Overview
Trustwave is a managed security services provider founded in 1995 with international headquarters in Chicago and regional offices in London, São Paulo, and Sydney. Following acquisition by LevelBlue (the rebranded AT&T Cybersecurity business under WillJam Ventures) on 1 July 2025, Trustwave operates as part of a combined entity with more than 2,000 employees and over US$1 billion in annual revenue. CEO Eric Harmon continues to lead the Trustwave brand within the LevelBlue group; pre-acquisition revenue was approximately US$542 million.
The services portfolio centres on managed detection and response, the Fusion XDR platform, SpiderLabs threat research and offensive security, digital forensics and incident response, and database security consulting. Trustwave maintains five global SOCs and operates as a Microsoft Verified MXDR partner — Microsoft Defender alignment has deepened materially since 2022 and is now central to the firm's commercial positioning. The combined LevelBlue + Trustwave entity also covers AT&T network security services for enterprise telecoms buyers.
Buyers engage Trustwave for mid-market and mid-enterprise managed security with predictable subscription pricing, particularly where Microsoft Defender consolidation, PCI-DSS compliance, or retail and payments security are in scope. The firm is less well suited to nation-state IR forensics and to buyers seeking deep transformation advisory. Integration with LevelBlue is ongoing and merits diligence on platform roadmap and SOC continuity during multi-year procurement.
Services Offered
- Managed detection and response — Trustwave Fusion XDR platform
- Microsoft Defender MXDR (Verified Microsoft partner)
- SpiderLabs offensive security — penetration testing, red team, threat research
- Digital forensics and incident response retainers
- Database security and DAM monitoring (DbProtect, AppDetective heritage)
- PCI-DSS, HIPAA, and regulatory compliance assessments
- Identity threat detection and Active Directory hardening
- Email security and managed phishing defence
- Cloud security posture and Microsoft Azure / AWS configuration review
- Managed firewall, secure SD-WAN, and AT&T network security via LevelBlue
Typical Engagement
| Engagement Type | Model | Typical Range |
|---|---|---|
| Security assessment / PCI audit | Fixed-fee project | $60K–$250K (4–10 weeks) |
| Penetration test / red team programme | Project or annual programme | $70K–$350K per programme |
| Trustwave Fusion MDR / Microsoft MXDR | Annual subscription, per asset | $5–$15 per asset/month |
| Managed security services | Monthly retainer | $15K–$300K per month |
| Consultant (staff augmentation) | Hourly bill rate | $175–$425/hour blended |
Pricing verified May 2026 from public procurement data and reference checks; ranges vary by region and engagement structure.
Strengths
- Verified Microsoft MXDR partner — one of the deeper Microsoft Defender service alignments in the market
- SpiderLabs threat research with strong reputation for vulnerability disclosure and adversary tracking
- PCI-DSS and payments security expertise — Qualified Security Assessor (QSA) heritage going back to the 1990s
- Five global SOCs (Chicago, Manila, Sydney, Warsaw, Singapore) for follow-the-sun delivery
- Combined LevelBlue + Trustwave coverage now includes AT&T network security for enterprise telecoms buyers
- Predictable per-asset MDR subscription pricing; competitive for mid-market consolidation
Limitations
- LevelBlue integration is in early stages — operating model, platform consolidation, and SOC continuity remain in flux through 2026
- Senior consultant attrition reported during multiple ownership transitions (Singtel → MC² Security Fund → LevelBlue)
- Smaller deep forensics bench than Mandiant or CrowdStrike Services for advanced adversary IR
- Advisory and transformation consulting depth is thinner than Big Four cyber practices
- Brand fragmentation between Trustwave, SpiderLabs, and LevelBlue creates buyer confusion in current RFP cycles