WithSecure Co-Security services are the expert services that WithSecure sells on top of its Elements software platform. WithSecure describes them as “a range of expert-backed security services designed to work alongside your existing team”, made up of Elevate, Managed Detection and Response (MDR), Incident Response Services and Elements Infinite.[1] The services are part of the Elements portfolio and are consumed through Elements Security Center. Their licensing sits on top of the Elements software subscriptions. Elevate is metered in Elevate tokens. MDR needs Elements EDR on the monitored devices. The incident response offers are priced in retainers and incident response days.[2][3]
Editions
| Service | What is licensed | Prerequisite | Source |
|---|---|---|---|
| Elevate | Validation and Investigation Tokens, sold as an add-on subscription | Active Elements EDR subscription | [2] |
| MDR for Endpoints | 24/7 detection and response service with an MDR subscription code | Elements EDR agents on the monitored devices | [3] |
| MDR for Identities | Add-on combining Elements Identity Security for Entra ID with managed detection | MDR customers | [1] |
| Elements DFIR Retainer | SLA-backed access to DFIR specialists, consumed on demand | Elements platform customers | [1] |
| IR Retainer (traditional) | Pre-paid days at discounted rates | None | [1] |
| Emergency Incident Response | Day-rate engagement without a retainer | None | [1] |
| Elements Infinite | Managed service combining CTEM, MDR and an Incident Response Retainer | None stated | [1] |
The Security services page in Elements Security Center lists these offers under the Co-Security category. It describes Infinite as bundling “the full range of WithSecure solutions and services”, including continuous threat exposure management, endpoint protection, XDR, MDR, full Elements platform access, customer success management and an incident response retainer.[5]
Metrics
| Metric | Catalog row | Service |
|---|---|---|
| Elevate token | Elevate token | Elevate |
| Incident response day | Incident response day | First Response Package, DFIR and emergency response |
| Device | Device | MDR for Endpoints (bundle pricing) |
| User identity | User identity | MDR for Identities (bundle pricing) |
In the MSP bundles, MDR for Endpoints appears under “Pricing based on number of devices” and MDR for Identities under “Pricing based on number of user identities”.[4]
Counting / floors
Elevate tokens
“WithSecure Elevate is licensed through two types of Tokens: one for Threat Validations and one for Threat Investigations. These tokens are offered in pre-packaged combinations that vary in size, for example 2/1 (2 Validation Tokens for 1 Investigation Token).”[2] Which token is used depends on the age of the detection. “If the detection under scrutiny is more than 7 days old, an Investigation Token is used for Elevation. Otherwise, the elevated detection is first validated using a Validation Token.”[2] To use Elevate, the customer needs an active Elements EDR subscription, at least one reporting agent and “a WithSecure Elevate add-on subscription”.[2] Catalog: Elevate: Validation Token first; Investigation Token for detections older than 7 days.
Tokens are tied to the subscription term. “The tokens expire based on the same duration as the product subscription.” “Tokens expire after 12, 24, or 36 months, depending on your subscription term.” The remaining balance is shown under Management > Subscriptions, and when no tokens are left the portal offers a link to buy more.[2] Unused tokens therefore lapse at the end of the term, much like prepaid credits in other consumption models. Catalog: Elevate tokens expire with the subscription term (12, 24 or 36 months).
WithSecure’s marketing page calls Elevate “a token-based, pay-as-you-go model”. It lists “WithSecure™ Elevate tokens included” among the components of MDR.[1] Catalog: Elevate is token-based pay-as-you-go; MDR includes tokens.
MDR
WithSecure MDR is “a continuous 24/7 detection and response service” that works “using data collected by WithSecure Elements Endpoint Detection and Response (EDR)”.[3] To take the service into use, the customer deploys EDR sensors, assigns the “WithSecure MDR subscription code” under Management > Subscriptions, turns on Advanced Response in the security profiles, and names primary and secondary on-call contacts.[3] MDR coverage therefore depends on EDR seats. A device without EDR is not monitored, and a compromised “host that does not have WithSecure Elements Endpoint Detection and Response protection” is one of the triggers for a Major Incident.[3] The Co-Security page states that response time “is SLA-backed at 60 minutes for 90% of cases”.[1]
Incident Response Retainer and First Response Package
“WithSecure Managed Detection and Response solution includes an Incident Response Retainer.”[3] The retainer is activated when an incident qualifies as a Major Incident, meaning that any of the following applies:
- “The incident has spread to at least two hosts within the network.”
- A business-critical system or a system vital for operational continuity is at risk.
- A host without Elements EDR protection is compromised.[3]
“Incident Response Retainer includes one First Response Package: one prepaid day of incident-response work.” The package covers the first 72 hours after a serious incident, including scoping, a containment estimate and root cause analysis.[3] For support beyond MDR’s scope, “we recommend the WithSecure Incident Response Retainer”.[3] Catalog: MDR includes an Incident Response Retainer with one prepaid day, Major Incident threshold for retainer activation.
DFIR retainers and emergency response
The Elements DFIR Retainer is for Elements customers only. It “requires no pre-paid days, with services consumed on demand at pre-agreed rates”. “Broader use of the Elements platform unlocks greater DFIR discounts”, which WithSecure calls “an insurance-like model”.[1] The traditional IR Retainer is open to any organisation and “includes pre-paid days with discounted rates”. Organisations without a retainer can buy Emergency Incident Response, where services “are provided at standard day-rates, subject to availability”. Retainer clients instead receive “guaranteed 72-hour support and priority access”.[1] Catalog: Elements DFIR Retainer has no pre-paid days, WithSecure Elements DFIR Retainer.
Virtualization & partitioning
The Co-Security documents add no virtualization rules. MDR and Elevate operate on the devices covered by Elements EDR, which counts virtual machines as devices (see WithSecure Elements subscriptions and module licensing).
Cloud / BYOL
All Co-Security services are delivered by WithSecure through Elements Security Center, so bring-your-own-license terms do not arise. MDR for Identities extends monitoring to Microsoft Entra ID as an add-on for MDR customers.[1]
Programs
Co-Security services are sold through the same partner channel as Elements, and MSPs can resell them. WithSecure’s MSP pricing page describes WithSecure MDR as handling “24/7 detection and response on your behalf”.[4] The services also fall under the WithSecure Terms of Use, whose definition of “Solution” includes “services directly supporting your use thereof”.[6] See WithSecure partner and MSP licensing and WithSecure Terms of Use.
Out of scope
- Prices for Elevate token packages, MDR, retainers and Elements Infinite: not published.
- Service descriptions and SLA documents for MDR and Elements Infinite beyond the administrator guide: older WithSecure resource-library PDFs were not available at retrieval.
- Incident Readiness engagements, which are consulting services and not licences.
Catalog rows
- Metrics
- Rules
- Elevate: Validation Token first; Investigation Token for detections older than 7 days
- Elevate tokens expire with the subscription term (12, 24 or 36 months)
- Elevate is token-based pay-as-you-go; MDR includes tokens
- MDR includes an Incident Response Retainer with one prepaid day
- Major Incident threshold for retainer activation
- Elements DFIR Retainer has no pre-paid days
- Programs
- Sources