Acronis expands MDR toward broader workspace protection

Cyberattacks do not respect normal business hours: They can happen at night, on weekends and during holidays. Acronis MDR by Acronis TRU gives partners 24/7/365 expert monitoring, investigation and response without having to build their own security operations center (SOC).

Acronis is expanding the MDR service with capabilities that make this expertise easier to deliver and help partners address more risks. The developments build on a broader commitment to managed security: helping service providers protect the connected workspace while giving customers access to the expertise needed to investigate threats, respond effectively and maintain business continuity.

• Available now — expanded language support: Spanish, Italian, Japanese and Portuguese alongside English. French support is coming by November 2026.
• Available now — direct customer communication: An optional add-on enables incident notifications and reporting directly to designated customer contacts.
• Available now — telco self-activation: Eligible customers can activate MDR from the console once their provider enables the relevant offering.
• Coming by November 2026 — Dark Web Monitoring: Ongoing domain-based scans for exposed information, data and credentials that can help support client security conversations. Partners can already request a one-time scan as of today to reach out to clients.
• Coming by the end of 2026 — managed ITDR early access: Identity Threat Detection and Response for selected partners, with general availability targeted for Q1 2027.

An employee’s working environment spans devices, cloud applications, identities and business data. Those elements are connected: a compromised account can expose information across services, while leaked credentials can create an opportunity for further attacks. Protecting that environment requires an understanding of how individual risks can affect the wider business.

These risks also persist when the working day ends. A suspicious login on a Saturday night or an attack during a holiday still needs prompt investigation and response. Waiting until the next business day can give attackers more time to spread, steal data or disrupt operations. Effective protection requires 24/7/365 expert attention, even when the MSP’s own team is off duty.

For managed service providers (MSPs), that creates a practical challenge. Customers expect continuous protection, but each additional area of exposure brings more information to assess and more decisions to make. MSPs need access to specialists who can investigate incidents, explain what matters and support an appropriate response. As protection becomes broader, the capacity to operate it must grow too.

Delivered directly by the Acronis security operations center (SOC) and backed by the Acronis Threat Research Unit (TRU), the service provides 24/7/365 monitoring, investigation and response. It complements and amplifies Acronis Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR), helping partners turn visibility and response capabilities into an operated security service.

That relationship matters because identifying suspicious activity is one step in managing an incident. Someone must assess the evidence, determine its significance and coordinate the next actions. Acronis analysts bring that operational expertise into the MSP’s team, helping partners get more value from their existing EDR and XDR investment.

For customers, the impact of an incident is measured in disrupted operations as well as compromised systems. Acronis MDR Advanced connects containment and remediation with rollback, recovery from backups and applicable remote monitoring and management actions. Bringing these capabilities into the response process helps reduce handoffs between security and recovery teams and supports the return to normal operations. Actions follow the agreed service scope, available licenses, configuration and approvals.

Advanced includes threat hunting, on-request investigation and analysis, detailed root cause reports and ad hoc requests within scope. These services help partners understand what happened, what was done and where protection can improve. They also give MSPs 24/7/365 access to specialist work that can carry separate charges with other providers.

TRU’s experience extends across many partner environments. An unfamiliar threat may require a longer investigation when first encountered; when it appears elsewhere, known indicators and tested response playbooks can enable faster action. That shared knowledge gives individual MSPs a broader evidence base than they could develop from their own customer environments alone.

The service levels reflect different operational needs. Standard is a strong fit for security-centric MSPs that can act on findings and own remediation. Advanced is particularly suited to generalist MSPs seeking more hands-on support through investigation, remediation and recovery.

Acronis MDR by Acronis TRU achieved 100% conversion from its early access partner cohort to general availability: every participating partner continued with the service.

For Dutch MSP SIX ICT, the challenge was delivering continuous security expertise without building an internal SOC. Adding Acronis MDR by Acronis TRU to its existing Acronis environment provided 24/7 monitoring and reduced the operational burden on its team. CEO Robert Nieuwenhuijse highlighted the analysts’ technical knowledge, thorough investigations and communication: “It shows the seniority of the experts protecting our systems.” Read the SIX ICT case study.

An Australian provider, IT&T, offers another view of the operational benefits. Its customers include medical practices and other health care organizations. The company adopted Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) to bring its data protection and security services together, adding MDR and EDR/XDR. It can now offer continuous oversight with monthly SOC reports that customers can use in discussions with their boards. This makes the service valuable both to the team operating security and to the people who need to understand its results.

Language can be a practical barrier when teams need to exchange incident context and understand recommended actions. Support for Spanish, Italian, Japanese and Portuguese alongside English helps more partners work with Acronis MDR by Acronis TRU in a familiar language. French support is planned by November 2026.

The optional customer communication add-on gives partners another delivery choice. MSPs can enable Acronis to send incident notifications and reports directly to designated client contacts, supporting customers who need closer visibility into security events. For Telco providers, customer self-activation simplifies adoption: once the relevant offering is enabled, eligible customers can activate the available MDR service level from the console without involving the provider in every activation.

Partners can request a dark web scan today to help identify leaked information, data and credentials associated with a customer’s domain. Ongoing domain-based scans will be available as part of Acronis MDR by November 2026. Partners can use the findings to approach clients with concrete evidence of existing exposure and explain why further protective action matters.

The value continues beyond that initial conversation. Partners can use the findings to prioritize follow-up, guide customers on reducing credential risk and explain the role of ongoing detection and response. Identifying leaked data does not reverse its disclosure; it provides evidence that can inform action on the resulting risk.

Acronis plans to introduce managed ITDR in early access for selected partners by the end of 2026, with general availability targeted for Q1 2027. The direction reflects the importance of identities in controlling access to business systems and the need to bring managed security expertise to identity-related threats.

Acronis will continue extending managed security services across additional risks and attack vectors over the coming quarters. The ambition is broader workspace protection that brings expert support closer to the places where customers work and where threats can develop. Further service details will be shared closer to their launches.

For partners, the goal is to make that broader responsibility manageable: access to specialist expertise, efficient service delivery and a clear connection between threat response and business continuity. The expanded MDR capabilities and planned services are successive steps toward that goal, helping MSPs grow their security practices as customer needs evolve.

Explore Acronis MDR to find the service level that fits your team and the customers you protect.