The five categories, plainly
Vendors describe all of these as security services, which is why comparing quotes feels impossible. They are not competing offers, they are different line items.
- Monitoring and response platform: software on your servers that detects attacks, misconfiguration and compromise, and usually acts on some of it automatically. Ongoing, priced per server per month, no humans included.
- Managed detection and response (MDR) or SOC-as-a-service: the same telemetry plus an analyst team that triages it and contacts you. Ongoing, several times the platform price, and the value is entirely in the humans.
- Hardening or audit engagement: a consultant reviews and fixes your configuration over days or weeks and delivers a report. One-off, project-priced, and its value decays from the day they leave.
- Penetration test: an authorised attacker tries to get in and documents how. One-off, project-priced. It finds problems; it does not fix them or watch for new ones.
- Managed service provider: someone runs your servers, with patching and some security folded in. Ongoing, priced per server, and the security depth varies enormously between providers.
What you are actually missing
The useful question is not which vendor, it is which gap. Four gaps, and each maps to a different category.
If nothing is watching your servers between incidents, you have a coverage gap, and a monitoring platform is the cheapest thing that closes it. This is the most common gap and the one most often solved by buying something far more expensive than necessary.
If alerts arrive and nobody is qualified or available to judge them, you have a judgement gap, and that is what MDR sells. Buying a platform will not fix it; it will produce more alerts nobody reads.
If your servers were built years ago and never reviewed, you have a state gap, and a hardening engagement or an automated audit fixes the current state. The question afterwards is what stops it drifting back.
If a customer, insurer or regulator is asking for proof, you have an evidence gap. That is a reporting requirement, and it is worth naming as such rather than buying detection you did not otherwise need.
What a monitoring platform should cover on Linux
If you are buying at this layer, this is the checklist worth holding a vendor to. Anything less and you are paying for partial coverage.
- Authentication: SSH brute force and successful logins, with source and method, not just a count.
- Privilege: sudoers, privileged group membership, setuid binaries and SSH keys, tracked as changes rather than as a snapshot.
- Integrity: changes to sensitive system paths and to web content, including WordPress core, plugins and themes.
- Vulnerabilities: installed packages matched against public CVE data for that specific machine, not a generic feed.
- Malware and persistence: webshells in web roots, suspicious processes including cryptominers and processes running from deleted binaries, and rootkit indicators.
- Network: outbound connections that deviate from the host baseline, which is how command-and-control traffic surfaces.
- Response: whether it acts automatically, how fast, and critically whether it can undo an action that breaks a service.
- Evidence: whether it produces reports you can hand to an auditor, and whether those reports distinguish what was verified from what was never checked.
Questions that separate serious vendors from the rest
What happens when your automatic fix breaks a production service? If there is no answer, automation is a liability rather than a feature. The honest answer is that the fix is verified after it is applied and reverted if the service stops responding.
What can your product not see? A vendor who cannot name their own gaps has not thought about them, or is not telling you. Backups, multi-factor configuration, data classification and encryption at rest are all common blind spots for host-based tooling.
Does your compliance report distinguish a verified control from one that was never assessed? A report that renders everything as pass or fail is asserting more than any tool can know, and it is the thing an auditor will pull apart first.
What happens to my data, where is it stored, and for how long? Ask before, not after.
Roughly what these cost
Precise numbers depend on your size and region, but the orders of magnitude are stable and worth knowing before you take a call.
A monitoring platform runs from tens of dollars per server per month. MDR is typically several times that per server, because you are paying for analysts. A hardening engagement is project-priced in the thousands and delivers a report. A penetration test is similar and delivers a different report. An MSP is priced per server per month and bundles far more than security.
The mistake worth avoiding is buying MDR to solve a coverage gap. If nothing is watching your servers at all, the platform closes that for a fraction of the cost, and you can add human triage later once you know what your alert volume actually looks like.
Where SecAI fits
SecAI is the first category: a monitoring and response platform for Linux servers, priced per server per month. An agent installs with one command and covers authentication, privilege changes, file integrity, package vulnerabilities, webshells, suspicious processes, rootkit indicators, outbound anomalies and website health, with AI security audits that score a server and produce specific fixes.
Response is automatic and reversible: it blocks an attacking source within seconds, and when it applies a fix it verifies the service still works and rolls the change back if it does not.
It is not MDR. There is no analyst team watching your dashboard, and it does not replace a penetration test or a consultant who understands your specific application. What it does is make sure something is watching continuously, act on the highest-volume attacks without waiting for a human, and produce evidence you can hand to someone who asks.