Quorum Cyber to acquire Ontinue in Microsoft-first MXDR deal

Edinburgh-based Quorum Cyber has signed a definitive agreement to acquire Zurich's Ontinue, combining two Microsoft-focused managed security operations businesses.

By The Datatech Times Editorial Team AI level 2 of 5
AI level 2 of 5: drafted by our AI editorial assistant from the company's announcement; fact-checked, edited and signed off by Mark Walker, Editorial Director. What the levels mean
A close-up of a metal door handle with a glowing green fingerprint reader securing a door, set against a blurred background of server racks with green indicator lights and white cables in a data center.

Quorum Cyber has signed a definitive agreement to acquire Ontinue, a Zurich-based provider of managed extended detection and response (MXDR) services built around Microsoft's security stack. The Edinburgh-founded company said the combination would create what it describes as the largest Microsoft-first MXDR offering, spanning agentic security operations, incident response, and cyber resilience services across North America, the UK, and the DACH region.

Financial terms were not disclosed. Eterna Growth Partners, the North American private equity firm that currently holds a majority stake in Quorum Cyber, will remain the majority investor in the combined entity. The transaction is subject to customary closing conditions and any required regulatory approvals; both companies will continue to operate independently until then.

The deal

The strategic rationale centres on the convergence of agentic AI and security operations. Ontinue built its platform on what it calls an Agentic SOC, in which AI agents investigate, prioritise, and act on threats within customer-defined guardrails, rather than surfacing alerts for human triage one by one. Quorum Cyber brings complementary capabilities in proactive risk reduction, professional services, and deep threat intelligence, along with the 2025 Microsoft Security MSSP of the Year award.

Kevin Hanes, chief executive of Quorum Cyber, said: "The union of Quorum Cyber and Ontinue is a major step forward in evolving our portfolio for that future and bringing to market the largest Microsoft-first MXDR combining machine intelligence with the judgment, expertise and accountability customers need to move forward with confidence."

Both companies are members of the Microsoft Intelligent Security Association (MISA) and hold Microsoft Gold Partner status, with collective accreditations spanning Microsoft Sentinel, Defender XDR, Entra, Purview, Microsoft Security Copilot, and the company's recently announced Project Perception agentic security framework. The combined portfolio is intended to help enterprise customers operationalise Microsoft's broader AI-first security roadmap, including Copilot and agent deployments, within governed, auditable operating models.

Market context

The MXDR market has become one of the most actively consolidated segments of the managed security services space. Hyperscalers, specialist MSSPs, and systems integrators are all competing to own the security operations layer as enterprise customers consolidate vendors and shift from point tools to integrated platforms. Microsoft's growing dominance of the enterprise security stack, through the tight integration of Sentinel, Defender, and its Copilot-adjacent security products, has created a distinct sub-market for partners able to operationalise that ecosystem at scale.

The deal also reflects a broader industry wager on agentic AI in security operations. Several well-funded vendors are pursuing the same thesis: that the asymmetry between attacker automation and defender response time can only be closed by AI systems that act autonomously within defined boundaries, not by adding more analysts to a SIEM queue. Whether agentic SOC platforms can deliver measurably lower mean-time-to-contain figures at enterprise scale remains an open empirical question; published, independently audited benchmarks are scarce across the category.

Regulatory read-across

The geographic scope of the combined business, covering the UK, North America, and the DACH region, places it across several distinct compliance regimes simultaneously. UK operations fall under the National Cyber Security Centre's Cyber Essentials and CHECK frameworks, while DACH-based customers are increasingly subject to NIS2 transposition obligations, which EU member states were required to implement by October 2024. Customers in regulated sectors such as financial services will expect the combined company to hold relevant certifications, including ISO 27001 and SOC 2 Type II, and to demonstrate data-residency controls that satisfy both GDPR and sector-specific requirements.

Quorum Cyber was founded in Edinburgh in 2016. Ontinue was advised by Raymond James and law firm Bär and Karrer; Quorum Cyber was advised by Mintz, Macfarlanes, and Schellenberg Wittmer.

Sector

Topic

Geography