Heimdal
A Danish modular platform that bundles antivirus, ransomware encryption protection, patching, DNS filtering, privilege management and a 24/7 SOC for small firms and MSPs, with a Trustpilot 3.8 on 970 reviews. What to know: there is no commercial price without a sales call (the calculator is a lead form; the only fixed UK figure is a G-Cloud public-sector price of £48 a device a year), no result at any of the four independent labs for the business product, and the G-Cloud listing offers email and ticket support only, weekdays.
How we testHeimdal Security A/S was founded in Copenhagen in 2014 by Morten Kjaersgaard, who moved to chairman when Jesper Frederiksen became chief executive in May 2024; Marlin Equity Partners, a US private-equity firm, has held majority control since March 2020 through Danish holding companies. It claims over 15,000 customers and its registered address and VAT number appear on its own pricing page. Engineering locations are not published and we found no Russian or Chinese link.
Pricing needs a conversation. The pricing calculator on heimdalsecurity.com lets a visitor pick from twelve modules, a customer type (end customer, reseller, MSP or distributor), device and server counts and a currency including pounds, then demands a name, company, job title, email and phone before it will show a figure. We did not submit one, so we have no commercial price. The only fixed pounds prices we could find are Heimdal's listings on the UK Government's Digital Marketplace (G-Cloud 14): £4.00 a device a month, about £48 a year, for a bundle of next-generation antivirus, ransomware encryption protection, patch management and 24/7 SOC monitoring, and £2.98 a user a month for a Unified Threat Platform bundle of DNS security, patching and antivirus with mobile device management. Those are public-sector framework prices, not confirmed as what a small company pays. Trials run 14 or 30 days depending on the bundle. The grid says "Not published".
The platform is genuinely broad for the money it does not publish: Next-Gen Antivirus and Firewall, Ransomware Encryption Protection (which detects encryption without signatures), Patch and Asset Management for Windows, Linux and third-party software, DNS Security at network and endpoint level, Email Security for Microsoft 365 and Google Workspace, Privileged Access Management with automatic de-elevation on detection, Application Control, EDR, XDR and a managed MXDR service, all in one cloud dashboard with a multi-tenant view for MSPs, a documented REST API and integrations with ConnectWise RMM, Autotask PSA and HaloPSA. Windows Server deployment is documented, macOS 10.15 to 14 is listed, Linux is covered for patching. No MCP server was found.
The gap is evidence. Heimdal does not appear in AV-Comparatives' H1 2026 business test, its only AV-TEST result is a 2020 consumer product, we found no SE Labs rating and it did not take part in MITRE's 2025 round. Support on the G-Cloud antivirus bundle is email and ticketing, weekdays nine to five, with a four-hour response and no phone or chat, although the MXDR service has its own 24/7 channel. No breach of Heimdal was found. Trustpilot is 3.8 on 970 unprompted reviews, 4 per cent one-star, though some reviewers appear to be consumers. Not yet tested by Saaskly: assessed on published pricing, the independent test labs, vendor documentation and third-party reviews.
Pros
- +Antivirus, ransomware encryption protection, patching, DNS filtering, email security, privilege management, EDR and a managed SOC in one modular platform
- +Danish company, no Russian or Chinese link found; REST API, multi-tenant dashboard, ConnectWise, Autotask and HaloPSA integrations; Trustpilot 3.8 on 970 reviews
- +Windows, Windows Server, macOS and Linux (patching) covered; the G-Cloud bundle includes 24/7 SOC monitoring at £48 a device a year
Cons
- −No commercial price without giving a salesperson your details; the only fixed figures are public-sector G-Cloud listings (marked down by editorial rule)
- −No result at AV-Comparatives, AV-TEST (business), SE Labs or MITRE for the business product
- −Email and ticket support only, weekdays, on the G-Cloud antivirus bundle; owned by US private equity (Marlin) since 2020
Pricing
Minimum commitment: £48 (£48/yr for the entry licence). The least you can spend before walking away; excludes numbers, minutes and add-ons.
Next-Gen Antivirus, Ransomware Encryption Protection, Patch Manager and 24/7 SOC (G-Cloud)
£4/mo · month-to-month
£48/yr on an annual commitment
Month-to-month costs -92% more
- ✓UK public-sector G-Cloud 14 price: £4.00 a device a month, about £48 a year, read 9 Sep 2026; VAT basis not stated. The commercial calculator on heimdalsecurity.com is a lead form and shows no price. Unified Threat Platform bundle (DNS security, patching, antivirus, MDM) £2.98 a user a month on G-Cloud. 14 or 30-day trial.
Specifications
| Rating | 2.8 |
| Scored tier* | Not published (G-Cloud bundle £48 a device a year as context) |
| Monthly billing | Annual only |
| Entry plan | Scored tier is the entry plan |
| Seats | No cap |
| Servers | Included |
| EDR | Paid add-on |
| MDR | Add-on, quote |
| Buy online | No |
| Self-service portal | No |
| AV-Comparatives | Not among the 16 vendors in the H1 2026 Business Security Test |
| AV-TEST | Only a 2020 consumer result (Thor Premium 2.5); no business certification |
| SE Labs | Not found |
| MITRE evaluated | No |
| Ransomware rollback | No |
| Web filtering | ✓ |
| Email security | Paid add-on |
| Patching | Included |
| Device control | No |
| Platforms | Windows · Mac · Linux · Server |
| Cloud console | ✓ |
| RMM integrations | ConnectWise RMM, Autotask PSA, HaloPSA |
| API | ✓ |
| MCP server | No |
| Owned in** | US-owned |
| Russian or Chinese link | None found |
| Phone support | No |
| Trustpilot (reviews) | 3.8 (970) |
| Scored tier name | Not published (G-Cloud bundle £48 a device a year as context) |
| VAT basis | Excluding VAT |
| Top plan | None |
| EDR tier or add-on | EDR, XDR and MXDR are separate modules, all quote-only |
| Monthly billing available | No |
| How you buy | Pricing calculator that requires contact details, then sales; MSP and distributor routes; UK G-Cloud for the public sector |
| Free trial (days) | 30 |
| Price changes | No commercial price published; G-Cloud £4.00 a device a month |
| Test record note | No independent result for the business product at any of the four labs |
| Behavioural detection | ✓ |
| Exploit prevention | No |
| Firewall management | ✓ |
| Disk encryption management | No |
| Vulnerability scanning | ✓ |
| Application control | ✓ |
| Mobile threat defence | No |
| iOS | No |
| Android | No |
| Platform notes | macOS 10.15 to 14 per the G-Cloud listing; Linux for patching; ARM with limitations; no ChromeOS mention |
| On-premises console option | No |
| Console data location | Not stated |
| Deployment | Agent installer; portal deployment; MSP onboarding wizard |
| SIEM export | No |
| Multi-tenant console | ✓ |
| SSO into console | No |
| HQ | Denmark |
| Owner | Marlin Equity Partners (US private equity), majority since 2020 |
| Engineering locations | Not published |
| Link evidence | None found |
| SOC 2 | No |
| ISO 27001 | No |
| Cyber Essentials | No |
| Major incident on record | No |
| Incident note | No breach of Heimdal found; a CEO-fraud phishing attempt against the company was disclosed by Heimdal itself |
| Live chat | No |
| UK support hours | G-Cloud bundle: email and ticket, Mon to Fri 9 to 5, 4-hour response, no phone or chat; MXDR has its own 24/7 channel |
| Paid support tier | Onsite support at extra cost |
| Support channels | Email, Ticketing, Technical account manager (business hours) |
*Scored tier: the business tier the score is set on (the cheapest plan with a cloud console covering Windows, macOS and Windows Server), per device per year on a one-year term at about 25 devices, then per device per month where monthly billing exists, in the currency the vendor shows a UK visitor on the research date; see each profile for the VAT basis, the seat band and what the tier above adds.
**Owned in: where the company that owns the vendor answers to. A US-owned vendor is subject to US law (including the CLOUD Act) wherever the console data sits. "Russian or Chinese link" records ownership, management or engineering links found on the research date, with the evidence on the profile; Saaskly marks these down in the score by editorial rule and says so.
Researched and drafted with AI assistance; reviewed and approved by Tim Meredith. How we use AI
Work at Heimdal? Something not look right? Register in the vendor portal to see what we publish and send corrections.