Unit 42 Managed XSIAM —
The AI SOC, Managed

Where PAN Wins

• Full AI SOC vs. endpoint-centric MDR: MSIAM is built on Cortex XSIAM — a purpose-built AI SOC platform with 3,000+ AI models for detection, investigation, and response across endpoint, network, identity, and cloud. Falcon Complete is engineered around Falcon EDR telemetry; expanding to network or cloud requires additional modules, additional cost, and doesn't produce a unified AI SOC.
• Machine-speed pre-authorized response: MSIAM's pre-authorized automated workflows execute containment actions across endpoints, firewalls, identity systems, and cloud without waiting for analyst approval. Real-world proof: Oneida Nation achieved MTTR of 43 seconds. Falcon Complete's response automation via Charlotte AI is more analyst-gated and endpoint-constrained.
• Breach Response Guarantee vs. Breach Warranty: MSIAM includes up to 250 hours of Unit 42 IR — no new SOW, no negotiation, no delay. The 250-hour guarantee activates immediately when a breach occurs. CrowdStrike's breach warranty is a financial warranty instrument with coverage conditions — not pre-deployed IR capacity.
• Third-party EDR telemetry: MSIAM accepts native and third-party EDR telemetry including CrowdStrike Falcon, SentinelOne, and others. CrowdStrike Falcon Complete exclusively monitors Falcon telemetry — it cannot monitor a mixed-EDR or competitive environment.
• Continuous detection engineering: MSIAM's Unit 42 team continuously improves detection rules based on real incidents in the managed fleet — detections get smarter over time. Falcon Complete's detection engineering improvements are tied to Falcon product releases rather than managed-fleet learning loops.
• Unit 42 threat intelligence with real IR experience: Unit 42 analysts who staff MSIAM are the same team responding to nation-state breaches globally. Their threat intelligence feeds directly into detection rule tuning. Charlotte AI is a product capability — not the same as having active breach responders tuning detections.

Where They're Strong

• Breach prevention warranty narrative: The financial warranty is a compelling risk-transfer story for buyers focused on cyber insurance and CFO-level risk conversations — even if the mechanics differ from MSIAM's IR hours guarantee.
• Deep Falcon EDR fidelity: In pure Falcon environments, Falcon Complete analysts operate on the deepest possible Falcon telemetry. Detection quality in homogeneous CrowdStrike environments is genuine.
• Brand strength and market momentum: CrowdStrike's MDR brand is exceptionally strong — especially in security teams where Falcon is already entrenched. Incumbent advantage is real.
• Charlotte AI assistant experience: For security teams that want AI-assisted investigation workflows alongside analyst work, Charlotte AI provides a transparent, interactive experience within the Falcon console.

Landmines to Set

• "When Falcon Complete investigates a threat — what network and identity telemetry do their analysts have access to? If you run PAN NGFWs, who is investigating that telemetry?"
• "If a threat actor moves laterally from endpoint to cloud workload to identity, does Falcon Complete scope cover the full attack chain — or does coverage stop at the endpoint boundary?"
• "How does the breach warranty activate in practice? What documentation, conditions, and timelines apply? How does that compare to MSIAM's 250-hour IR guarantee that activates without a new SOW?"
• "Does Falcon Complete have a roadmap for a full AI SOC — not just Charlotte AI assistance, but autonomous AI agents executing detection and response? What does that look like vs. XSIAM's 3,000+ models operating today?"
• "If you ever move off CrowdStrike — can Falcon Complete continue to monitor your environment? MSIAM accepts third-party EDR telemetry including CrowdStrike, so you're never locked into a single endpoint vendor."

Key Objections

Where PAN Wins

• Proprietary AI SOC platform vs. tool aggregation: MSIAM is built on Cortex XSIAM — a purpose-built AI SOC platform with 3,000+ AI models, native UEBA, automated playbooks, and continuous detection engineering. Arctic Wolf's Aurora Platform is a data aggregation and correlation layer on top of customer tooling — it cannot produce the AI-driven detection and response depth of XSIAM.
• Machine-speed automated response: MSIAM pre-authorized workflows execute containment across endpoints, firewalls, identity, and cloud at machine speed. The Green Bay Packers deployment saw 54% more alerts investigated, 120+ analyst hours saved monthly, and response times reduced from hours to minutes. Arctic Wolf's model is human-led — every containment action requires analyst involvement, creating response latency that compounds at scale.
• Unit 42 threat intelligence depth: Unit 42 named-group attribution, real-time threat research, and active incident response experience directly informs MSIAM detections. Arctic Wolf's Concierge teams are skilled analysts but operate without equivalent proprietary threat intelligence or global IR experience.
• Breach Response Guarantee: MSIAM includes 250 hours of Unit 42 IR with no new SOW. Arctic Wolf's IR service is a separate purchase — there is no included IR guarantee with their MDR service.
• Continuous detection engineering: MSIAM detection rules improve over time based on real incidents in the managed fleet — a feedback loop that Arctic Wolf's tool-agnostic model structurally cannot replicate at the same scale or depth.
• XSIAM native scope — endpoint, network, identity, cloud: MSIAM monitors the full attack surface natively. Arctic Wolf's network and cloud monitoring requires sensor deployment and connector configuration — coverage quality depends on what's connected.

Where They're Strong

• Concierge relationship model: Dedicated analysts who know the specific customer environment over time is genuinely valued in mid-market accounts where relationship continuity and named-analyst familiarity drive satisfaction scores.
• Technology-agnostic positioning: "We work with what you have" eliminates the endpoint displacement conversation — powerful for customers resistant to agent change or deeply invested in non-Palo endpoint tools.
• Mid-market pricing accessibility: Arctic Wolf is typically priced more aggressively for mid-market accounts — easier budget conversation for buyers below the enterprise threshold.
• No platform lock-in narrative: Arctic Wolf's vendor-neutrality story resonates with procurement teams and security architects who prioritize optionality.

Landmines to Set

• "Arctic Wolf works with your existing tools — which means detection quality is bounded by those tools. If your current endpoint or SIEM misses a technique, Arctic Wolf misses it too. What is your current endpoint MITRE ATT&CK coverage score?"
• "What is Arctic Wolf's automated containment capability? If a threat is detected at 2 AM, how long until a containment action fires — analyst decision or automated? MSIAM pre-authorized workflows execute in seconds, not minutes."
• "Does Arctic Wolf have an AI SOC platform or a roadmap to one? How do 3,000+ AI models compare to analyst-led triage with tool connectors?"
• "If you ever have a serious breach — what does Arctic Wolf's IR capacity look like? Is there an included IR guarantee, or is that a separate engagement at separate cost?"

Key Objections

Where PAN Wins

• Platform clarity and investment certainty: Cortex XSIAM has committed, public, accelerating investment from Palo Alto Networks — the roadmap is clear. Secureworks-under-Sophos creates real uncertainty: is Taegis the strategic product or Sophos MDR? Customers renewing Taegis ManagedXDR are making a multi-year commitment to an unclear roadmap.
• Full AI SOC vs. AI-assisted XDR: MSIAM operates on XSIAM's 3,000+ AI models with autonomous detection and response workflows. Taegis ManagedXDR is an AI-assisted XDR platform — a meaningful difference in capability and scalability.
• Machine-speed pre-authorized response: MSIAM's pre-authorized workflows execute containment at machine speed. Taegis ManagedXDR's response layer is more analyst-dependent, with AI assisting analyst decision-making rather than executing autonomously.
• Breach Response Guarantee: MSIAM includes 250 hours of Unit 42 IR with no new SOW. Secureworks IR is a separate professional services engagement — not included in the managed service.
• Unit 42 IR brand vs. CTU: Unit 42 is globally recognized for elite incident response at nation-state breach events. CTU is credible threat intelligence — but Unit 42's active breach response reputation is a stronger trust signal for enterprise buyers.
• Third-party EDR flexibility: MSIAM supports CrowdStrike, SentinelOne, and other EDR telemetry sources. Taegis ManagedXDR's telemetry breadth depends on connector coverage and integration completeness.

Where They're Strong

• Legacy enterprise relationships: Long-term Secureworks customers with established CTU and SOC relationships are sticky. The relationship itself is a genuine retention asset that MSIAM must overcome.
• Counter Threat Unit intelligence: CTU is a genuine threat research organization with a long track record of adversary tracking and named threat group attribution.
• Taegis vulnerability management integration: Taegis VDR integration with the managed service creates a broader managed security posture narrative that MSIAM doesn't natively match.

Landmines to Set

• "With Secureworks now under Sophos ownership, what happens to the Taegis platform roadmap in two to three years? Is Taegis the strategic product going forward, or does Sophos MDR absorb it?"
• "When is your Taegis renewal? The platform uncertainty is a real strategic risk — a renewal is a good time to benchmark against MSIAM before committing to another multi-year term."
• "Does Taegis ManagedXDR have a path to an autonomous AI SOC — not AI-assisted response, but AI agents executing autonomously? XSIAM's 3,000+ models are operating that way today."
• "What is your MTTR SLA on Taegis ManagedXDR for containment actions? Is that analyst-dependent, or automated?"

Key Objections

Where PAN Wins

• Proprietary AI SOC platform vs. integration aggregation: MSIAM's XSIAM platform produces detections independently of — and superior to — whatever tools the customer runs. Expel's detection fidelity is bounded by the tools they integrate with. If those tools miss a technique, Expel misses it.
• Unit 42 threat intelligence depth: Unit 42 operates at a level of threat intel depth and attribution fidelity that a pure-play MDR provider like Expel does not maintain independently. Expel uses community threat feeds and customer-connected tool telemetry — not named-group attribution from active global IR operations.
• Machine-speed pre-authorized response: MSIAM's autonomous workflows execute containment across endpoints, firewalls, identity, and cloud without analyst involvement for pre-authorized scenarios. A real example: phishing investigation MTTR dropped 90% — from 40 minutes to 3 minutes. Expel's automation is strong but operates within the constraints of its tool integrations.
• Breach Response Guarantee — IR hours included: 250 hours of Unit 42 IR is included in MSIAM at no additional cost, no new SOW. Expel has no included IR guarantee — major incidents require a separate engagement.
• Continuous detection engineering at platform scale: MSIAM's detection improvements compound over the full managed fleet — not just a single customer's environment. Expel's detection engineering is account-level and integration-dependent.

Where They're Strong

• Workbench transparency model: Expel Workbench provides real-time visibility into every analyst action and decision — a genuine differentiator for security leaders who must justify MDR investment to their board and want operational accountability.
• Documented, aggressive SLAs: Expel's time-to-respond SLAs are clearly documented and frequently cited by customers as a key satisfaction driver. Their track record on SLA adherence is strong.
• Automation-first philosophy: Expel's principle of automating every automatable action before analyst involvement resonates with lean security teams. Their automation layer within tool constraints is genuinely efficient.
• Tech-agnostic sell: Expel's "we work with your existing stack" avoids the displacement conversation and reduces friction with procurement teams resistant to new platform investments.

Landmines to Set

• "Expel integrates with your existing tools — detection quality is bounded by those tools' telemetry and detection rules. What is your current MITRE ATT&CK coverage on your endpoint? If it misses a technique, Expel misses it too."
• "Who is the threat intelligence source behind Expel's detection rules? How does community feed attribution compare to Unit 42's named-group attribution from active global IR operations?"
• "Does Expel have an AI SOC platform or a roadmap to one? Not automation-within-tools — a full AI SOC with 3,000+ models running autonomous detection and response workflows?"
• "If you have a major breach — what does Expel's IR response look like? Is there included IR capacity, or is that a separate cost at breach time when you're least able to negotiate?"

Key Objections

Where PAN Wins

• Purpose-built AI SOC vs. SIEM + partner: MSIAM is a single, integrated AI SOC managed by one accountable team. Microsoft's managed coverage is MSSP-delivered — quality, consistency, and accountability vary by partner. There is no Microsoft-operated AI SOC equivalent to MSIAM.
• Unified accountability: With MSIAM, Palo Alto Networks and Unit 42 are fully accountable for detection and response outcomes. With Microsoft Sentinel + MSSP, accountability is split between Microsoft (platform), the MSSP (operations), and Defender product teams — when something goes wrong, the finger-pointing begins.
• Machine-speed pre-authorized response: MSIAM's autonomous workflows execute containment across the full attack surface. Microsoft's Copilot for Security is an AI assistant for analysts — not an autonomous response platform. MSSPs on Sentinel must build their own automation layer.
• Breach Response Guarantee — 250 hours Unit 42 IR: No Microsoft managed offering includes an IR guarantee from a top-tier IR team. Defender Experts for Hunting is proactive hunting only — not managed SOC and not breach response.
• Non-Azure environment coverage: MSIAM covers multi-cloud and hybrid environments natively including AWS and GCP. Sentinel's best coverage is Azure — non-Azure environments require additional connectors with varying fidelity.
• No MSSP quality variance: MSIAM's quality is the Unit 42 team, period. Microsoft-based managed security quality is the MSSP the customer selected — which could be excellent or average.

Where They're Strong

• E5 licensing bundle economics: Organizations already paying for Microsoft E5 get Sentinel and Defender XDR effectively bundled — the marginal cost for the platform appears low, making the managed service layer seem like an add-on rather than a platform commitment.
• Azure-native environments: For heavily Azure-committed organizations, Sentinel's native integration with Azure AD, Azure workloads, and M365 telemetry is genuinely strong and low-friction.
• Copilot for Security narrative: Microsoft's AI narrative is well-funded and pervasive — Copilot for Security is a strong boardroom conversation even if the product is AI-assisted rather than AI-autonomous.
• M365 telemetry depth: For M365-heavy organizations, Defender for O365 and Defender for Identity telemetry in a Sentinel SIEM is genuinely comprehensive for email and identity threat coverage.

Landmines to Set

• "Who actually runs your SOC in the Microsoft model — Microsoft, or your MSSP? If it's the MSSP, what is your accountability path when there's a breach?"
• "Copilot for Security assists your analysts — who are your analysts? If you're relying on an MSSP, how does their analyst quality compare to Unit 42's breach responders staffing MSIAM?"
• "What does breach response look like in the Microsoft model? Is there an included IR guarantee, or is that a separate engagement at breach time?"
• "What's your AWS and GCP coverage quality in Sentinel today? How does that compare to MSIAM's native multi-cloud telemetry?"

Key Objections

Where PAN Wins

• AI SOC platform vs. managed SIEM layer: MSIAM is built on a purpose-built AI SOC — not a managed layer on top of an existing SIEM. Deepwatch's value is analyst and process quality operating on a SIEM that wasn't designed to be an AI SOC. XSIAM was designed from the ground up for autonomous AI-driven detection and response.
• Machine-speed autonomous response: MSIAM's pre-authorized workflows execute containment at machine speed across endpoints, firewalls, identity, and cloud. Deepwatch's response actions are analyst-driven — the SIEM provides the alert, the Deepwatch analyst decides the response. No autonomous execution layer.
• Unit 42 threat intelligence vs. SIEM-fed intelligence: Unit 42's threat intelligence feeds directly into MSIAM detection rules from active global IR operations. Deepwatch's threat intelligence depends on the SIEM's native intel feeds and third-party enrichment — no proprietary attributed threat research at Unit 42 depth.
• Breach Response Guarantee — 250 hours IR included: MSIAM's IR guarantee has no equivalent in the Deepwatch offering. Deepwatch IR is a separate engagement.
• Continuous detection engineering at fleet scale: MSIAM's detection improvements compound across the full managed fleet. Deepwatch's detection engineering is account-level and SIEM-constrained.
• True consolidation path: MSIAM is the AI SOC that can replace the SIEM and the analyst team. Deepwatch adds cost on top of the existing SIEM investment. MSIAM consolidates the SIEM, SOAR, detection engineering, and managed SOC into one platform and service.

Where They're Strong

• SIEM-protective positioning: For accounts with major Splunk or Sentinel investments they cannot exit, Deepwatch's "we work on top of your SIEM" avoids the platform displacement conversation entirely.
• Mid-enterprise pricing: Deepwatch is typically positioned at price points accessible to mid-enterprise buyers who can't justify a full platform replacement alongside managed service costs.
• Splunk-deep expertise: Deepwatch's Splunk partnership and deep Splunk expertise is a genuine advantage in heavily Splunk-committed environments where Splunk is not going anywhere.

Landmines to Set

• "With Deepwatch, you're paying for managed analysts on top of your existing SIEM cost. What is the total cost of Splunk plus Deepwatch vs. MSIAM — which consolidates both into one AI SOC managed service?"
• "What does Deepwatch's automated response look like — specifically, what containment actions execute autonomously vs. requiring analyst approval? How long does analyst-required response take at 3 AM?"
• "Does Deepwatch have a roadmap to an AI SOC? Not AI-assisted SIEM — an autonomous AI SOC platform? What does that timeline look like vs. XSIAM operating that way today?"
• "What is Deepwatch's IR capability if you have a major breach — is there included IR capacity, or is that a separate engagement?"

Key Objections