Flamingo Raises $4.5M Seed Round · Led by Vertex Ventures, bringing total funding to $6.7M to build the open, AI-native layer for IT and security.
Conrad Lunderstedt
ThreatDown review for MSPs and IT teams: the four bundles from Core to Ultimate, published per-device prices, OneView, integrations, buyer trade-offs and who it fits.
Updated: October 2026
Malwarebytes built its name on malware removal. Its business line now sells that detection as a full endpoint stack, with managed response and a console built for service providers. This ThreatDown review covers the four bundles, the published prices, how OneView works for MSPs and where buyers report friction.
ThreatDown is the business security brand of Malwarebytes. The company launched it on November 7, 2023, at the IT Nation conference. It replaced the Malwarebytes for Business name and split the company into two units: Malwarebytes for consumers and ThreatDown for businesses, partners and MSPs.
The product is one lightweight agent and one cloud console. The agent deploys to Windows, macOS and Linux endpoints, per ThreatDown's MDR page. Single-company customers use the Nebula console. MSPs use OneView, the multi-tenant version, to manage every client from one place.
Everything is sold as a bundle. Each tier adds capabilities on top of the one below, from next-gen antivirus up to a fully managed service with a published SLA.
ThreatDown's pricing page lists four bundles. Here is what each one adds, read from that page on October 22, 2026.
| Bundle | What it adds | Key features |
|---|---|---|
| Core Next-Gen AV | The base layer | Next-gen AV, automated remediation, device control, application block, vulnerability assessment, browser phishing protection, AI visibility |
| Advanced EDR | Detection and response | Everything in Core plus EDR (endpoint detection and response), ransomware rollback (up to 7 days), patch management, host firewall management, Windows drive encryption, managed threat hunting |
| Elite MDR | 24/7 human response | Everything in Advanced plus round-the-clock MDR (managed detection and response) and ThreatDown AI recommendations that admins approve before they run |
| Ultimate MDR Plus | Fully managed | Everything in Elite plus MDR Plus (malware removal, root cause analysis, threat intelligence, dark web exposure monitoring, published SLA), identity threat detection (ITDR) and Premium Support |
The jump that matters is Core to Advanced. Core is built to block threats, but has no EDR, no rollback and no patching. For a team weighing what EDR buys, our EDR vs XDR guide covers the difference.
At the top of the ladder, ITDR watches identities in Active Directory, Entra ID and Okta from the same console, per ThreatDown's ITDR page.
ThreatDown publishes direct prices on its own store. These are the US list prices per device per year on a one-year term, read from ThreatDown's pricing page and store on October 22, 2026:
| Bundle | Per device, per year | Monthly equivalent (annual / 12) |
|---|---|---|
| Core Next-Gen AV | $69 | $5.75 |
| Advanced EDR | $79 | $6.58 |
| Elite MDR | $99 | $8.25 |
| Ultimate MDR Plus | $149 | $12.42 |
A three-year term saves 20%, so Core drops to $165.60 per device for the full three years. The online cart takes 5 to 20 devices. Larger fleets buy through sales or a partner. Prices, bundles and terms change, so confirm with ThreatDown or your distributor before you buy.
MSP rates aren't on the page. Partners buy through the ThreatDown MSP Partner Program or a distributor such as Pax8, and those rates are quoted, not published.
The $10 step from Core to Advanced is the cheapest upgrade in the ladder, and it's the one that adds EDR and patching.
Four items sit outside every bundle, Ultimate included: DNS filtering, email security, server protection and mobile security. Mobile security covers Chromebook, Android, iOS and iPadOS devices. Premium Support is an add-on below Ultimate. ITDR is an add-on on Advanced and Elite and isn't offered on Core.
Server protection is the line to watch. A quote built on workstation counts alone leaves the servers unprotected or unpriced. Count servers, phones and mailboxes before comparing ThreatDown against a vendor that bundles them.
Illustration by Flamingo, not a ThreatDown quote.
OneView is the multi-tenant console. One login shows every client, and each client gets its own policies, dashboards and reports.
For MSPs, the billing tools stand out. The OneView product page lists usage per customer down to the site, with billing history, reconciliation data and an audit log.
The same console now includes a free Risk Exposure Report across your client base. ThreatDown's own MSP Unfiltered series walks through it:
ThreatDown's integrations page, read October 22, 2026, lists these connections:
Depth varies by tool. The Atera integration provisions OneView licenses and deploys agents from inside Atera. The Datto RMM one deploys and removes agents. Check the specific workflow you need, not just the logo.
The pricing is readable. A buyer can see the per-device cost of every bundle before a sales call.
One agent covers the whole ladder. Every bundle runs on the same lightweight agent and console, so an MSP can start a cost-sensitive client low and move it up later without switching vendors.
Ransomware rollback, from Advanced up, restores files that were encrypted, detected or modified up to 7 days after an attack, per the pricing page.
Patch management sits inside the EDR bundle. Teams that patch with a separate tool can still use it, but a small shop can cover patching and endpoint security from one console.
ThreatDown AI, in Elite and above, explains detections in plain language and suggests actions. An admin reviews and approves each one, so the technician stays in charge of what runs.
Coverage outside workstations costs extra. Servers, email, DNS filtering and mobile devices are add-ons on every bundle, so the list price is a floor, not the total.
Partner pricing is a quote. The published store covers 5 to 20 devices; MSP and volume rates come from the partner program or a distributor, which makes side-by-side comparison slower.
The pricing page describes drive encryption for Windows workstations, read October 22, 2026. If you manage Macs, confirm macOS coverage with ThreatDown before you count on it.
User ratings, read October 22, 2026: G2 shows 4.6 out of 5 from 1,090 reviews. SoftwareReviews shows ThreatDown EDR at 9.0 out of 10 from 477 reviews, with a Plan to Renew score of 99.
G2's pros and cons summary puts ease of use at the top of the pros. Customer support appears on both sides: it is a common pro, and poor customer support is the most-cited con. Test a support ticket during the pilot.
Opinion on r/msp splits. In an April 2025 thread comparing it with Bitdefender, one MSP said ThreatDown had caught things their SentinelOne setup did not, while others preferred Bitdefender, citing its test record. Another used it for cost-sensitive clients. Our Bitdefender GravityZone review covers that alternative.
Replies were mixed in a March 2025 thread titled "Threatdown (Malwarebytes) and huntress". One MSP removed it after performance complaints and another called a production trial a poor fit, while others said it blocked threats well and stayed for ransomware rollback. Run a pilot on your heaviest machines before a fleet rollout.
In an r/msp post from the start of September 2026, one reseller said ThreatDown asked for three monthly $100 payments after they left the MSP program. In a follow-up comment, the same poster said the fee was mentioned verbally and that the contract they signed does not mention it. A commenter who buys through Pax8 said that route came with no strings attached.
That's one partner's account, not a published policy. Still, ask for the full partner agreement before signing, and compare direct terms against distributor terms.
A short pilot answers the questions those threads raise. ThreatDown offers a free trial, so keep it to one or two clients with mixed hardware:
ThreatDown fits a small IT team or MSP that wants EDR, patching and 24/7 MDR from one agent, with a price it can read before talking to sales. It suits fleets of mixed clients where OneView's per-site billing saves admin time.
Look elsewhere if you already run Huntress on top of Microsoft Defender and want to keep that pairing. Our Huntress review covers that model. The same goes if your clients need server, email and mobile coverage in one price, or if you can't pilot on your heaviest machines first.
ThreatDown is one layer. It still needs backup, identity and a way to confirm the agent is running on every device you bill for. Our MSP security stack guide maps the full set.
Flamingo has no commercial relationship with ThreatDown or Malwarebytes, and it builds OpenFrame, which competes with some of the tools covered here. OpenFrame, Flamingo's open, AI-native infrastructure layer for IT and security, can run a script across a client's devices and collect the output, which is one way to spot machines where the agent is missing.
Solution Architect
I'm Conrad, Solution Architect at Flamingo. I've spent about 26 years in IT, roughly half of it inside MSPs and the rest in enterprise environments, so I've watched vendor decisions get made on both sides of that line. Now I spend my days talking with MSPs about the stack they already run, and helping them work through the requests and issues that come with it.
Still deciding?
Ask Mingo answers from our docs and customer stories.
Still deciding?
Ask Mingo answers from our docs and customer stories.