On August 30, 2024, WhiteDog Cyber said it wanted to recruit roughly 100–200 managed service provider (MSP) partners to deliver its security platform to small and midsize businesses. The company called the offering “real XDR,” describing detection and response across email, DNS, identity, network, and endpoint—not just endpoint monitoring. That was a recruitment target, not a verified current partner count, and “real XDR” was WhiteDog’s positioning rather than an industry-standard certification. By 2026, the company’s public offer had expanded to include cloud, Open XDR, and Delta Detection & Response (ΔDR).
What WhiteDog was announcing in 2024
WhiteDog’s August 30, 2024 announcement was a channel-expansion pitch: the company wanted MSPs to sell and deliver managed security under their own customer relationships. Founder Shahin Pirooz said the target was approximately 100–200 service-provider partners. WhiteDog described the initial fit as SMB-focused MSPs that typically managed around 30–50 customer organizations; that was a reported profile, not a formal eligibility rule. The company had emerged from stealth in June 2023 and formally launched its platform in August 2023. WhiteDog’s 2024 announcement
The channel was central to the model, not merely a reseller outlet. WhiteDog’s stated proposition was to supply the technology integration and security operations that smaller service providers might not be able to build and staff themselves, while the MSP retained the customer relationship and presented the service under its brand. In 2023 launch materials, WhiteDog claimed 30-day onboarding, no implementation fees, and “100% margin” for partners. Those are company claims from launch-period materials; the basis for the margin figure and the current applicability of those terms are not established publicly. WhiteDog’s 2023 launch announcement
What WhiteDog means by “real XDR”
EDR generally focuses on endpoint telemetry and response. MDR describes a managed service that monitors and responds using security tools, which can include EDR, SIEM, or other products. XDR is commonly used for products that correlate signals across more than one security domain. These labels vary across vendors, so the practical distinction is what data a service can use and what actions it can actually take.
#1 Best Overall
- APPLIANCE ONLY: Hardware unit sold without a service subscription — security services, firmware updates and support are NOT included and must be purchased separately to activate protection.
- PERFORMANCE: Up to 2.5 Gbps firewall inspection, 1 Gbps threat prevention and 1.2 Gbps IPSec VPN throughput driven by SonicWall's patented Reassembly-Free Deep Packet Inspection (RFDPI) engine.
- CONNECTIVITY: 8x1GbE + 2x1G SFP in a desktop form factor; zero-touch deploy and manage on-box or via cloud Network Security Manager (NSM).
- THREAT PROTECTION: SonicOS 8 delivers intrusion prevention, gateway anti-malware, application control, TLS/SSL decryption, Capture ATP multi-engine sandboxing (RTDMI) and reputation-based content & DNS filtering with an active service subscription.
- BUILT FOR SMALL BUSINESS & BRANCH: Secure SD-WAN, IPSec and SSL VPN plus Zero-Trust Network Access through Cloud Secure Edge keep distributed sites and remote workers protected.
WhiteDog’s “real XDR” argument is that a service should respond across multiple layers, not simply gather detections from multiple sources and then act mainly on endpoints. Its 2024 description named email, DNS, identity, network, and endpoint. The company has argued that some competing XDR offerings broaden detection inputs while keeping response centered on the endpoint; that is WhiteDog’s vendor claim, not an independently established description of the market. 2024 platform description; WhiteDog’s explanation of its MSP security model
To evaluate the distinction, an MSP should ask separately about four things:
- Telemetry: Which data sources are connected, and how much information is collected?
- Detection: Which suspicious events can the service identify in each domain?
- Response: Can it take action in that domain, or does it only recommend a step or send an alert?
- Ownership: Does WhiteDog, the MSP, the customer, or a third-party vendor approve and execute the action?
A list of covered domains answers only the first question. It does not prove that detection and response are equally available across them.
How the composable platform is meant to work
WhiteDog described its architecture as composable: it combines capabilities from multiple vendors, with the option to use individual services, selected components, or a broader platform. It said it periodically evaluates underlying tools and could replace a component without requiring the MSP or customer to reconfigure the service. WhiteDog’s description of its architecture
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsFor an MSP, the appeal is less tool sprawl, a common portal and reporting layer, and potentially fewer integrations and vendor relationships to maintain. WhiteDog’s current site also says customers can use existing tools, its curated stack, or a combination. The trade-off is that the MSP may have less direct control over the underlying products. A backend substitution could affect detection logic, integrations, data retention, agents, response actions, or the evidence customers see. The company’s replacement promise should therefore be checked against contract language and change-notification procedures.
Rank #2
- SECURE UPGRADE PLUS PROGRAM (2-Yr, Advanced Edition): SonicWall upgrade path that bundles a new TZ280 appliance with the Advanced Protection Suite (APSS). REQUIREMENTS: for customers upgrading from an existing SonicWall firewall; a qualifying prior unit may be required at registration.
- SERVICE BUNDLE – ADVANCED PROTECTION SUITE (APSS): all Essential services plus Capture ATP cloud sandboxing with patented RTDMI, advanced DNS security, cloud Network Security Manager (NSM) management, reporting & analytics, and 24/7 support — SonicWall's recommended all-in security suite.
- PERFORMANCE: Up to 2.5 Gbps firewall inspection, 1 Gbps threat prevention and 1.2 Gbps IPSec VPN throughput driven by SonicWall's patented Reassembly-Free Deep Packet Inspection (RFDPI) engine.
- CONNECTIVITY: 8x1GbE + 2x1G SFP in a desktop form factor; zero-touch deploy and manage on-box or via cloud Network Security Manager (NSM).
- BUILT FOR SMALL BUSINESS & BRANCH: Secure SD-WAN, IPSec and SSL VPN plus Zero-Trust Network Access through Cloud Secure Edge keep distributed sites and remote workers protected.
“Composable” does not mean dependency-free. Before adopting the service, an MSP should identify the underlying vendors and subprocessors, understand how tool changes are governed, and confirm data ownership and portability if the relationship ends. WhiteDog’s public positioning does not independently establish that its stack choices are best-in-category or that substitutions are invisible in every customer environment.
What the partner model offers—and what to verify
WhiteDog’s published partner materials describe white-label and multi-tenant delivery, training, sales enablement, technical support, and flexible billing. Company materials have also described partners starting at Gold tier with up to 24 months to meet revenue goals. These terms come from materials published at different times and should not be assumed to describe the current program without confirmation. WhiteDog partner-program discussion
WhiteDog has described monthly, quarterly, and annual billing, with additional discounts for annual payment, but it has not published a verified dollar price or discount percentage in the cited materials. Monthly billing language should not be read as proof that there are no minimum commitments or contract terms. WhiteDog’s billing discussion
Free tools Windows power users keep installed
One-click scans. No signup required.
White-labeling can help an MSP preserve its brand, but it also raises accountability questions. If the customer sees only the MSP’s name, the customer may not know who operates the security operations center, makes containment decisions, conducts investigations, or bears responsibility for missed alerts. The MSP should define those roles in both its partner agreement and customer contract.
WhiteDog’s 2023 “100% margin” claim also needs a definition. It does not by itself establish profit after sales, onboarding, account management, support, and customer acquisition costs. The MSP should model its own labor and obligations, not treat the phrase as a profitability calculation. 2023 launch materials
Why an MSP might use an outside platform
Building managed security internally can mean hiring and retaining security specialists, maintaining integrations, supporting tools, and arranging meaningful coverage outside business hours. A platform partner may let an MSP add a security service without first building a full security operations center. It can also give smaller customers access to managed services they would be unlikely to operate on their own.
WhiteDog said it would handle integration, correlation, threat hunting, security operations, and the backend stack, while providing customer-facing security statistics through its portal. That scope should be translated into operational commitments: who approves a containment action, who contacts a customer during an incident, what escalation times apply, and whether forensic investigation or recovery work is included or billed separately. WhiteDog’s 2024 description of its services
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →An early partner, BACS Consulting Group, told WhiteDog that the platform reduced the need to integrate multiple security vendors and let the firm focus on its managed-services business. That is a partner testimonial, not independent evidence of detection quality, financial returns, or results across other MSPs. Partner comments in WhiteDog’s announcement
Outsourcing operations does not remove the MSP’s need to understand customer environments, maintain asset inventories, communicate risks, coordinate remediation, and help customers recover. A small provider may not need its own SOC, but it still needs enough internal security expertise to act as a responsible service provider.
What WhiteDog markets today
WhiteDog’s current public materials present a broader unified platform than the 2024 recruitment story. Its website lists email, DNS, identity, endpoint, network, and cloud coverage, along with 24×7 security operations, AI-assisted correlation, human validation, threat hunting, and continuous incident response. These are vendor descriptions, not independent performance findings. WhiteDog’s current website
Rank #4
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
The current solutions page lists EDR, MDR, XDR, Open XDR, and ΔDR, as well as security operations, access and zero-trust network access, mailbox security, and attack-surface and posture services. WhiteDog says continuous incident response is included with MDR, XDR, and ΔDR; the scope, exclusions, and remediation boundaries should be confirmed for the specific service and contract. WhiteDog solutions
Recommended Free Tools
WhiteDog introduced ΔDR, or Delta Detection & Response, as a category intended to address gaps the company sees in conventional XDR. Its announcement describes coverage across identity, storage, DNS, mailbox, network, and external exposure, with continuous incident response. The category name and claim that it closes XDR gaps are WhiteDog’s framing, not a market consensus or independent validation. WhiteDog’s ΔDR announcement
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Questions to settle before joining
A useful evaluation should move beyond product names and marketing claims. Request written answers, demonstrations, and contract terms for the following:
- Response authority: Can the service quarantine email, block malicious DNS, disable or challenge an identity, isolate an endpoint, or block network traffic? Which actions are automatic, which require approval, and which depend on a third party?
- Integration depth: Which Microsoft 365, Google Workspace, identity-provider, endpoint, network, SIEM, ticketing, and PSA integrations are supported? For Open XDR, what can each integration read and change?
- Tenant controls: What isolation, role-based access, delegated administration, customer-specific policies, audit logs, branding, and reporting are available?
- Operational evidence: What alert and investigation records can the MSP access? What are escalation procedures and response-time commitments? Is evidence export available?
- Data governance: Where is data stored, how long is it retained, who owns it, which subprocessors receive it, and how can it be exported at termination?
- Commercial terms: What are the billing unit, minimum commitment, renewal and price-change rules, partner margin calculation, implementation charges, and costs for work outside the standard subscription?
- Customer relationship and liability: Who contracts with the end customer, who handles breach communications, who is liable for missed detections or delayed action, and what happens to the customer if the MSP relationship ends?
- Service scope: What does 24×7 operation mean in staffing and escalation terms? Does continuous incident response include hands-on containment, forensics, and recovery, or only coordination?
A 30-day onboarding statement also needs precise definition. Provisioning access is not the same as deploying agents, configuring email and DNS, integrating identity, tuning policies, preparing customer contacts, and validating response procedures. Ask what milestone the 30 days measures and whether it is a contractual guarantee or an implementation target.
Finally, ask for operational performance evidence relevant to the service being purchased. The public materials cited here do not establish independent mean-time-to-detect or response results, false-positive rates, SOC staffing levels, uptime, incident volume, or customer retention. A vendor presentation can explain its approach; it cannot substitute for service-level commitments, references, and a review of the actual operating evidence available to partners.
Best Value
- SonicWall TZ370 High Availability Unit (02-SSC-6443) - Seamless Failover Protection: Designed to pair with a primary SonicWall firewall for automatic failover and continuous network uptime. Not a Standalone unit - requires an identical primary SonicWall appliance; cannot function independently.
- Protects against encrypted malware and intrusions using DPI-SSL inspection, IPS, anti-malware, and Capture ATP sandboxing with RTDMI detection.
- Secure SD-WAN intelligently steers traffic across links to reduce MPLS costs and improve cloud application performance for branch users.
- Zero-Touch deployment, SonicExpress onboarding, and centralized management via Network Security Manager simplify rollout and ongoing operations.
- Scales up to 900,000 to 1,000,000 concurrent connections depending on policy mix, supporting secure growth across users and devices.
How to compare the operating models
WhiteDog is one way to deliver managed security, not the only one. The right comparison is often between operating models rather than product logos.
Build and operate an internal stack
This can suit larger MSPs with security engineers, integration expertise, and enough scale to spread staffing and tool costs. It offers more direct control and customization, but makes the MSP responsible for maintaining the stack, arranging coverage, and managing incident operations.
Use a single-vendor XDR or MDR platform
A single-vendor suite may integrate more deeply within its own ecosystem and can be a better fit where customers already standardize on that provider. It may offer less vendor neutrality, and the MSP still needs to determine how much service, monitoring, and response work it must provide itself. Official products to evaluate include Microsoft Defender XDR, CrowdStrike Falcon, SentinelOne Singularity, and Palo Alto Networks Cortex XSIAM. These are comparison candidates, not a feature-by-feature verdict; current capabilities, service terms, and channel requirements should be assessed directly.
Partner with an independent MDR provider
This can fit an MSP seeking outsourced monitoring and response without adopting a broader composable platform. Compare white-label rights, multi-tenancy, telemetry access, supported security domains, incident-response scope, pricing, and who retains the customer relationship.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Use a managed platform as an overlay
WhiteDog says customers can retain existing tools, use its curated stack, or combine the two, and its Open XDR positioning is intended to support third-party tools. Confirm the particular integrations and the response actions they support before assuming that an existing product will work as a full participant in the service. WhiteDog’s partner and Open XDR discussion
Who the model may fit
A white-label, multi-tenant service may be worth evaluating for an SMB-focused MSP that wants to add managed security but lacks a SOC, prefers one operational relationship, and is comfortable relying on an outside provider for specialist operations. It may be a weaker fit for an MSP that needs direct control of every underlying tool, has already invested in its own SOC and integrations, requires public pricing, or cannot accept the dependence and accountability obligations of a white-label provider.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
