AI Governance & Security Vendor Wiki

6 min read

eSentire

Primary category: ai-soc-analysts.

One-liner — A Canadian managed detection and response (MDR) provider, owned by Warburg Pincus since 2017. It runs a 24/7 SOC on its own Atlas platform, which now does much of the alert investigation with LLM agents. In 2026 it added a module that monitors a customer’s own AI usage.

What it does — eSentire sells MDR as a service: 24/7 monitoring, threat hunting, and hands-on response (host isolation, account actions) across endpoint, network, log, identity and cloud signals. Packages include All-in-One MDR, MDR for Microsoft and MDR for AWS. Also on offer: digital forensics and incident response, and Atlas Preempt (autonomous pen testing / continuous exposure management). Atlas is the platform behind the service. It takes signals from “any vendor stack” (300+ integrations, vendor figure), and customers use the Atlas Operations Center to see SOC investigations. Logs are one signal type within MDR. No standalone SIEM product was found on its site, so it is not cross-listed in siem-soc.

What AI it claims (vendor marketing). eSentire is more specific than most MDRs here:

  • Its site describes “Controlled Autonomy SecOps” and adaptive “AI Operatives” (agents), and claims “95% Tier-3 Analyst Validation Alignment”.
  • An Anthropic customer story (co-marketing) says Atlas runs multi-agent autonomous investigations on Claude Opus 4.6 via Amazon Bedrock and the Claude Agent SDK. Per that story: about 44 tool calls and about 6 minutes per investigation, 120,000+ investigations in 12 months, and over 90% agreement with senior experts’ verdicts across 500+ adjudicated cases. Senior analysts still review and act on every critical finding.
  • Atlas AIDR (GA, announced 2026-09-29) came from buying an unnamed stealth-mode AI-security startup (price undisclosed). It gives the customer a record of their own AI use: conversation timelines, tool calls, and inventories of agents, models, providers and MCP servers. It adds prompt-injection screening, redaction of personal data before it reaches a model, custom rules, and alerts when an MCP server’s tool descriptions change.

All of these figures are vendor-reported and not independently verified.

Naming / provenance — Founded 2001. Earlier based in Cambridge, Ontario, then moved its HQ to Waterloo, Ontario. Platform branding has moved from “Atlas XDR” (2022) to “Atlas”. Acquired CyFIR (digital forensics) in 2021. CEO since March 2026: James C. Foster, who founded ZeroFox and took it public. He succeeded Kerry Bailey (CEO from 2018), who retired.

Ownership & viability — pe-owned. Warburg Pincus bought a majority stake in 2017. In February 2022, Georgian and CDPQ led a $325M deal, largely a purchase of existing shares, at a valuation above $1B, and Warburg stayed majority holder. On 2024-08-13 Reuters reported that the owners were exploring a sale at about $1B including debt, with Evercore advising and ARR of about $150M. No completed sale was found through 2026-10-24. The 2026 CEO change and the AIDR acquisition suggest the owners are investing to grow rather than selling right away. A sale to a larger security or PE platform remains a live possibility, so customers should check contract-assignment and price-protection terms.

Positioning & differentiators —

  • Publishes how its AI works. Most MDRs (e.g. blackpoint-cyber, adlumin) say “AI-enhanced” without detail. eSentire names its model stack and publishes investigation metrics, which is the closest any MDR here gets to the AI-SOC software vendors (dropzone-ai, prophet-security). It still sells an outcome, not software you run.
  • Vendor-agnostic, unlike Microsoft-centred MDRs. Atlas works across stacks. Compare bluevoyant, which is built around Microsoft, and crowdstrike Falcon Complete, which runs on CrowdStrike’s own stack.
  • Visibility into your AI. Atlas AIDR monitors the customer’s own AI agents and MCP use. That is unusual for an MDR and overlaps with dedicated AI-usage monitoring tools, so expect overlap if you already run one.
  • Versus reliaquest: both sell AI-agent-assisted SOC outcomes. ReliaQuest is larger (>$300M ARR) and markets itself as a platform. eSentire markets itself as MDR.

Who should choose them / anti-fit — Fits a mid-sized fund or asset manager with a mixed tool estate and no 24/7 SOC that wants managed response and some insight into how the AI triages. Finance, insurance and private equity are listed industries. Anti-fit: a firm that wants to own and tune detection in its own SIEM and only buy software. Also an all-Microsoft shop where E5 plus a Microsoft-focused MSSP is cheaper.

Known weaknesses / gotchas — Survey write-in (2026-10): written into Q47 AI SOC by 1 respondent, in production. Ownership has been in play since the 2024 sale exploration. AI performance metrics come from the vendor and from Anthropic co-marketing. Customer telemetry is processed by a third-party LLM (Claude on Bedrock), so confirm the data-processing, residency and no-training terms. The AIDR startup’s name and team size are undisclosed.

Deployment & data handling — SaaS platform plus eSentire sensors/agents and API integrations. Telemetry goes to eSentire’s SOC and cloud (data_leaves_tenancy: true), and investigation data is processed by Claude via Amazon Bedrock. Retention, residency (it has North America, EMEA and APAC operations) and training-use terms are unverified. Atlas AIDR captures AI conversation content, so ask where those transcripts are stored and for how long.

Integrations & partnerships — 300+ integrations (vendor). Microsoft and AWS MDR packages. AWS/Bedrock for LLMs. AIDR inventories MCP servers, but eSentire’s own MCP support is unverified (mcp_support: unverified). Sold direct and via partners (AIDR availability mentions “customers and partners”).

Compliance & FS traction — Finance and private equity are listed target industries (fs_traction: claimed). No named hedge-fund customers found. Certifications not checked. Claims >2,000 customers in 80+ countries.

Commercial — Not public. Packaged MDR subscriptions.

Open questions

  • Whether the 2024 sale process concluded; current cap table.
  • SOC 2 / ISO 27001; data residency and LLM no-training terms for telemetry sent to Bedrock.
  • Name of the AIDR startup acquired (2026-09); price.
  • Whether a log-retention / SIEM-like offering exists (would justify a siem-soc cross-list).

Sources

History

  • [2026-10-24] Page created and researched. Added because of an Oct-2026 CTO survey write-in under Q47 AI SOC (1 respondent, in production). Primary ai-soc-analysts. No siem-soc cross-list (no standalone SIEM/log platform found).

Graph View

Backlinks