eSentire is a managed detection and response (MDR) provider that runs threat detection, investigation and response for organisations that want round-the-clock security operations without building a full SOC of their own. Its analysts and threat hunters work from 24/7 Security Operations Centers on top of the Atlas Platform, which takes in signals from the security tools a customer already owns.
It suits mid-sized and large organisations that cannot staff a round-the-clock team but still need attacks contained in minutes, and that now also want oversight of how their staff and agents use AI.
At A Glance
| Vendor | eSentire |
|---|---|
| Category | Managed detection and response, security operations |
| Deployment | Managed service on the Atlas Platform with 24/7 SOCs |
| Agentic AI | Atlas AI operatives, Atlas AIDR for AI observability and control |
| Customers | More than 2,000 reported organisations across 35+ industries |
| Founded | 2001 |
| Market classification | Security Operations |
What ESentire Does
Attackers increasingly log in with valid credentials rather than break in, which makes detection across many signal sources and fast containment the core of the job. eSentire covers endpoint, network, log and cloud activity around the clock and pairs automated investigation with the judgement of human analysts, who handle what the machines escalate. The Atlas Platform is the shared layer under every service, so one correlated data set drives detection, investigation, response and remediation for each customer, whichever tools it runs.
Products
All-In-One ESentire MDR
The core service for organisations that want one provider watching everything. It draws on more than 300 technology integrations and is delivered by eSentire’s 24/7 SOC, with detection, investigation and response across endpoint, network, log and cloud. Variants focus on Microsoft and AWS estates, and a Response and Remediation service carries incidents through to a fix.
Atlas Platform
Atlas is the technology behind the services, organised into modules including Atlas AI, Atlas Operations Center, Atlas Detect and Atlas Preempt. Adaptive AI operatives on the Atlas Platform expose, detect and neutralise attacks. Deterministic protocols decide which actions run autonomously and which escalate for human approval, so automation stays inside limits the customer can see. Each task-specific agent works at machine speed with its reasoning visible to analysts. Specific components address specific gaps:
| Atlas Response Orchestration | Defines how Atlas responds once a finding is confirmed, with every action logged, reversible and auditable |
|---|---|
| Atlas Email | Built with Sublime Security, it inspects the behaviour and intent of every message |
| Atlas Patch Management | Pushes fixes to affected assets directly from Atlas |
Atlas AIDR
Atlas AIDR is a module within Atlas Detect for organisations that need to see how employees and agents use AI. It shows conversation timelines, tool calls, cost, latency and security events tied to users, teams and workstations, and keeps “a live inventory of agents, models, providers, MCP servers, and tools”. It tracks the external MCP servers that autonomous agents call and flags when a server’s description or behaviour changes. It also finds shadow AI through existing telemetry, redacts personal data before it reaches a model, screens for prompt injection and tracks token spend against budgets.
Threat Response Unit And Services
The Threat Response Unit (TRU) is eSentire’s research team. Alongside it sit Digital Forensics and Incident Response (DFIR) for active breaches, and Atlas Preempt, which provides autonomous penetration testing and continuous threat exposure management for teams that want to find weaknesses before attackers do.
How It Works
eSentire runs its services as a managed offering from its own SOCs.
| Component | What it does |
|---|---|
| Atlas Platform | Connects to signals across vendor stacks and correlates email signals with endpoint, identity and network activity. |
| Security Operations Centers | 24/7 SOCs staffed by threat hunters, including the Waterloo SOC and a US SOC in the greater Washington D.C. area. |
| US data residency | The US SOC runs on a separate Atlas instance in a dedicated US AWS region, with a contractual guarantee that customer data never leaves the United States. |
| Response actions | Under rules the customer sets, Atlas can notify people, isolate hosts and suspend compromised users. |
Company Background
| Founded | 2001; Eldon Sprickerhoff is Founder and Advisor |
|---|---|
| Offices | Waterloo (Canada), Cork (Ireland), Pleasanton (United States) and Ramat Gan (Israel), with security operations capabilities in Canada, Europe, the Middle East and Asia |
| Leadership | James C. Foster (Chief Executive Officer), John Becker (Chairman) |
| Ownership | Warburg Pincus invested in 2017 and remains the majority shareholder |
| Funding | A reported US$325 million raised from Georgian and CDPQ in 2022, at a valuation above US$1 billion |
| Acquisitions | A stealth-mode AI security startup, announced 15 September 2026, whose technology became Atlas AIDR |
| Recognition | Included in the Gartner 2026 Market Guide for Managed Detection and Response |
Note: This overview is compiled from eSentire’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.