This Managed Detection and Response Addendum (this “Addendum”) is entered into as of [ADDENDUM EFFECTIVE DATE] (the “Addendum Effective Date”) by and between Exaforce, Inc., a Delaware corporation (“Exaforce”), and [CUSTOMER NAME], a [JURISDICTION] [ENTITY TYPE] (“Customer”), and supplements the Master Services Agreement between Exaforce and Customer dated as of [MSA EFFECTIVE DATE] (the “Agreement”). All capitalized terms used herein shall have the meanings set forth in Section 8 hereof or, if not defined in this Addendum, in the Agreement.
NOW, THEREFORE, for good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:
1. Incorporation; Order of Precedence
This Addendum is incorporated into and forms part of the Agreement. MDR Services are “Services” for all purposes of the Agreement and, except as expressly modified by this Addendum, all terms of the Agreement apply to MDR Services. In the event of any conflict with respect to MDR Services, the following order of precedence applies: (a) the applicable Order Form, (b) this Addendum, and (c) the remainder of the Agreement.
2. MDR Services
2.1 Scope. During the Subscription Term, Exaforce will provide MDR Services on a continuous 24/7/365 basis, consisting of monitoring, Triage, investigation, and response guidance for Threat Findings and, where approved under Section 4, Authorized Actions, delivered through a combination of automated detection, AI Agents, and Exaforce security analysts, as further described in the Documentation and the applicable Order Form.
2.2 Coverage Model. Exaforce delivers MDR Services using a “follow-the-sun” model across multiple regional security operations centers and may determine and change the number, location, and staffing of those centers, provided that continuous coverage is maintained and Customer Data is processed in accordance with the DPA. Open Escalated Threat Findings are handed over between shifts without interruption.
2.3 Reporting. Exaforce will provide Customer, through the Services or as otherwise agreed in the Order Form, (a) a weekly, bi-weekly, or monthly summary of P2 and P3 activity, as selected by Customer, and (b) no less than quarterly, a service review covering Threat Finding volumes, Priority Level distribution, MDR SLA attainment, and tuning recommendations.
2.4 No Guarantee. MDR Services are intended to reduce, but cannot eliminate, security risk. Exaforce does not warrant that MDR Services will detect, prevent, or contain every threat or unauthorized activity, and Section 15.3 of the Agreement applies to MDR Services, including Outputs generated by AI Agents. Customer remains responsible for implementing any remediation steps recommended by Exaforce that are not Authorized Actions.
2.5 Onboarding; Steady State. Customer will promptly establish Connections to the Customer Systems identified for monitoring during onboarding and complete its obligations under Section 3.4. Once Connections have been established to at least forty percent (40%), by number, of such Customer Systems, and data containing the expected fields has been received through each such Connection at the expected volume, in each case as reasonably determined by Exaforce, for ten (10) consecutive days, Exaforce will promptly notify Customer, through the Services or by email (the date of such notice, the “Steady State Date”). Before the Steady State Date, MDR Services are provided on a commercially reasonable efforts basis and the MDR SLA does not apply.
2.6 Excluded Services. Unless separately ordered for additional Fees, MDR Services do not include (a) remediation, recovery, re-imaging, or reconfiguration of Customer Systems, other than Authorized Actions; (b) forensics or incident response beyond the investigation described in Section 2.1, including any engagement directed by Customer’s counsel or insurers; or (c) on-site services, litigation support, or communications with regulators, law enforcement, or other third parties on Customer’s behalf.
2.7 Detection Tuning. Exaforce may tune, suppress, consolidate, and automatically close detections and Threat Findings, including through AI Agents, to reduce false positives, and a Threat Finding suppressed or closed in accordance with the Documentation is not a failure to detect or respond. Exaforce will share applicable tuning and suppression rules upon request. Customer-created detection rules are Customer’s responsibility and are excluded from the MDR SLA.
3. Customer Responsibilities
3.1 Monitored Systems. Customer is solely responsible for selecting the Customer Systems that it connects to the Services through Connections for monitoring as part of MDR Services (the “Monitored Systems”). Exaforce’s ability to detect and respond to Threat Findings is limited to Monitored Systems, and Exaforce has no obligation to monitor, and no liability for any failure to detect or respond to activity within, any Customer System that is not a Monitored System.
3.2 Connections and Customer Credentials. Without limiting Section 7 of the Agreement, Customer will establish and maintain in good working order all Connections and Customer Credentials necessary for Exaforce to receive data from Monitored Systems and to take Authorized Actions, including by (a) renewing Customer Credentials prior to expiration; (b) promptly remediating any broken, misconfigured, throttled, or interrupted Connection; and (c) promptly updating Connections to reflect changes to Customer Systems, including new or decommissioned systems and changed permissions.
3.3 Degraded Coverage. Customer will promptly notify Exaforce if it becomes aware that a Connection has failed or is delivering incomplete, delayed, or duplicate data. Exaforce will use commercially reasonable efforts to alert Customer to Connections that appear to Exaforce to have materially stopped delivering expected data, but Exaforce does not guarantee detection of every such failure and has no other obligation to monitor the health of Connections or Customer Systems.
3.4 Approvers and Contacts. Customer will designate in the Services, and keep current, the Users authorized to approve Authorized Actions (“Approvers”), Customer’s escalation contacts, and its Monitored Systems. Any approval given by an Approver or through a Runbook constitutes valid authorization binding on Customer, and Exaforce will have no liability for acting in good-faith reliance on any such approval or on information that Customer has failed to keep current.
3.5 Effect of Non-Compliance. If Customer materially fails to comply with this Section 3 and does not cure within ten (10) business days after notice, Exaforce may suspend the MDR SLA and provide MDR Services on a monitoring-and-notification basis only until cured, and Fees for MDR Services will remain payable.
4. Authorized Actions
4.1 Grant of Authority. Customer authorizes Exaforce, acting through its security analysts and AI Agents, to take containment and remediation actions on Monitored Systems through Connections, limited to the categories of action that Customer has approved in the applicable Order Form, in a Customer-approved response playbook configured in the Services (a “Runbook”), or in the Services configuration, which may include isolating a host or endpoint, disabling a user account or credential, blocking an IP address, domain, or file hash within Customer’s connected security tooling, terminating a malicious process, or revoking a session token (each, an “Authorized Action”). Exaforce will provide recommended remediation steps and will not take an Authorized Action without Customer’s prior approval, given either in advance through a Runbook or by an Approver through the Services console or other approval mechanism specified in the Order Form.
4.2 Limits on Authority. Exaforce has no authority under this Addendum to bind Customer contractually, make representations to any third party on Customer’s behalf, or take any action that is not an Authorized Action. Exaforce’s exercise of authority under this Section 4 is undertaken solely as a service to Customer and does not (a) transfer ownership, control, or operational responsibility for any Customer System to Exaforce; (b) relieve Customer of its obligations under Sections 6 through 8 of the Agreement; or (c) make Exaforce an operator, controller, owner, or agent of any Customer System for any purpose other than performing the specific Authorized Action.
4.3 Liability for Authorized Actions. Except to the extent arising from Exaforce’s gross negligence or willful misconduct, Exaforce will have no liability for (a) business interruption, data loss, or other consequences resulting from an Authorized Action taken in accordance with Customer’s approval; (b) consequences resulting from inaccurate, incomplete, or untimely information, approvals, or escalation contacts provided by Customer; or (c) any Authorized Action that Exaforce reasonably believed was within the scope of Customer’s approval when taken.
4.4 Revocation. Customer may revoke or narrow any category of Authorized Action, including any Runbook, at any time by written notice to Exaforce through the Services console. Exaforce will use commercially reasonable efforts to implement any such revocation within one (1) business day after receipt and will have no liability for any Authorized Action taken before it has had a reasonable opportunity to implement the revocation.
5. MDR Service Levels
5.1 Priority Levels; MDR SLA. Exaforce will assign a Priority Level to each Threat Finding upon Triage. Exaforce will meet the applicable Time to Begin Investigation and Time to Initial Response set forth below for at least ninety percent (90%) of the Escalated Threat Findings at each Priority Level in each calendar month (the “MDR SLA”), beginning with the first full calendar month that commences after the Steady State Date. If the number of Escalated Threat Findings at a Priority Level in a calendar month is so low that a single miss would cause attainment to fall below ninety percent (90%), one miss at that Priority Level will be disregarded for that month.
5.2 Measurement; Status Changes. Response times are measured using the status timestamps recorded in the Services, which are the system of record. Each response time runs from the immediately preceding status change and stops when Exaforce enters the applicable status change, as follows: (a) “Time to Begin Investigation” runs from completion of Triage until Exaforce sets the Escalated Threat Finding to “In Progress”; and (b) “Time to Initial Response” runs from the time the Escalated Threat Finding is set to “In Progress” (or, for P2 and P3, from completion of Triage) until Exaforce sets it to “Transferred” or “Closed,” after taking any applicable Authorized Actions and recording in the Services the Authorized Actions taken and any remediation steps remaining for Customer. If Customer does not respond within seventy-two (72) hours, Exaforce may close the Escalated Threat Finding and record its recommendations in the Services. If Exaforce reclassifies an Escalated Threat Finding in good faith based on investigation findings, the response times for the new Priority Level run from the time of reclassification. Exaforce may consolidate Threat Findings arising from the same activity or root cause into a single Escalated Threat Finding.
5.3 Separate from Platform Service Levels. The MDR SLA applies solely to MDR Services and is separate and apart from any availability, support, or other service level commitments applicable to the Services under the Support Policy or an Order Form (the “Platform SLAs”). The Platform SLAs do not apply to MDR Services, and a failure to meet the MDR SLA is not a failure to meet any Platform SLA. Any unavailability or degradation of the Services, including the platform through which MDR Services are delivered, is excluded from the MDR SLA, and Customer’s sole and exclusive remedies therefor are those set forth in the Platform SLAs.
5.4 Exclusions. The MDR SLA does not apply to any failure to meet a response time to the extent arising from: (a) a Force Majeure Event or an outage of a Cloud Provider or other third-party service; (b) Trial Services or Preview Offerings; (c) any unavailability, degradation, or maintenance of the Services, as provided in Section 5.3; (d) Customer’s selection of Monitored Systems or failure to establish or maintain Connections or Customer Credentials under Section 3; (e) Customer’s failure to designate reachable Approvers or escalation contacts, or to respond to Exaforce requests reasonably necessary to continue Triage, investigation, or an Authorized Action; (f) changes to, or outages of, Customer Systems or Connections, including changes made without notice to Exaforce; (g) a volume of Threat Findings in any twenty-four (24) hour period exceeding three (3) times Customer’s average daily volume over the preceding thirty (30) days, including as a result of a mass security event or changes to Customer Systems; or (h) testing performed by or on behalf of Customer, including penetration or red-team testing without prior notice to Exaforce, or Customer’s breach of the Agreement. The MDR SLA also excludes P0 and P1 Escalated Threat Findings exceeding five percent (5%) and ten percent (10%), respectively, of all Escalated Threat Findings in a calendar month.
5.5 Remedies. Exaforce will review any failure to meet the MDR SLA with Customer at the next service review under Section 2.3 and will implement commercially reasonable corrective measures. Such review and corrective measures are Customer’s sole and exclusive remedies, and Exaforce’s entire liability, for any failure to meet the MDR SLA.
6. Performance Warranty
Section 15.1(a) of the Agreement applies to MDR Services, including Authorized Actions, as if references therein to Implementation Services included MDR Services, and Customer’s exclusive remedy for any breach thereof is as set forth in Section 15.1 of the Agreement. A failure to meet the MDR SLA is not, by itself, a breach of the Performance Warranty and is governed exclusively by Section 5.5.
7. Fees; Term
Fees for MDR Services will be set forth in the applicable Order Form and are subject to Section 13 of the Agreement. This Addendum remains in effect for so long as any Order Form for MDR Services is in effect and will automatically terminate upon the expiration or termination of the last such Order Form or of the Agreement. Sections 2.4, 3.1, 4.2, 4.3, and 5.5 will survive any expiration or termination of this Addendum.
8. Definitions
Capitalized terms not otherwise defined in this Addendum shall have the respective meanings assigned to them in this Section or, if not defined in this Section, in the Agreement.
“Escalated Threat Finding” means a Threat Finding for which Triage results in a recommendation of “Needs Investigation.”
“MDR Services” means Exaforce’s managed detection and response services described in Section 2, as ordered under an Order Form, including as part of the Exaforce Enterprise tier.
“Priority Level” means the classification (P0 through P3) assigned to a Threat Finding under Section 5.1.
“Threat Finding” means any event, alert, or activity surfaced by the Services from Monitored Systems for automated or analyst review.
“Triage” means Exaforce’s initial assessment of a Threat Finding, resulting in an assigned Priority Level and a recorded disposition and recommendation.
IN WITNESS WHEREOF, the Parties have executed this Addendum by their authorized representatives to be effective as of the Addendum Effective Date.
[CUSTOMER NAME]
By: ___________________
Name:
Title:
Date:
EXAFORCE, INC.
By: ___________________
Name:
Title:
Date: