Question 1

What is managed detection and response (MDR)?

Accepted Answer

MDR is a service where an outside team of analysts monitors your environment around the clock and responds to threats for you. It combines detection software across endpoints, identity, email, and cloud with human analysts who triage every alert, decide what is real, and take containment action. Unlike a tool you buy, MDR includes the people who operate it.

Question 2

Do your analysts hold active security clearances?

Accepted Answer

Many of our analysts have held clearances up to Top Secret, and several came from special operations and intelligence roles. To be precise about how clearances work: a clearance stays active only while a person is sponsored by an employer holding a facility clearance against a classified contract. We say cleared-experience because that is the accurate term. If your environment requires cleared delivery, talk to us about the Regulated tier. Our Chief Technology Officer, Kevin J. Rhodes Sr., has held clearance up to Top Secret across 23 years as a U.S. Army cyber officer.

Question 3

How much does an outsourced SOC cost?

Accepted Answer

BlackBunker starts at $3,500 per month for the Watch tier and $9,500 per month for Complete Defense, with custom pricing for the Regulated tier. For comparison, one in-house security lead runs $180,000 to $250,000 per year fully loaded and still only covers one shift. A staffed 24/7 SOC costs a fraction of building the same coverage internally.

Question 4

What is the difference between MDR and an MSSP?

Accepted Answer

An MSSP typically manages your security tools and forwards alerts to you, leaving triage and response on your plate. MDR owns the outcome. BlackBunker analysts take each alert to resolution, isolate compromised hosts, kill malicious sessions, and revoke breached access. An MSSP tells you something happened. MDR stops it while it is happening.

Question 5

Do we still need Microsoft Defender if we use BlackBunker?

Accepted Answer

Yes, and it works better with us. Defender is a detection sensor, not a response team. BlackBunker ingests Defender signal alongside identity, email, network, and cloud telemetry, then puts a live analyst behind it. You keep the license you already pay for, and you gain the people who watch it at two in the morning.

Question 6

Is BlackBunker's team based in the United States?

Accepted Answer

Yes. Every analyst is a US citizen working inside the United States. The operations center is staffed entirely by US military veterans, many from special operations backgrounds, and many have held government security clearances, up to Top Secret. No shift is routed offshore and no alert queue is outsourced to a third-party call center.

Question 7

How quickly can BlackBunker deploy across our infrastructure?

Accepted Answer

Deployment takes under an hour in most environments. We install lightweight agents across endpoints, connect your cloud and identity platforms through read APIs, and begin ingesting telemetry the same day. There is no rip and replace, no downtime window, and no disruption to daily operations. Analysts begin watching your environment as soon as signal flows.

Question 8

How does BlackBunker respond to late-night cyber attacks?

Accepted Answer

The operations center is staffed live 24/7/365, so a 2:00 AM alert reaches a human in minutes. Analysts isolate the affected endpoint, terminate malicious processes, revoke compromised credentials, and contain the incident before your team wakes up. You receive a written incident summary describing what happened and what was done.

Question 9

Does BlackBunker replace our existing security tool stack?

Accepted Answer

In most cases, yes. BlackBunker unifies endpoint detection, identity protection, email security, dark web monitoring, and deepfake defense into one managed operations center under one contract. Clients typically retire eight to twelve point-solution vendors. Where a tool is contractually required, we ingest its signal instead of replacing it.

Question 10

What happens during an active breach attempt?

Accepted Answer

Analysts execute active response immediately rather than waiting for your approval on containment basics. We isolate compromised hosts from the network, kill malicious processes, revoke breached access tokens, and block attacker infrastructure. Your team is notified in parallel with a complete incident timeline, the indicators involved, and the recommended follow-up work.

Question 11

Is BlackBunker a fit for CMMC and NIST 800-171 environments?

Accepted Answer

Yes. The Regulated tier is built for defense contractors and high-assurance supply chains. It provides US-citizen-only staffing written into the contract, a dedicated enclave, US-soil operations, hardened response processes, and continuous monitoring evidence that maps to NIST 800-171 and CMMC control families. BlackBunker supplies the monitoring and response function, not a certification. Our CTO implemented the Risk Management Framework for a federal agency and ran ISSM programs inside defense environments. The Regulated tier is built on that experience, not a checklist we bought.

They only need to get in once. We watch every second.

The numbers behind the watch.

analyst response SLA, written into the contract

live eyes on screen, never an empty chair

of alerts resolved without waking you up

estimated cyber insurance premium savings

The attack that gets you will not look like malware. It will look like AI.

Your CFO's voice, cloned.

Your executives, for sale.

Your credentials, already leaked.

The eyes on your screens defended the country first.

You bought the tools.
Nobody is watching them.

AI-driven attacks meet a real American analyst, live.

Behavioral detection across endpoint, identity, cloud, and email.

Threats contained while you sleep, before the damage spreads.

We are not another tool you have to watch. We watch it for you.

The rest send you notifications.
We send someone into the fight.

Live human eyes on screen 24/7

Active containment and incident response

Deepfake and impersonation defense

100% US-citizen, US-veteran team

What a shift looks like.

A full 24/7 security operations center,
for less than one in-house hire.

WATCH

COMPLETE DEFENSE

REGULATED

Who runs BlackBunker.

Gregory Scott Henson

Kevin J. Rhodes Sr., MS, CISSP

Frequently asked.

Tailored to your environment.

Under attack right now?

Capability	Help-desk MSP	Point tools (Defender, AV)	Alert-only MDR	BlackBunker
Live human eyes on screen 24/7	No	No	Limited	Yes
Active containment and incident response	No	No	Limited	Yes
Deepfake and impersonation defense	No	No	No	Yes
100% US-citizen, US-veteran team	No	No	No	Yes