What Ontinue does

Ontinue is a privately held managed security services provider that delivers AI-powered Managed Extended Detection and Response (MXDR) exclusively to organizations using the Microsoft Security stack. Founded in 2004 (with the AI-led MXDR service launched in 2023), the company is headquartered in Redwood City, California with a newly opened European headquarters in Zurich, Switzerland, and operates seven offices across North America, Europe, and Asia-Pacific. Its core offering, ION MXDR, combines the cloud-native ION platform, the ION Cyber Defense Center (five globally distributed SOCs operating in a follow-the-sun model), and ION IQ, a proprietary agentic AI that builds deep contextual understanding of each customer environment and autonomously investigates incidents before human review. The portfolio includes add-on modules for enhanced phishing protection, managed vulnerability mitigation, and IoT/OT security, plus consulting services for Microsoft Security deployment.

The company generates revenue through annual subscription contracts for its MXDR service and add-on modules, with professional services and Microsoft-funded workshops as supplementary streams. Pricing is quote-based and not publicly disclosed, structured around customer environment complexity and Microsoft tool utilization. Ontinue sells primarily through direct enterprise field sales led by a newly appointed CRO, complemented by a channel partner program for MSSPs and co-selling leverage through Microsoft's partner ecosystem (MISA membership, Threat Protection and Cloud Security Specializations). The customer base spans financial services, healthcare, manufacturing, legal, high tech, retail, education, energy, hospitality, telecommunications, and a notable concentration serving nearly half of all UN organizations globally, with named customers including BBC Group, DO&CO, Ottobock, Vossloh AG, Franke, Burckhardt Compression, ACR, College of Southern Nevada, SmartestEnergy, and the Royal British Legion.

Ontinue's go-to-market is anchored to its Microsoft Security specialization, evidenced by multiple Microsoft Partner of the Year awards (2022 MSSP, 2023 Innovation, 2023 Security Customer Champion Finalist, 2025 Security Trailblazer Finalist), Gartner Cool Vendor status (2024), IDC MarketScape Major Player recognition (2024), Gartner Peer Insights Strong Performer 4.7/5 (2026), and industry awards including Visionary MXDR at RSA 2026 and Most Innovative XDR Platform at the 2026 Cybersecurity Stars Awards. The company employs 251-500 staff and is led by newly appointed CEO Moritz Mann (20+ year veteran, formerly CSO), with Simon Godfrey (ex-Secureworks VP Sales EMEA) as CRO. Notable risks include concentration on a single hyperscaler ecosystem (Microsoft), competition from Microsoft Defender Experts and other Microsoft-native MSSPs, and private-company opacity around revenue, funding, and ownership.

Name

Ontinue

Legal name

Ontinue, Inc.

Website

https://ontinue.com

Company type

Private

Founded year

2004

Operating status

Operating

Headcount range

101–250 employees

Short description

Ontinue provides AI-powered Managed Extended Detection and Response (MXDR) services purpose-built for Microsoft Security customers, combining its proprietary ION platform, ION IQ agentic AI, and five globally distributed Cyber Defense Centers to deliver 24/7 threat detection, investigation, and response.

Ownership category

akta.pro rank

Product category

Managed Extended Detection and Response (MXDR)

NAICS

Other Computer Related Services (541519), Computer Systems Design and Related Services (54151)

SIC

Services-Computer Programming, Data Processing, Etc. (7370), Services-Computer Integrated Systems Design (7373)

akta.pro primary industry

Endpoint Security Managed Services (EDR/XDR) (BPAEADAH)

akta.pro secondary industries

Extended Detection & Response (XDR) (HDADAEAB), OT Threat Detection & Monitoring (NDR/IDS for ICS) (HDADAJAF), Control System Cybersecurity for OT (ICS Security, Monitoring, Hardening) (IMAGABAL)

Keywords

• Managed extended detection response
• Managed security operations
• AI-powered threat detection
• Microsoft security services
• Cloud-native SecOps platform

Headquarters

HQ city

Redwood City

HQ country

United States

HQ region

North America

Offices7 records

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Operations, Infrastructure, Marketing or Sales

Revenue model

1. ION MXDR Service: Core managed extended detection and response (MXDR) subscription service providing 24/7 AI-powered security monitoring, detection, investigation, and response for Microsoft Security customers. Revenue is generated through recurring subscription contracts with customers leveraging Microsoft Defender and Sentinel tools.
2. Add-on Services: Additional revenue streams from ION for Enhanced Phishing Protection, ION for Vulnerability Mitigation (MVM), IoT/OT Security add-on services, and Consulting Services that extend the core MXDR platform.
3. Professional Services: Consulting services including strategy reviews, deployment assistance, and enrichment services for Microsoft Security tools, plus Microsoft-funded workshops delivered by Ontinue security experts.

Pricing tiers

Go-to-market motion3 records

Distribution channels4 records

Marketing channels9 records

Core offering

Ontinue provides AI-powered Managed Extended Detection and Response (MXDR) services built natively on the Microsoft Security stack (Defender, Sentinel, Azure, Teams). The core ION MXDR service delivers 24/7 threat detection, autonomous investigation via ION IQ agentic AI, and human-led response from a distributed Cyber Defense Center. Add-on modules extend coverage to phishing, vulnerability mitigation, and IoT/OT environments, with consulting services supporting Microsoft tool deployment and optimization.

Product overview

Ontinue offers a unified AI-powered MXDR service called ION (Intelligent Operations Network) built specifically for Microsoft Security customers. The core offering consists of the ION MXDR Service, which combines the ION Platform (cloud-native security operations platform), the ION Cyber Defense Center (globally distributed SOC with five locations), and ION IQ (proprietary security AI leveraging Azure OpenAI). The portfolio includes add-on modules: ION for Enhanced Phishing Protection (phishing-specific MDR), ION for Vulnerability Mitigation (prioritized vulnerability management), and ION for IoT Security (OT/IoT threat detection using Microsoft Defender for IoT). An add-on Consulting Services module provides Microsoft security strategy, deployment, and enrichment support. All products integrate natively with Microsoft Sentinel, Microsoft Defender suite, Microsoft Teams, and Microsoft Entra ID.

Differentiator

Problem solved

Functional benefit

Brands

• ION: The company's primary MXDR service platform providing managed extended detection and response built for Microsoft Security customers.
• ION IQ
• Agentic SOC

Products and services

• ION MXDR Service AI-powered Managed Extended Detection and Response (MXDR) service that combines the ION platform, the ION Cyber Defense Center, and ION IQ AI for 24/7 threat detection, autonomous investigation, response, and continuous security posture improvement, built natively for Microsoft Security customers.
• ION Platform Cloud-native MXDR platform built on the Microsoft security product portfolio (Defender, Sentinel, Azure, Teams) providing AI-driven automation, real-time collaboration, and continuous security posture improvement for security operations teams.
• ION Cyber Defense Center Distributed global security operations center service delivered from five locations in a follow-the-sun model, staffed with security analysts, Cyber Advisors, PhD data scientists, automation engineers, threat hunters, threat intelligence researchers, vulnerability managers, and detection engineers providing 24/7 monitoring, response, and advisory coverage.
• ION IQ Proprietary security AI product that builds deep environmental understanding of each customer, uses agentic AI to gather context, form hypotheses, develop action plans, conduct autonomous investigations, and deliver localized natural-language responses powered by Azure OpenAI integration for context-aware security operations.
• ION for Enhanced Phishing Protection Add-on service that extends 24/7 triage, enrichment, investigation, and response to user-reported phishing emails using multi-layer automation and 24/7 expert-led investigation to handle phishing incidents end-to-end.
• ION for Vulnerability Mitigation Managed Vulnerability Mitigation add-on service (formerly Managed Vulnerability Mitigation) that critically evaluates vulnerabilities, assesses threat levels specific to each customer business, identifies highest-risk vulnerabilities, and provides intelligent mitigation recommendations leveraging Microsoft Defender for Endpoint.
• ION for IoT Security Add-on service that extends continuous 24/7 protection to IoT and OT environments using Microsoft Defender for IoT, providing real-time asset discovery, threat detection, investigation, and containment for IoT/OT environments.
• Ontinue Consulting Services End-to-end Microsoft Security consulting offering strategy evaluation, deployment assistance, and enrichment services, including free Microsoft workshops covering Security Strategy Review, Threat Protection, Defender Essentials, and Sentinel Essentials.

Quantifiable outcome

• 99.5% of incidents resolved without customer involvement
• +8 more outcomes

Named customers16 records

Segments11 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration8 records

AI capability9 records

Feature7 records

Partnerships

Five partnerships are on record, tiered minor, supporting, flagship and core.

• CommvaultminorOthers · 13 April 2026Geoff Haydon stepped down as CEO of Ontinue to become President of Customer and Field Operations at Commvault. This personnel transition may lead to future partnership opportunities as Commvault is a data resilience company.
• Channel PartnerssupportingChannel Partner/ Reseller/ Distributor · 1 April 2026Ontinue maintains a partner program including channel partners that resell and distribute their MXDR services. The program supports managed security services providers seeking to deliver Ontinue's ION services to their customer bases.
• Microsoft Tech for Social Impact (TSI)flagshipStrategic or Co-development Partner · 20 April 2024Ontinue works closely with Microsoft's Tech for Social Impact team to maximize cybersecurity benefits for NGO and IGO community. This partnership specifically supports Ontinue's positioning serving nearly half of all UN organizations globally, providing specialized security services for non-profit and humanitarian organizations.
• Microsoft Intelligent Security Association (MISA)coreStrategic or Co-development Partner · 1 July 2023Ontinue is a member of MISA, Microsoft's ecosystem of independent software vendors and managed security service providers that have integrated their solutions with Microsoft Security products. Membership enables co-selling and integration with Microsoft's security portfolio.
• MicrosoftcoreStrategic or Co-development Partner · 1 January 2023Ontinue's ION platform is purpose-built for Microsoft Security stack (Defender, Sentinel, Azure, Teams). As 2023 Microsoft Innovation Partner of the Year and 2022 Microsoft Security MSSP of the Year, Ontinue holds Microsoft Threat Protection and Cloud Security Specializations, and is a member of the Microsoft Intelligent Security Association (MISA). Company leverages Microsoft Copilot for Security and participates in Microsoft-funded workshops and partner programs.

Scale indicators13 records

Recent moves7 records

Expansion highlights6 records

Broad incumbents

• CrowdStrike: Endpoint security leader offering Falcon Complete MDR service as part of broader Falcon platform. Overlaps with Ontinue as MDR provider but as part of a much wider security portfolio; Falcon Complete bundles XDR/MDR with CrowdStrike's own endpoint and identity products.
• SentinelOne: Endpoint security platform offering Vigilance MDR service alongside Singularity XDR platform. Comparable as MDR provider but operates as broad endpoint/XDR incumbent; Purple AI agentic capabilities directly compete with Ontinue's ION IQ.
• Sophos (MDR): Endpoint and network security vendor offering Sophos MDR service, now part of Secureworks acquisition. Comparable as managed detection and response provider but operates as broader security incumbent targeting primarily mid-market customers.
• Palo Alto Networks (Unit 42): Cybersecurity platform company offering Unit 42 MDR service within broader Strata and Cortex portfolio. Directly competes for enterprise MDR budget but as part of a network/firewall-to-cloud platform; Prisma Cloud and Cortex XDR overlap with Ontinue's Microsoft-stack focus.

Direct peers

• Arctic Wolf: Leading MDR provider with concierge security operations model and Aurora platform, serving mid-market and enterprise customers globally. Highly comparable subscription-based managed security model; both compete for the same Microsoft Security customer base though Arctic Wolf is multi-vendor.
• Secureworks: Global MDR/MXDR provider serving mid-market and enterprise customers with 24/7 SOC services. Highly comparable to Ontinue as a managed security services competitor; notably, Ontinue's newly appointed CRO Simon Godfrey joined from Secureworks, indicating direct competitive overlap.
• Expel: MDR provider offering transparent, tech-enabled managed detection and response with Workbench platform. Directly comparable in business model (managed subscription service), target market (mid-market and enterprise), and AI-augmented SOC delivery approach.
• eSentire: Pure-play MDR provider offering 24/7 threat detection, investigation, and response with proprietary Atlas XDR platform. Closely comparable to Ontinue in serving mid-market and enterprise customers with managed services, though eSentire is multi-vendor while Ontinue is Microsoft-focused.
• ReliaQuest: Enterprise-focused MXDR provider with GreyMatter platform offering open XDR across multiple security tools. Closely comparable to Ontinue in serving enterprise customers with managed security operations; multi-vendor approach contrasts with Ontinue's Microsoft-only specialization.

Regional players

• WithSecure: European-headquartered cybersecurity provider offering managed security services including MDR/MXDR. Comparable managed services business model and Microsoft partnership focus; serves similar European enterprise customer base and represents Ontinue's most direct European-headquartered competitor.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat6 records

Key risks5 records

Key highlights7 records

Customer concentration

• Xx.com/ontinuemxdr
• YouTubeyoutube.com/@ontinue
• LinkedInlinkedin.com/company/ontinue
• Facebookfacebook.com/100088512353993

Compliance4 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles5 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Ontinue