Managed Detection and Response
with Arctic Wolf and ISEC7
What Arctic Wolf does
Arctic Wolf is a managed detection and response provider. Its security operations center monitors the connected sources 24/7, assesses every alert and reports confirmed incidents to your team along with a recommended response. German-speaking customers are served from Frankfurt, where Arctic Wolf opened its first European SOC in November 2021.
A person makes the call
According to Arctic Wolf in our joint webcast in July 2025, the triage team in Frankfurt works around the clock in three shifts. Whether an alert is real or a false positive is decided by a person.
Its own platform, your existing tools
Arctic Wolf runs its own platform rather than a third-party SIEM and is vendor-agnostic. According to the company, cloud services, firewalls, EDR, identity systems and Microsoft 365 can be connected, including security software you already have in place.
Hands-on only by agreement
Arctic Wolf takes immediate actions such as isolating a host, disabling an account or adding a firewall rule only if you agreed to them during onboarding. Beyond that, the line is the one the Arctic Wolf speaker drew in the webcast himself: Arctic Wolf does not touch the keyboard in your environment.
Who does what: Arctic Wolf, ISEC7 and your organization
The work is split: Arctic Wolf handles detection from Frankfurt, and remediation in your systems is done by you or by ISEC7. The SOC belongs to Arctic Wolf. ISEC7 is an Arctic Wolf partner and, if you want, takes on the work that follows a report in your environment.
Arctic Wolf
monitors the connected sources, assesses alerts around the clock, reports confirmed incidents with a recommended response and carries out the immediate actions you agreed on.
ISEC7
connects your mobile landscape to detection. You implement the recommendations yourself, or we do: patches, configurations and policies in the UEM. Because Arctic Wolf does not intervene in customer systems, ISEC7's IT experts also fix the vulnerabilities found by the Managed Risk service. If you like, we run your mobile environment for you as part of our managed endpoint services.
Your organization
decides whether an incident is significant and reports it to the competent authority.
The Arctic Wolf Threat Report 2026 shows how much depends on the second half. In 65 percent of the incident response cases that did not involve business email compromise, attackers got in through abused external remote access, meaning RDP, VPN or remote management tools. The ten vulnerabilities seen most often in these cases all date from 2024 or earlier. A report does not close a gap. A patch does.
The report covers cases Arctic Wolf was called in on for incident response between November 1, 2024, and November 1, 2025.
How onboarding works
The service starts with onboarding by Arctic Wolf in three phases: connecting the sources, tuning detection to your environment, then day-to-day operation with regular reviews. ISEC7 makes sure your mobility and UEM landscape becomes part of that detection and, if you want, implements the recommendations once the service is running.
- Conversation with ISEC7: Which systems, which mobile landscape and which security software do you run today?
- Phase 1, onboarding: Arctic Wolf connects the sources, and you decide which immediate actions Arctic Wolf may take. ISEC7 connects your mobile landscape to detection.
- Phase 2, tuning: Arctic Wolf tunes detection to your environment.
- Phase 3, operations: Arctic Wolf reports confirmed incidents with a recommendation, and regular reviews accompany the service. You or ISEC7 fix what is found.
MDR is the base service and, according to Arctic Wolf, includes 90 days of log retention. Managed Risk, Managed Security Awareness and an incident response retainer are separate services you can add.
Why the mobile landscape belongs in detection
Incidents on mobile devices rarely show up when nobody is looking. Smartphones and tablets are managed in the UEM, and they only appear in detection if someone connects them. That is ISEC7's part: we connect your UEM and mobility landscape to Arctic Wolf's detection and implement patches, configurations and policies where the devices are managed.
If Arctic Wolf runs in your environment, ISEC7 SPHERE shows its alerts in the same console as your UEM systems. How Arctic Wolf fits into ISEC7's wider security services is described under endpoint security.
Webcasts, recording and blog
- Arctic Wolf Threat Report 2026: the analysis on the ISEC7 blog
- Webcast on the Threat Report 2026 with Arctic Wolf on October 15, 2026 and November 5, 2026, both at 11:00 a.m. German time, online, free of charge, in German
- Recording of the webcast “Cyberabwehr neu gedacht” with Arctic Wolf from July 10, 2025, in German, registration required
- All ISEC7 webcasts
Frequently asked questions about managed detection and response with Arctic Wolf
What is managed detection and response, and how is it different from a SIEM?
With managed detection and response (MDR), an external security operations center monitors your systems around the clock, assesses alerts and reports confirmed incidents, without you having to build a SOC of your own. A SIEM, by contrast, is a tool: it collects and correlates logs, and someone still has to assess them. According to Arctic Wolf, it runs its own platform rather than a third-party SIEM, does not charge by log volume and has a person assess every alert.
Who runs the SOC when I get MDR through ISEC7, and where is the data kept?
Arctic Wolf runs the SOC, not ISEC7. Arctic Wolf opened its first European security operations center in Frankfurt in November 2021 and serves German-speaking customers from there. According to Arctic Wolf in our joint webcast in July 2025, more than 150 German-speaking employees work in Frankfurt, and the data is kept in Germany.
What does Arctic Wolf do, what does ISEC7 do, and what stays with us?
Arctic Wolf monitors the connected sources, assesses alerts around the clock, reports confirmed incidents with a recommended response and carries out the immediate actions you agreed on. ISEC7 connects your mobile landscape. You implement the recommendations yourself, or ISEC7 does: patches, configurations and policies in the UEM. Your organization decides whether an incident is significant and reports it to the competent authority.
Does Arctic Wolf's SOC make changes in our systems itself?
Only within the agreed scope. You decide during onboarding which immediate actions Arctic Wolf may take, such as isolating a host, disabling an account or adding a firewall rule. According to Arctic Wolf, if you rule out immediate actions, someone on your side has to be reachable on weekends to respond to a report. Fixes in your systems are made by you or by ISEC7.
Does Arctic Wolf MDR work with the security tools we already have?
According to Arctic Wolf, the service also works with security software you already have in place. The platform is vendor-agnostic and connects, for example, cloud services, firewalls, EDR, identity systems and Microsoft 365. ISEC7 connects your UEM and mobility landscape.
Do we need our own SOC to meet the reporting deadlines in Germany under Section 32 BSIG?
Section 32 of the German BSI Act (BSIG), part of Germany's NIS2 implementation, does not require a SOC of your own, but it does set deadlines. Essential and important entities report a significant security incident with an early warning no later than 24 hours after becoming aware of it, with an initial assessment including severity and, where available, indicators of compromise within 72 hours, and with a final report one month later. That information depends on analyzed logs, which is what MDR delivers. Whether an incident is significant is your organization's decision, and so is the report itself.
Is incident response included in Arctic Wolf MDR?
No. According to Arctic Wolf, MDR is the base service covering detection, assessment and reporting, plus 90 days of log retention. Arctic Wolf offers incident response as a separate service on retainer, along with Managed Risk and Managed Security Awareness.
What does the Arctic Wolf Threat Report 2026 say about the most common ways in?
Attackers most often got in through abused external remote access: in 65 percent of the incident response cases that did not involve business email compromise, they used RDP, VPN or remote management tools. The ten most common vulnerabilities in these cases date from 2024 or earlier, mostly on edge devices. Among other things, the report recommends rotating credentials after exposure, using phishing-resistant MFA and patching known exploited vulnerabilities (KEV) first. The figures come from cases Arctic Wolf was called in on, so attacks stopped early are underrepresented, and the report does not cover mobile devices.
Talk to us about MDR with Arctic Wolf
Want to know which of your systems and mobile devices can be connected, and who takes on what after a report? Send us a message using the form, and someone from ISEC7 will get back to you.