Todyl

Who uses Todyl and what it's for

Todyl sells only through the channel, so its direct customers are managed service providers, IT teams, and security professionals who protect small and mid-sized businesses.¹ Its founder's author page says the platform protects more than 10,000 businesses.² Its best uses are consolidating secure access, endpoint protection, log monitoring, and compliance tracking for many client companies, with a managed detection and response team watching alerts around the clock.³

MSP owners quoted on Todyl's homepage describe the consolidation. Paul Havens, the CEO of IT Haven, says: Before Todyl, we were using about 8 tools per machine, which was a hassle to image and onboard. Now, we just use Todyl and our RMM, and have cut our onboarding time down to less than an hour.⁴ Justin Mirsky of DBT says he called on Todyl's detection engineers on a Sunday and they agreed right away.⁴

Todyl does not publish prices. Its competitors include MSP-focused MDR providers such as Huntress and Blackpoint Cyber and SIEM platforms such as Blumira.

One Agent for SASE, Endpoint, SIEM, and MXDR

The Todyl platform combines Secure Access Service Edge (SASE), endpoint security (EDR and next-generation antivirus), SIEM, managed extended detection and response (MXDR), security orchestration and response (SOAR), and governance, risk, and compliance (GRC) in a cloud platform with one agent.¹ Its investor TechOperators says customers can turn on modules as they need them without disrupting what they run today.⁵

Todyl added SOAR with its Series B in 2024, launched a product it calls Unified Assurance in 2026, and announced on October 13, 2026 that IRONSCALES email security will be available as a module inside the platform.¹³⁶

RSA's Security Operations Center Runs on Todyl

In January 2026, RSA, the identity security company, selected Todyl to protect its commercial and corporate environments and power its security operations center, replacing incumbent tools.⁷ Robert Hughes, RSA's CISO, said in the announcement: We chose Todyl to protect our most sensitive assets, and we haven't looked back.⁷ For a platform aimed at MSPs, a security vendor running its own SOC on it is unusual evidence of depth.

A Channel-Only Company From Denver

John Nellen founded Todyl in 2015 after nearly eight years at Next Jump, where he was Senior Director of Engineering and Technology and Head of Information Security.² The first platform, with SASE and SIEM, launched in 2020, and a second version added EDR and MXDR in 2022.³ The company moved into its Denver headquarters in 2023 and opened an office in Augusta, Georgia, in 2024.³

Base10 Partners led a $50 million Series B in March 2024, with Anthos Capital, TechOperators, and StoneMill Ventures, and Datto founder Austin McChord joined the advisory board.¹ TechOperators led the seed round and invested again in the Series A and Series B.⁵ Todyl says it has raised $85 million in total and has more than 150 employees in four offices.²

How it compares with Huntress and Blackpoint Cyber

Huntress also sells mostly through MSPs and adds a 24/7 SOC to managed EDR, identity, and SIEM products, and it publishes per-unit prices. Blackpoint Cyber sells managed detection and response through IT service providers. Todyl's difference is networking: its SASE module gives client employees secure remote access through the same agent that runs endpoint protection.¹

A buyer that has secure remote access in place and only wants a managed SOC has less reason to take on Todyl's broader platform.

Where Todyl falls short

Todyl's pricing sits behind a request form, so an MSP cannot compare per-endpoint costs with rivals before talking to sales.⁸ Companies that want to buy directly cannot, since Todyl sells only through channel partners.¹

Replacing several tools with one agent also concentrates risk with one vendor. Email security arrived only in October 2026 through a partnership with IRONSCALES, so that module has a short track record inside the platform.⁶