PHILADELPHIA – October 29, 2026 -- Clone Systems, Inc. has rebuilt its Managed SOC + SIEM as a 24/7 managed detection and response (MDR) service priced per endpoint, with the SIEM included and no log-ingestion fees. The service runs on the company's own private, self-hosted AI. Customer logs are never sent to an outside AI provider or used to train public models.
The pricing model targets a cost problem for buyers. Auditors, cyber insurers and boards increasingly demand proof of continuous monitoring, and PCI DSS v4.0.1 has required automated review of audit logs under Requirement 10 since March 31, 2025. Clone Systems says many organizations told to "get MDR" find the SIEM, log ingestion and AI features priced separately. Others find that AI-assisted triage means sending sensitive logs to a third-party model.
Per-endpoint pricing starts at 50 endpoints and includes SIEM, AI and analysts
The minimum order is 50 endpoints. The price covers the SIEM, the AI and round-the-clock analyst coverage. Onboarding from first call to full coverage takes a few weeks.
Director of Strategic Development Jorja Mandy said "very few want their logs leaving the building" for AI processing. She added that, with the SIEM included, the quoted price does not climb as log volume grows.
Analysts in the US and EU respond to critical alerts in under a minute
Clone Systems analysts in the United States and the EU monitor, investigate and respond around the clock. Detection rules run every minute. The SIEM correlates logs from endpoints, servers, firewalls, cloud and SaaS in one console, with more than 100 integrations including CrowdStrike, SentinelOne, Microsoft 365, Okta, AWS, Microsoft Azure, Google Cloud, Proofpoint and Mimecast.
The Clone Systems AI Assistant investigates alerts and drafts response steps inside the company's own infrastructure, and an analyst approves every action. Integrated endpoint detection and response (EDR) and managed intrusion prevention let analysts contain threats at the endpoint.
Dedicated instances sit in Philadelphia, Athens or Limassol, or in the customer's environment
Each customer gets a dedicated instance hosted in Clone Systems data centers in Philadelphia, Athens or Limassol. It can also be deployed in the customer's own environment so logs never leave it.
The service ships with twelve standard reports, including a monthly executive report and a compliance evidence pack. Alerts are mapped to PCI DSS, HIPAA, GDPR, NIST 800-53 and SOC 2, and logs are retained for 12 months for PCI DSS.
One provider can cover PCI Requirements 10, 11.3 and 11.4
Clone Systems has been a PCI Security Standards Council Approved Scanning Vendor since 2007. It also sells PCI ASV scanning, vulnerability scanning and penetration testing, each separately. Buyers can therefore address logging (Requirement 10), scanning (11.3) and penetration testing (11.4) with one vendor.
Vice President of Business Development Elyse Hamilton said buyers should not have to assemble a SIEM license, an ingestion plan and a monitoring contract to meet a single requirement. The rebuilt Managed SOC + SIEM is available now to organizations worldwide.