The first eSentire appliance was not born in a gleaming lab. It was hand-built to answer a stubborn problem: a security consultant could inspect a company on Tuesday, leave on Wednesday, and have no idea what crossed the network on Thursday. Founder Eldon Sprickerhoff had started eSentire in Ontario in 2001 as a security consultancy. While assessing and configuring customer defenses, his team occasionally watched an attack unfold in real time. The useful part was not the report they would write later. It was seeing the intruder while something could still be done.
That changed the product. eSentire began placing customized network sensors inside customer environments, watching the traffic remotely and stepping in when it looked wrong. The company called the practice “Collaborative Threat Management” and paired it with “Embedded Incident Response.” The modern label - managed detection and response, or MDR - came later. The operating idea was already there: machines watch continuously; skilled people investigate; somebody acts before the customer’s morning meeting.
By mid-2002, referrals from financial firms and law offices had filled a modest Cambridge, Ontario space. A server lived under a table. It warmed the office in winter and punished the air conditioner in summer. This is the sort of origin story cybersecurity companies rarely tell, perhaps because a server under furniture does not resemble the command bridge on a sales deck. It does, however, explain eSentire’s central instinct. Useful security is an operation, not an ornament.
01 / The original failure
A snapshot could not catch a moving thief
The first thing to fail was periodic consulting. Assessments could harden a network, but they could not provide memory between visits. Building an internal security operations center was the other obvious answer, and for many mid-sized organizations it was an expensive one. It meant hiring enough specialists to cover nights, weekends and holidays, buying several tools, maintaining detection rules, triaging alerts, retaining forensic knowledge and persuading good analysts not to leave. One eSentire case study describes an investment firm that attempted exactly that and ran into the complexity and cost.
The product is not the alert. It is the closed loop from signal to judgment to action.
eSentire sells that loop as a subscription. Its Atlas platform collects telemetry from endpoints, networks, logs, cloud services and identities. Automation correlates and enriches the signals. A round-the-clock security team investigates what survives the filters, hunts for threats and takes agreed response steps - isolating a host, blocking a malicious file, suspending a compromised account or helping remove an attacker’s foothold. Digital forensics, incident response, vulnerability management and cyber-risk advice widen the service beyond the monitoring desk.
How the watchtower works
This makes eSentire neither a conventional software vendor nor a consulting firm with a portal. Atlas is SaaS, but the people on the other side are part of what the customer buys. The company says it supports more than 300 technology integrations and allows clients to keep existing licenses from Microsoft, CrowdStrike, SentinelOne, Palo Alto Networks, Tenable and others. That “bring your own license” option is strategically important. A security leader does not need to throw away a functioning stack simply to hire someone to operate across it.
02 / The customer is a condition, not an industry
Serious risk, thin bench, too many blinking lights
eSentire now says it protects more than 2,000 organizations across at least 35 industries. Its roots in financial and legal services remain visible, but its customer list has spread through healthcare, private equity, insurance, manufacturing, construction, education, government, retail and food supply. The connecting tissue is not a vertical. It is an operational condition: the organization holds valuable data, downtime hurts, compliance matters and the internal team cannot investigate every alert at 3 a.m.
These are company-reported operating and customer metrics, not universal guarantees for every incident.
A hospital wants threats contained without interrupting patient care. A law firm worries about privileged files and impatient partners. A manufacturer may have old equipment, remote sites and little tolerance for a stopped line. An investment manager faces regulators, portfolio-company sprawl and attackers who know exactly where the money sits. Each buys the same broad outcome - a capable security operation without assembling the entire shift schedule alone.
Competitors frame that promise differently. Arctic Wolf emphasizes its concierge model. Red Canary and Expel built reputations around cloud-delivered MDR. ReliaQuest sells a broader security operations platform. CrowdStrike and Microsoft can wrap managed services around their own enormous ecosystems. eSentire’s distinction is the combination of multi-vendor flexibility, network-era operational experience and active response. It wants to be the layer across the stack, not merely the caretaker of one endpoint product.
03 / From watching the door to testing every window
Atlas learned to throw the first punch
The 2026 product push changes the order of operations. Under new chief executive James C. Foster, who founded ZeroFox and Ciphent, eSentire has recast Atlas around “controlled autonomy.” The phrase means AI agents can investigate and take bounded action quickly, while people define the policy, review evidence and remain accountable. It is a useful distinction in an industry full of automated tools that can create their own emergency.
Atlas Preempt, launched in June, continuously discovers assets, scans for weaknesses and runs AI-led penetration tests. The point is not another list of alarming vulnerabilities. It is to prove which paths are reachable, then feed that knowledge into detection and patch priorities. In July, eSentire added response orchestration, attack-informed defense and patch management. Rules can notify a Slack channel, isolate a host or suspend a user, with actions logged and designed to be reversible. In August, a partnership with Sublime Security made email a native signal, so a suspicious message can be investigated alongside identity, endpoint and network behavior.
Hand-built sensors and embedded response establish the MDR operating pattern.
Warburg Pincus backs the company; a later US$325 million transaction pushes valuation above US$1 billion.
The Nexus Network lets partners operate dedicated instances and build local services.
Autonomous testing, governed response, patching, email security and a U.S.-resident SOC broaden the platform.
The newest U.S. security operations center adds another kind of boundary. Its Atlas deployment runs on isolated U.S. infrastructure, with a contractual promise that customer data and investigation records remain inside the country. That matters to government, education and healthcare buyers whose procurement rules can turn data residency into a pass-fail question. The company also operates security capabilities in Canada, Europe, the Middle East and Asia.
04 / What the invoice actually buys
No sticker price - because the stack is the quote
eSentire does not publish a flat dollar price. It sells Atlas Essentials, Atlas Advanced and Atlas Complete, and calculates a quote from endpoint count, signal sources, existing licenses, service depth and extras. Complete adds cyber-risk advisors; customers can bring third-party subscriptions or buy a fully managed bundle. Reviewers frequently praise fast response and specialist support, while some flag premium pricing, false positives, reporting gaps or slow ticket communication. The relevant cost comparison is therefore not a cheap app. It is the fee against staffing and operating a credible 24/7 team.
The company itself has not been built cheaply. In 2019, eSentire raised a reported US$47 million Series E. In February 2022, Georgian and CDPQ joined a US$325 million transaction that combined US$100 million in primary financing with a reported US$225 million secondary deal. Warburg Pincus remained the majority owner. eSentire said annual recurring revenue had passed US$100 million, and the transaction valued the company above US$1 billion.
The copyable part is an operating design, not an AI slogan
- Put every useful signal into one investigation path. Handoffs are where context disappears.
- Write response authority before the incident. Decide what can be blocked, isolated or suspended automatically.
- Rank weaknesses by reachability and business impact, not a scary score alone.
- Keep automation reversible and visible. A fast mistake is still a mistake.
- Measure the outcome buyers feel: time to investigate, time to contain and work removed from the internal team.
This model is not a universal fit. A tiny company with a simple environment may find a premium MDR contract heavier than its risk warrants. A buyer unwilling to connect enough telemetry, tune the service or grant meaningful response authority may end up paying for an expensive alert forwarder. And an organization that has not handled basics such as asset ownership, patching and identity controls cannot outsource those responsibilities by purchasing a SOC. eSentire works best when the customer wants a co-pilot with permission to touch the controls.
The company’s original insight remains sharper than the current AI vocabulary. A report is late the moment an attacker moves. The warm server, the hand-built sensor and today’s agentic system are versions of the same answer: keep watching, preserve context, and shorten the distance between noticing trouble and doing something about it. For a mid-sized security team, that distance is often the whole game.