Stop paying four vendors to miss the same attack.
A SIEM, an EDR, a SOAR tool and an MDR contract, plus a person whose job is making them talk. Every handoff between them is a place an attacker can wait. We replaced all of it with one platform, and we price it by the people you protect, not the logs you keep.
Side by side
The stack you have. The platform that replaces it.
| SIEM + EDR + SOAR + MDR | Convoy | |
|---|---|---|
| Consoles | Four or more | One |
| Pricing | Per gigabyte ingested, per module, per seat | Per identity protected. No ingest meter. |
| Detection content | Yours to write, tune and keep alive | 2K+ rules mapped to MITRE ATT&CK, tuned with you |
| Endpoint agent | A separate EDR contract | Convoy Agent, included |
| Response | Playbooks someone has to build and maintain | Endpoint, identity and email actions on day one |
| Investigation | Alerts copied between tools by hand | Lead, case, evidence and comms in one place |
| Who watches it | Whoever is on call, or an add-on contract | Convoy operators in your console, as much or as little as you want |
| Investigation write-ups | An alert ID and a status | Every lead closed with a written reason and a confidence score |
| Raw data | Often sampled or tiered to control cost | All of it, queryable |
| Your own AI tools | Usually a portal and a PDF | MCP and REST API on every tenant |
Compare
Whatever shape your stack is in, here's what changes.
Three stack shapes we meet in briefings, and what changes for each.
Shape 1
SIEM plus an MDR contract
What you have: a log platform billed by volume and a service that watches a subset of it, usually the endpoint and identity alerts, and emails you.
What breaks: the MDR can't see what the SIEM didn't ingest because it cost too much, and neither can act in the other's console.
What Convoy changes: one source of truth with everything in it, operators in the same console you use, no meter. The SIEM contract ends at renewal.
Shape 2
EDR with the vendor's managed service
What you have: a good endpoint agent and a team that watches endpoints. Identity, email, firewalls, IoT and cloud are someone else's problem or nobody's.
What breaks: the attack starts in a mailbox and the first thing the EDR sees is the third step.
What Convoy changes: keep the agent if you like it, we ingest it. Add identity, email, firewalls, IoT and cloud to the same source of truth. Or bake off Convoy Agent and decide later.
Shape 3
In-house SOC with a SOAR
What you have: capable people, a playbook engine someone built two years ago, and a backlog of playbooks nobody maintains.
What breaks: every new tool means new glue, and the 3 a.m. response still depends on who's awake.
What Convoy changes: co-managed. Your team writes rules and playbooks on a platform that already has the actions, the audit trail and the MCP server. Our operators cover the hours you don't.
Pricing model
Pay for coverage. Never for volume.
One number per protected identity, per month. Convoy Agent is in it. Operators are in it, on every plan. The ingest meter doesn't exist. Sending us more telemetry makes you safer and never makes the bill bigger.
Price per identity
One line on the invoice, with endpoints and servers included up to a baseline. Easy to forecast as you grow.
Ingest meter: none
Connect every source you have. Volume never moves the price.
Agent and operators: in it
Convoy Agent is part of the platform, and the people are part of the service, whether you go managed, co-managed or self-managed.
Trust
We hold ourselves to the standard we sell.
A security vendor with weak controls is just another way in. These commitments are written into our contracts.
99.95%
Uptime
Written into the agreement as a platform commitment.
BAA
Signed first
For healthcare customers, the business associate agreement comes before anything else and governs the rest.
1:1
Tenant isolation
Every customer's data sits in its own tenant, and every request is scoped to it.
RBAC
Permissions on every call
Role-based access, checked on each request in the console, the API and the MCP server.
100%
Audited
Every response action and rule change is recorded, whether a person, a playbook or one of your own AI tools made it.
2 days
To acknowledge a report
Found a weakness in something we run? Our disclosure program acknowledges reports within 2 business days and credits the researcher.
Before you switch
Questions buyers ask.
Do we have to turn off our SIEM on day one?
No. Convoy runs next to it while your sources move over. You switch the old one off when Convoy's coverage matches it, usually at renewal.
Can we keep our current EDR?
Yes. Convoy ingests the major third-party EDRs today and can isolate a host through yours. You can also run Convoy Agent beside your current agent and compare the two before you decide.
Who's actually watching our environment?
Convoy's own operators, working in the same console you see. Every action they take shows up in your audit trail.
What does onboarding involve?
We connect your sources, deploy Convoy Agent, tune the rules against your real traffic and run alongside your current tools until the coverage matches.
Can our own engineers work in it?
Yes. Co-managed and self-managed customers write their own rules and playbooks, and every tenant is open over MCP and a REST API under the same permissions as the console.
Our offers
Three offers to hold us to.
Run us beside your SIEM until you turn it off.
We connect your sources and run in parallel. You switch the old one off when our coverage matches it, usually at renewal. No hard cutover, no migration weekend.
Bake Convoy Agent off against whatever you run.
Same hosts, same attacks, same window. Keep the one that caught more. Your hosts decide.
We'll price it against your last invoice.
We'll map what Convoy replaces, what it keeps, and what you'd pay instead, line by line. If we're not the better deal we'll say so.