Quorum Cyber agrees to buy Ontinue from EQT in Microsoft MDR deal
Both providers build their managed security services on Microsoft's tools. The combined business would put AI agents at the center of its security operations, aiming at customers in North America, the UK and German-speaking Europe
- Deal value: not disclosed
- Majority investor after closing: Eterna Growth Partners, which already backs Quorum Cyber
- Until closing, the two companies operate independently
- Advisers: Mintz, Macfarlanes and Schellenberg Wittmer for Quorum Cyber; Raymond James and Bär & Karrer for Ontinue
- Both firms are members of the Microsoft Intelligent Security Association
Customers of either provider should check the change-of-control and assignment clauses in their contracts, and ask in writing which security operations center, platform and named team will serve them once the businesses combine. Hold the new owner to existing response-time service-level agreements and reporting during integration, when analyst turnover and tooling changes tend to bite. Firms buying MDR more widely should note how closely both providers tie their service to Microsoft's security stack, and test whether their own non-Microsoft logs and tools would still be covered.
“AI has changed the speed, scale and economics of cyber defense. The future is not security teams managing more tools; it is experienced defenders directing AI-powered systems that can work continuously and act at machine speed, with humans firmly in control.”Kevin Hanes, chief executive, Quorum Cyber
Quorum Cyber, an Edinburgh-based managed security provider, has signed a definitive agreement to acquire Ontinue from the EQT Mid Market Europe fund, the companies announced on 16 September 2026. Ontinue serves more than 250 customers in Europe and the US.
Ontinue sells managed extended detection and response (MXDR): round-the-clock security operations run on its own ION platform, which Ontinue says uses AI agents to investigate and act on threats within limits the customer sets. It began as the managed detection and response (MDR) arm of Open Systems and became a standalone company in 2023. EQT says Ontinue has roughly doubled in scale under its ownership, merged three technology platforms into one and made three add-on acquisitions in data science, AI and cybersecurity services.
Quorum Cyber, run by chief executive Kevin Hanes since June 2026, offers MDR, incident response and professional services. It says it holds every Microsoft Security specialization and was Microsoft's managed security services provider (MSSP) of the year for 2025. Hanes previously held senior roles at Secureworks and Dell Technologies.
Quorum Cyber says the combined group would cover secure AI adoption, security improvement, 24/7 detection, incident response and recovery, and would deepen its support for Microsoft Sentinel, Defender XDR, Entra, Purview and Security Copilot. The deal still needs customary closing conditions and any required approvals.
Sources
- Quorum Cyber, “Quorum Cyber Announces Intent to Acquire Ontinue, Building an Unrivaled Microsoft-First Agentic SOC for the Autonomous Threat Era”, press release, 16 September 2026. https://www.quorumcyber.com/insights/ontinue-agentic-soc/
- EQT, “EQT to sell Ontinue, a provider of AI-powered Managed Extended Detection & Response cybersecurity services”, press release, 16 September 2026. https://mb.cision.com/Main/87/4396450/4272558.pdf
- Quorum Cyber, “Quorum Cyber Appoints Kevin Hanes as Chief Executive Officer”, press release, 30 June 2026. https://www.quorumcyber.com/insights/quorum-cyber-appoints-kevin-hanes-as-chief-executive-officer/
