In short: Check Point MDR is a 24/7 managed detection and response service run by Check Point's own analysts within CPR Act, its intelligence and response unit. Analysts monitor endpoint, email, network, cloud and identity, hunt for threats, contain attacks and include incident response. It works with Check Point and third-party tools, and lists the UK among its data residency options.
What is Check Point MDR?
Check Point MDR is a managed security service, not software you run yourself. Check Point's analysts watch the telemetry from your security tools around the clock, decide which alerts are real, investigate them, and act: isolating a device, blocking an indicator or escalating to incident response when an attacker is active.
It sits within CPR Act, which Check Point describes as its unified operational unit bringing research-driven intelligence, readiness, detection and response together, with threat intelligence from Check Point Research. (The July 2025 launch announcement placed MDR in Check Point's Infinity Global Services, the earlier name for its services portfolio.) That means the analysts watching your environment work alongside the researchers who track the threats, and draw on the same ThreatCloud AI intelligence.
For a generic explanation of how MDR differs from EDR and XDR, see endpoint security and XDR on our sister site.
What it covers
- 24/7 detection and response across endpoints, email, network, cloud and identity
- Proactive threat hunting for activity that has not triggered an alert
- Automated containment to cut the time an attacker has inside your network
- Identity threat detection with native support for Microsoft Active Directory, Microsoft Entra ID and Okta
- Incident response included, with escalation to incident response when a live attacker is detected
- Data residency options, including the UK
- Access to the Check Point XDR/Playblocks platform in the higher packages, so you see the incidents and automated responses the analysts work with
Service packages
Check Point launched a tiered line-up, MDR 360 and MXDR 360, on 28 July 2025. The packages build on each other:
| Package | What it adds |
|---|---|
| MDR | The foundation: 24/7 managed detection and response using endpoint agents and API connections to your existing tools |
| MDR 360 | MDR plus identity threat detection, broader data integrations and access to the Check Point XDR/XPR platform (then called Infinity XDR) |
| MXDR 360 | Everything in MDR 360 plus a fully managed SIEM and an enterprise-grade security data lake for long-term retention, run within a co-managed SOC framework |
Exactly what each package includes, and how incident response hours can be used (Check Point's announcement mentions crisis management, tabletop exercises, compromise assessments and root cause analysis), is set out in the service description for your contract. We go through it with you before you sign, and we never quote response-time targets on Check Point's behalf.
Works with your existing tools
Check Point positions MDR as vendor-neutral. As well as Check Point products, it integrates with third-party EDR, firewalls, cloud platforms and SaaS tools, so you do not have to replace what you already run to get a 24/7 service. Organisations with a mix of Microsoft security, other vendors' firewalls and Check Point email protection can bring them into one managed service; we check that each of your tools is on Check Point's integration list before you commit.
Check Point MDR is also available through the Microsoft and AWS marketplaces, which can help organisations that buy against existing cloud commitments.
MDR for Harmony and Workspace Security customers
If you already run Harmony Endpoint (Check Point Endpoint Security) or Harmony Email and Collaboration (Check Point Email Security), MDR is the natural next step. The telemetry is already in your Check Point Portal account, so onboarding is largely a matter of connecting the analysts to what you have and agreeing how they should act.
- On top of Endpoint Security: analysts triage EDR detections, run threat hunts and use the agent to isolate devices or remediate, rather than leaving alerts in a queue. See Harmony Endpoint EDR and XDR
- On top of Email Security: analysts can follow a phishing email from the inbox to the endpoint where it was opened and contain both
- With Harmony Endpoint Elite: Elite already includes XDR for Endpoint, so incidents are correlated before the analysts pick them up
MDR is broader than Incident Response as a Service, the email add-on in which Check Point analysts respond to users' phishing reports and requests to restore quarantined email. IRaaS suits a small IT team that wants help with the email queue; MDR is for organisations that want their whole estate watched around the clock.
Incident response and UK data residency
Incident response is included in the MDR packages, and Check Point runs a separate incident response service for organisations without MDR that need help during a live attack.
Check Point lists data residency options for MDR in the EU, US, Australia, Canada, India, the UAE and the UK. For UK organisations with UK GDPR obligations, or public sector and regulated customers with contractual data location requirements, we confirm the region before onboarding and make sure it matches where your Check Point Portal account and other products store data.
Is Check Point MDR right for you?
MDR makes most sense if you have security tools but not the people to watch them at night, at weekends and during holidays, which describes most UK organisations below enterprise size. It also suits larger teams that want a co-managed SIEM without building a full in-house security operations centre.
We scope the service with you, connect your Check Point and third-party tools, agree escalation contacts and run the onboarding, then stay involved as your day-to-day support. Contact us to discuss Check Point MDR, or see how it fits with the rest of the Harmony suite.
How Forever Systems supplies and supports Check Point Harmony
We supply and support the whole Check Point Harmony suite, now marketed as Check Point Workspace Security, for UK organisations: from a single product to endpoint, email, SaaS, mobile, browser and SASE together, with Check Point MDR if you want round-the-clock cover.
- Scoping and licensing: the right products, editions and plans for your users, devices and risk, and a clear view of what the old Harmony names now mean
- Proof of value: trial deployments that show what Harmony finds in your own mailboxes, devices and traffic
- Deployment: endpoint agents and policies, the Microsoft 365 or Google Workspace connection, mobile roll-out through your MDM, browser extensions and SASE access policies
- Migration: moving from another endpoint, email or VPN product, or from Harmony Connect to Harmony SASE
- Ongoing support: policy tuning, alert triage, upgrades and renewals, managed in the Check Point Portal
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, including other options if Harmony is not right for you.
Want a Check Point Harmony quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Check Point MDR?
Check Point MDR is a 24/7 managed detection and response service in which Check Point's own analysts monitor your endpoints, email, network, cloud and identity, investigate alerts, hunt for threats, contain attacks and provide incident response.
Who delivers Check Point MDR?
Check Point's own analysts deliver it, within CPR Act, the Check Point unit that brings together research-driven threat intelligence, readiness, detection and incident response. The analysts draw on Check Point Research and ThreatCloud AI intelligence.
Does Check Point MDR only work with Check Point products?
No. Check Point describes MDR as vendor-neutral, integrating with third-party EDR, firewalls, cloud platforms and SaaS tools as well as Check Point products.
Is Check Point MDR data stored in the UK?
Check Point lists the UK among its MDR data residency options, alongside the EU, US and others. We confirm the region for your contract before onboarding.
What is the difference between MDR, MDR 360 and MXDR 360?
MDR is the 24/7 foundation using endpoint agents and APIs. MDR 360 adds identity threat detection, broader integrations and the Check Point XDR/XPR platform. MXDR 360 adds a fully managed SIEM and security data lake on a co-managed basis.
Can I add MDR to Harmony Endpoint or Harmony Email?
Yes. If you already use Check Point Endpoint Security or Email Security, MDR can use the telemetry already in your Check Point Portal account, and it can also take in data from your third-party tools.
Can I buy Check Point MDR through a cloud marketplace?
Yes. Check Point lists MDR on the Microsoft and AWS marketplaces, which can suit organisations buying against existing cloud commitments. We can also supply and support it directly.