Red Canary
Veteran MDR service with 10+ years of SecOps expertise, now inside Zscaler.
Acquired — still operating
Zscaler announced a definitive agreement to acquire Red Canary in May 2025, positioning it as the foundation of an agentic AI-powered SOC. Expect roadmap and packaging to follow Zscaler's direction.
About
Red Canary is a managed detection and response provider with over a decade of security operations experience. Its service combines threat detection across endpoints, cloud, and identity with human-led investigation and automated remediation workflows, and the company claims its customers investigate threats up to 10 times faster with 99.6 percent accuracy. The platform maps detections to MITRE ATT&CK and emphasizes streamlined workflows that reduce analyst toil rather than shipping raw alerts.
In May 2025 Zscaler announced a definitive agreement to acquire Red Canary, positioning the combination as an agentic, AI-powered SOC built on Zscaler's Zero Trust Exchange platform, its data fabric technology, and ThreatLabz intelligence. Buyers should expect the product roadmap and support experience to be shaped by Zscaler ownership going forward. Investigation speed and accuracy figures are vendor-reported and I have not independently tested them.
What it can do
- 24/7 managed detection and response
- Threat detection across endpoint, cloud, identity
- Automated remediation workflows
- MITRE ATT&CK-mapped detections
- Threat intelligence integration
- Agentic AI-powered SOC roadmap with Zscaler
Setup
- Engage via redcanary.com (now within Zscaler) to scope your environments.
- Connect endpoint, cloud, and identity telemetry sources through supported integrations.
- Red Canary analysts begin 24/7 monitoring with automated remediation where configured.
- Track investigations and outcomes in the Red Canary portal.
Prerequisites
Endpoint/cloud/identity telemetry to feed the platform; confirm current packaging and roadmap with Zscaler sales given the acquisition.
Use cases
Works with
Trust score — 8/10
Scored 8/10 (TIER metrics, metrics-v1). Evidence: 10+ years of SecOps operation as an established MDR provider; Zscaler acquisition announced May 2025 via press release; long-standing detection-engineering reputation. Strengths: deep MDR track record, Zscaler backing brings Zero Trust Exchange data scale and ThreatLabz intelligence. Docked for: (1) speed and accuracy figures are vendor-reported, not independently tested; (2) acquisition in progress creates roadmap and support uncertainty for new buyers. License: proprietary.
How the trust score is built
Full methodology →- Adoption · stars/downloads, log-scaled vs peers
- 8.0/10
- Maintenance · recency, releases, issue load
- 7.0/10
- Openness · license + docs
- 3.0/10
- Manual review · sanity read + red-flag check
- 1.0/10
- · 10+ years of MDR SecOps operation; established detection-engineering reputation
- · Zscaler acquisition announced May 2025 via press release
- · Roadmap and support will follow Zscaler direction; acquisition uncertainty
- · Speed and accuracy figures are vendor-reported
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.