Alert Logic takes the night shift

The revealing detail in the Wealth Wizards story is the size of the engineering team. Here was a financial technology business running on Amazon Web Services, responsible for applications that needed security attention at several layers. Its engineers could build the service. Finding enough hours to watch it was another matter. Alert Logic’s customer account describes a team buying access to outside security expertise so it could keep doing its own work.

That is a useful place to start with Alert Logic. Cybersecurity is crowded with products promising visibility. Visibility creates work: someone must decide whether an unusual event deserves attention, whether two apparently unrelated events belong together, and whether to wake the customer. The company built its proposition around handling that work alongside the technology.

The customer was buying time

Wealth Wizards wanted a view of its AWS assets, their vulnerabilities and their configuration. It also wanted monitoring across network, host and application layers. The attraction, according to the published case study, included the people interpreting the findings. For a small team, that changes the purchase from another interface to another source of operating capacity.

“Knowing exactly what images we have deployed and what threats may exist within our network is really important.”

Richard Marshall · Head of Platform, Wealth Wizards

Financial technology makes the stakes easy to understand, but the model extends beyond it. Historical customer materials describe organizations in healthcare, retail and other industries. An AWS example features ClubCorp, with a changing IT footprint and member information to protect. The common characteristic is an environment whose security demands exceed the attention available inside the business.

A subscription with people inside

Alert Logic combines asset discovery, vulnerability scanning, intrusion detection and log analysis in a cloud-delivered platform. Managed detection and response, or MDR, adds security operations expertise. Its broader product family has included extended detection and response, or XDR, and managed web application firewall services. A WAF addresses application traffic; MDR covers a wider investigation problem.

The distinctions inside the service are worth reading carefully. A published offering matrix separates Essentials, Professional and Enterprise. All include platform access and vulnerability capabilities. Professional adds round-the-clock threat management; Enterprise adds services including a designated security expert and continuous threat hunting. An always-available platform and an always-working analyst team are separate entries for a reason.

Automation has boundaries, too. Alert Logic’s Intelligent Response documentation describes configured actions and supported integrations. Its FAQ says Simple Responses are triggered by Alert Logic analytics, rather than customer-defined log correlations. Buyers need to understand the route from a finding to an action, including where their own authorization and intervention enter the process.

The cloud changed the delivery route

Founded in Houston in 2002, Alert Logic was building this business before today’s MDR vocabulary became familiar. Co-founder Misha Govshteyn held roles including founding CEO and CTO. Reporting also identifies Chris Church as a co-founder. By June 2012, the company reported more than 1,700 customers and nearly $30 million in annual recurring revenue.

That financing shows what management wanted to expand. Industry Ventures and DH Capital led the round, alongside existing investors. The announced uses included growing Web Security Manager and distributing it through hosting and cloud service providers. Selling through those partners put protection close to the place customers were already buying infrastructure.

The technical integrations followed the same logic. In February 2022, AWS announced that its Systems Manager Distributor could deploy the Alert Logic MDR agent to EC2 and on-premises instances without customers maintaining their own software packages. The operational appeal is straightforward: security deployment can follow infrastructure management, reducing a separate piece of installation work.

The handoff matters more than the dashboard

The business model is recurring subscriptions combining software and service, sold directly and through partners and marketplaces. A useful cost comparison includes internal staffing, tuning and investigation time alongside the quoted fee. Buyers should request a current offer covering their environment, data collection and response scope. A historical package or partner listing cannot settle that calculation.

Alert Logic belongs in the MDR market alongside providers such as Arctic Wolf, Sophos and Red Canary. Its cloud integrations and combination of network, log and vulnerability information give buyers concrete features to compare. Human-led operations are shared across this category. The meaningful test is which systems a service sees and which decisions its people actually own.

There are practical limits. Missing telemetry limits an investigation. Unmaintained permissions can interrupt collection. A customer still needs someone able to approve changes and carry out agreed remediation. For a team already operating a capable internal security center, some services may overlap. For a team expecting a subscription to remove every security responsibility, the handoff needs another conversation.

A new owner, the same unfinished shift

Ownership has changed repeatedly: Welsh Carson announced a majority investment in 2013, and HelpSystems acquired the company in 2022 before becoming Fortra. In January 2026, LevelBlue announced a partnership with Fortra that included acquiring Alert Logic’s MDR, XDR and WAF managed services. Today’s landing page places Alert Logic inside LevelBlue and preserves links to customer resources.

The lesson another business can copy is specific: sell the recurring work that customers struggle to staff, then define the handoff clearly. For security buyers, start with an asset inventory and trace one incident from collection through remediation. It also gives both sides a rehearsal: which alert reaches which person, which action can happen automatically, and which decision waits for the customer. A procurement discussion becomes much more useful when everyone can follow the same example. That exercise reveals what the subscription buys. Somewhere between the alert and the next action, somebody still has a shift to finish.