts.
How it works · service architecture
How Managed Detection & Response works: four building blocks, one single cycle.
From the first alert to containment, all under a single point of contact. No vendor handovers, no translation, no grey zone.
01 ·
Multi-domain ingestion
EDR · NDR · IDR · CDR, telemetry from endpoint, network, identity and cloud, normalised into a single data fabric. On the identity plane the service runs as ITDR on Active Directory, Entra ID and Okta. Vendor-agnostic: we adapt to the stack you already have.
02 ·
Tier-zero AI-native
Multi-domain AI correlation against the TTPs of 287 tools and actors profiled by our Cyber Threat Intelligence. >90% noise reduction. Only what merits the human analyst leaves tier-zero.
How AI works in the defence cycle: read the guide.
03 ·
Our L2/L3 analysts
European SOC, analysts with decision authority. Triage, investigation, attribution to the threat actor. Embedded in your regulatory environment, time zone, language and compliance context included.
04 ·
Response & containment
Median containment <30 min from confirmed alert. Assisted remote response: process kill, credential reset, network segmentation on demand. For major incidents, escalation to the Incident Response team.
Defence Map · included in the MDR
Defence Map: the map of your defence, included in the MDR
The Defence Map is a Fortgale Defence Platform feature included in MDR Tier 1 and Tier 2, with no additional price list line. It is the map of your infrastructure and shows where the defence covers and where it does not.
- Drawn in the portal or imported from draw.io.
- Organises the infrastructure into zones.
- Highlights components without EDR.
- Highlights zones without a sensor.
- Flags systems that do not send logs to the SIEM.
- Exports to PNG, JSON and CSV.
- No automatic discovery: the customer fills in the map together with Fortgale analysts.
Deliverable: dashboard in the Fortgale Defence Platform.
Proof · service metrics
Four numbers that anchor the MDR.
Metrics measured on real customer telemetry in Q1 2026. Updated quarterly.
<30 min
Median containment
from confirmed alert
from confirmed alert
>90 %
Noise reduced
by tier-zero AI
by tier-zero AI
14
MITRE ATT&CK
tactics covered
tactics covered
287
Adversaries profiled
and blocked
and blocked
Supported technologies
MDR on 10 leading platforms · one single console.
Fortgale runs your MDR service on the platform you use (or selects the optimal one with you). For each platform · a dedicated page with technical detail, observed threat intelligence and proprietary runbooks.
- Microsoft Defender XDRIdentity + M365 + Endpoint
- CrowdStrike FalconEndpoint EDR/XDR cloud-native
- SentinelOne SingularityAutonomous response + Storyline
- Elastic SecurityOpen SIEM + XDR ownership rules
- Cortex XDR · Palo AltoXDR + NGFW unified telemetry
- DarktraceSelf-Learning AI · NDR + Antigena
- Splunk Enterprise SecuritySIEM + SOAR · Risk-Based Alerting
- Sumo LogicCloud SIEM · AWS/Azure/GCP/K8s
- Trend Vision OneEmail + Endpoint + Cloud unified
- Vectra AI PlatformNDR + ITDR · network + identity
For whom · two angles
Same MDR, two angles.
The CISO decides on risk. The IT lead decides on the runbook. Fortgale MDR produces evidence for both.
For the CISO
A named runbook per actor, ready before the alert.
Ransomware is not a question of "if" but of "when". Each month the CISO receives the profile of the 3 most probable adversaries against their sector, with the Fortgale runbook already mapped to each one.
- Monthly threat briefingActors, observed TTPs, campaigns active in your sector.
- Runbook per actorLiving playbooks mapped on MITRE, updated against the adversary.
- Board-ready reportingRisk · impact · decision. No technology slides.
For the IT lead
Zero translator handover. European analysts, immediate decision.
When the alert is real, decision time is containment time. Our L2/L3 analysts know your stack, share your time zone and regulatory context, and have decision authority.
- Median containment <30 minFrom confirmed alert to remediation in production.
- Assisted remote responseProcess kill, credential reset, network segmentation on demand.
- Integration with existing stackVendor-agnostic · we adapt to the stack you already run in production.
Research · the foundation of MDR runbooks
Our MDR runbooks come from first-hand research.
When an MDR alert is confirmed, the runbook we execute has already been tested against the real adversary. We profile actors, analyse samples, track TTPs: this research becomes operational action in production, not shelfware.
MacSync: when the victim types the attack chain
No exploit. No attachment. No phishing email. In this campaign the threat actor needs the victim to do exactly one thing: copy a command from an installation guide and paste it i…
Read article →
Kali365: when the session becomes the new credential
ABSTRACT The FBI recently issued an advisory on Kali365, a Phishing-as-a-Service platform that abuses legitimate Microsoft OAuth flows to bypass multi-factor authentication. Kali…
Read article →
Phishing Kits Bypass MFA and Hijack companies's accounts in minutes
Intelligence · Phishing Kit · Q1 2026 April 24, 2026Fortgale CTI14 min readRPT-26-0424 Observation of the quarter The 2026 phishing ecosystem has outpaced traditional defenses. M…
Read article →
Investment-Targeted Phishing: How Phishing Kit Fuels Espionage in Funding Rounds
In the high-stakes world of venture capital and corporate funding, where millions hang in the balance and sensitive financial data flows freely, a new breed of cyber threat is em…
Read article →
Operation Storming Tide: A massive multi-stage intrusion campaign
In February 2026, the Fortgale Incident Response team investigated a multi-stage intrusion attributed to Mora_001, a Russian-origin threat actor exploiting Fortinet vulnerabiliti…
Read article →
Behind the Wheel: Unveiling the Supercar Phishing Kit Targeting Microsoft 365
UPDATES: 27.11.2024: As mentioned by TrustWave, "Supercar Phishing Kit" has an high level of overlapping with the most recent update of "Rockstar 2FA Phishing-as-a-Service" 26.09…
Read article →FAQ · frequently asked
What to know about an MDR service.
What is included in a managed detection and response service?
24·7·365 monitoring from a European SOC, alert triage and validation, intel-driven detection and threat hunting mapped to MITRE ATT&CK, investigation, remote containment (median <30 min from confirmed alert), remediation guidance, the Defence Map and monthly reporting. For the basics, see what MDR security is.
How much do managed detection and response services cost?
The price depends on scope (endpoints, identities and data sources covered), on the service level and on optional add-ons. Fortgale prepares a written quote after the Discovery meeting; you can start from the quote request. Compared with an in-house SOC, MDR avoids hiring and retaining enough analysts to cover every shift: the math is in managed SOC vs in-house.
What is the difference between MDR and MSSP?
An MSSP typically manages security devices and forwards alerts, leaving the response to you. MDR takes on detection, investigation and containment: Fortgale analysts have the authority to act, not just to notify. The full comparison with EDR and XDR is in MDR vs EDR vs XDR.
Does an MDR provider actually respond to threats or only send alerts?
It depends on the provider, so ask. Fortgale analysts contain on your behalf: they isolate hosts, revoke sessions and block accounts according to the agreed runbooks, with median containment <30 min from confirmed alert.
Who needs managed detection and response?
Organisations without a 24·7 security team, lean IT teams that cannot watch alerts at night, companies in regulated sectors under NIS2 or DORA, and those coming out of an incident who need continuous coverage quickly.
What is the difference between MDR and a SOC?
The SOC is the structure that monitors; MDR is the service that, on top of the SOC, adds intel-driven detection and above all response: analysts have authority to decide and contain, not just to notify. In the Fortgale model the managed SOC and MDR are the same European outpost, with no handover between providers.
Is Fortgale MDR NIS2-ready?
Yes. The service is NIS2-ready: continuous monitoring, documented detection, IOC collection for the national CSIRT notification within 24 hours and the technical documentation for follow-up filings, aligned with ISO/IEC 27001, DORA and GDPR Art. 32.
How long does it take to activate the service?
Defence is active from day one: access and security monitoring go live within the first days of onboarding. Within three weeks from NDA, platform access is complete and the service is at full capacity. Five steps: Discovery, Onboarding, Provisioning, Federation, Full protection. No go-live event: protection grows from day 1.
Does it work with the security stack I already have?
Yes, the service is vendor-agnostic: it integrates on the platform you already use, or selects an optimal one with you. Fortgale runs MDR on Microsoft Defender, CrowdStrike Falcon, SentinelOne and 7 other leading platforms, all under a single console.
Real case · containment
In Operation Storming Tide the Fortgale team detected and contained a multi-stage intrusion (actor Mora_001) at a European logistics organisation: data exfiltration and ransomware prevented.
Read the analysis →Real case · MDR
An AiTM attack against senior executives during an investment round was intercepted before compromise. No access was gained.
Read the case →By the Fortgale Cyber Threat Intelligence team
Over 100 published analyses. Attributions corroborated by third parties such as Mandiant (Google), Amazon, SentinelOne and Huntress. European SOC, 24·7·365.
What is MDR → · Why MDR is more than a SOC → · MDR vs EDR vs XDR → · From MDR to MDIR →
Speak with the defence outpost
One meeting. One NDA. A real runbook on your stack.
We bring the Report on your sector with the most probable adversaries and a real MDR runbook mapped to your technology stack.