Socura

What Socura does

Socura is a UK-based Managed Detection and Response (MDR) services provider founded in September 2019 in Cardiff, Wales, by Andrew Kays (CEO) and Jamie Brummell (CTO). It delivers 24/7 threat detection and proactive incident response to UK enterprises and public sector bodies — primarily NHS Trusts, local councils, central government departments, and regulated private companies across financial services, industrial, and cultural sectors — combining a security-cleared, fully remote UK analyst team with an integrated SIEM, NDR, EDR, SOAR and XDR technology stack spanning AWS, Azure and GCP environments.

The platform centres on three proprietary or uniquely-integrated components. The Detection Rule Automation Engine (DRAE), a UK patent-pending technology, automates deployment and lifecycle management of SIEM detection rules across customer estates. SOAR playbooks, built on Palo Alto Networks XSOAR, execute automated containment actions such as quarantining files, terminating processes, suspending accounts and blocking command-and-control traffic. An Incident Management Portal gives client security teams a real-time dashboard and direct analyst collaboration channel for tracking active incidents and posture.

Socura sells on an annual subscription basis, priced per active IT user and the security data sources monitored, with optional add-on licensing for SIEM/EDR controls, penetration testing, red teaming, digital forensics and dark web monitoring delivered via partners (notably Thomas Murray for incident response). Go-to-market is direct enterprise sales augmented by public-sector frameworks, including CymruSOC, the UK’s first national SOC, where Socura is the delivery partner to the Welsh Government for 21+ local authorities and fire & rescue services. The company is privately held, headquartered in Cardiff, has 11–50 employees, holds CREST, ISO 27001, ISO 9001, Cyber Essentials Plus and NHS DSPT 'Standards Exceeded' certifications, and was ranked #78 globally on the MSSP Alert Top 250 in 2025 — its fourth consecutive year on the list.

Name

Socura

Legal name

Socura Limited

Website

https://socura.co.uk

Company type

Private

Founded year

2019

Operating status

Operating

Headcount range

11–50 employees

Short description

Socura is a UK-based Managed Detection and Response (MDR) provider delivering 24/7 proactive threat detection and incident response to UK public sector bodies — including NHS Trusts, local councils via CymruSOC, and central government — and regulated private enterprises, using cloud-native SIEM/NDR/EDR/SOAR technologies and proprietary automation.

Ownership category

akta.pro rank

Product category

Managed Security Services

NAICS

Other Computer Related Services (541519), Computer Facilities Management Services (541513)

SIC

Services-Computer Programming, Data Processing, Etc. (7370)

akta.pro primary industry

Managed Detection & Response (MDR) (BPAEADAA)

akta.pro secondary industries

Managed Detection & Response (MDR) & SOC Services (HDADAGAG), Security Operations Center (SOC) as a Service (BPAEADAB)

Keywords

• Managed detection response
• Cybersecurity services
• Threat detection response
• Security operations centre
• Incident response services

Headquarters

HQ city

Cardiff

HQ country

United Kingdom

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales, Infrastructure

Revenue model

1. Managed Detection and Response (MDR) Subscription: Subscription-based MDR service with annual pricing model. Primarily determined by number of active IT users within an organization and specific security data sources requiring monitoring. Additional costs for licensing of controls such as SIEM and/or EDR solutions where applicable.

Pricing tiers

Go-to-market motion2 records

Distribution channels2 records

Marketing channels6 records

Core offering

Socura provides 24/7 Managed Detection and Response (MDR) services combining a UK-based, security-cleared remote Security Operations Centre with integrated SIEM, NDR, EDR and SOAR technologies and the proprietary Detection Rule Automation Engine (DRAE). The service proactively detects, contains, and disrupts cyber threats on behalf of clients across networks, endpoints and cloud platforms, delivered as an annual subscription priced by active IT users and monitored data sources.

Product overview

Socura is a Managed Detection and Response (MDR) services provider offering a unified cybersecurity service platform. The core offering is Socura MDR — a 24/7 managed security service combining UK-based SOC expertise, best-in-class detection and response technology (SIEM, NDR, EDR, SOAR), and integrated threat intelligence. The platform is augmented by the proprietary Detection Rule Automation Engine (DRAE — patent pending) for streamlined detection rule management, and the Incident Management Portal for real-time incident collaboration. Additional add-on modules include Threat Exposure Management (dark web monitoring), penetration testing, red teaming, and digital forensics (delivered via partners). CymruSOC represents a landmark public-sector initiative — a national SOC for Wales — delivered as a sub-brand of Socura MDR, protecting over 21 public sector bodies under a collective defence model.

Differentiator

Problem solved

Functional benefit

Products and services

• Managed Detection and Response (MDR) Core 24/7 managed detection and response service combining a UK-based, security-cleared remote SOC with integrated SIEM, NDR, EDR and SOAR technologies and threat intelligence. Acts as a seamless extension of the customer's security team, proactively identifying, containing and disrupting attacks on networks, endpoints and cloud workloads. Sold as an annual subscription priced by active IT users and monitored data sources.
• Detection Rule Automation Engine (DRAE) Proprietary Socura technology that automates deployment and maintenance of SIEM detection rules across customer environments, with full change history for audit and compliance. UK patent application pending. Sold as part of and a differentiator within Socura's MDR platform.
• CymruSOC (Wales National Security Operations Centre) Wales' National Security Operations Centre delivered by Socura as a pioneering collective-defence MDR service for the UK public sector, providing 24/7 threat detection and response to over 21 local authorities and fire and rescue services across Wales.
• Penetration Testing Penetration testing service delivered via a Socura partner that tests the security of customer systems and applications from the perspective of an ethical hacker.
• Red Teaming Exercises Objective-based red team assessments delivered via a Socura partner to test customer detection controls and incident response processes against simulated adversaries.
• Digital Forensics and Incident Response Retainer

Quantifiable outcome

• 96% of incidents handled without customer escalation
• +3 more outcomes

Named customers8 records

Segments6 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration9 records

AI capability6 records

Feature3 records

Partnerships

Nine partnerships are on record, tiered minor, strategic, core and flagship.

• FinTech WalesminorGTM or Marketing Partner · 6 November 2025Joined FinTech Wales as member to deepen understanding of fintech sector challenges and collaborate on solutions. Andrew Kays, CEO, stated commitment to sharing cybersecurity expertise with Welsh fintech community.
• Thomas MurraystrategicStrategic or Co-development Partner · 5 December 2024Strategic partnership providing Socura clients access to Thomas Murray's Incident Response Retainer services including 24/7 incident support, digital forensics, response planning, legal and regulatory support, dark web monitoring, pen testing, red teaming, and cyber awareness training. Thomas Murray clients receive MDR services from Socura for post-incident recovery.
• CRESTcoreTechnology or Integration · 1 January 2021CREST member since 2021 holding accreditation for SOC validating MDR service delivery meets rigorous standards in operational effectiveness, staff competence, threat intelligence integration, and incident response. Founding signatory of CREST AI Charter.
• Palo Alto NetworkscoreTechnology or Integration · 1 January 2019Technology partner since founding in 2019. Socura leverages Palo Alto Networks solutions for detection and response capabilities. Awarded Technical Partner of the Year 2024 by Exclusive Networks and Palo Alto Networks for innovative use of their technology.
• Exclusive NetworkscoreChannel Partner/ Reseller/ DistributorGlobal distributor and partner that awarded Socura Technical Partner of the Year 2024 alongside Palo Alto Networks recognition.
• Google CloudstrategicTechnology or IntegrationPartnership with Google Cloud to augment human expertise in security operations with AI and automation. Joint speaker presence at events.
• SocitmminorGTM or Marketing PartnerPartnership with UK society for IT professionals in public sector. Socura exhibited and presented at Socitm President's Conference 2026. Conducted joint webinars on modernizing threat detection in local government.
• Welsh GovernmentflagshipStrategic or Co-development PartnerDelivery partner for CymruSOC, Wales' National Security Operations Centre - the UK's first national SOC. Contract to deliver MDR to 21+ local authorities and fire and rescue services across Wales. CymruSOC awarded Project of the Year 2024 at Computing Security Awards.
• NHS EnglandcoreStrategic or Co-development PartnerSocura signed NHS Cyber Security Charter committing to robust security practices including continuous patching, MFA, 24/7 logging and monitoring, and incident response planning. Complies with NHS Data Security and Protection Toolkit (DSPT) at 'Standards Exceeded' rating.

Scale indicators6 records

Recent moves6 records

Expansion highlights5 records

Direct peers

• eSentire: Pure-play MDR provider offering 24/7 threat detection and response across SIEM, EDR, NDR and cloud. Closely aligned business model and customer base to Socura, with broader global reach.
• Arctic Wolf: Large MDR-focused vendor delivering 24/7 managed detection and response via a concierge delivery model. Competes head-to-head in UK mid-market and enterprise security operations outsourcing.
• Expel: MDR provider known for transparency-driven service delivery and SOAR-based automation. Targets similar mid-market and enterprise customers seeking outsourced SOC capabilities.
• Huntress: Managed detection and response specialist with a focus on SMB and mid-market customers. Competes in adjacent tier of outsourced security operations with similar 24/7 SOC delivery.
• PureCyber: UK-based MDR provider serving mid-market and enterprise customers. Comparable size and customer profile to Socura; previously employed Socura's current CRO, indicating direct competitive overlap.

Broad incumbents

• CrowdStrike: Falcon Complete delivers bundled MDR on top of the CrowdStrike Falcon platform. As a broad incumbent, it competes with Socura in enterprise SOC outsourcing while also offering the underlying EDR/XDR technology Socura integrates.
• Sophos: Sophos MDR is a flagship managed service from the broader endpoint and network security vendor. Competes with Socura across mid-market and enterprise customers, often as part of a bundled platform deal.
• WithSecure: European-headquartered cybersecurity vendor offering managed detection and response as part of a broader portfolio. Comparable service offering to Socura with deeper European geographic reach.

Regional players

• Bridewell: UK-headquartered cybersecurity services firm providing managed SOC, MDR, and consulting across multiple sectors including critical national infrastructure. Most direct UK-based peer to Socura's mid-market and regulated-customer focus.
• Adarma: UK-focused managed security services provider delivering SOC, MDR, and threat intelligence to enterprise customers. Directly comparable UK competitor with similar service portfolio and target segments.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights7 records

Customer concentration

• LinkedInlinkedin.com/company/socura-mdr/?originalSubdomain=uk

Compliance5 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles8 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Socura