SIEM and SOC setup
A SIEM set up on the platform that fits your estate, with the right log sources, detection rules and dashboards from the start.
Security Operations & Incident Response
Know when something is wrong, and know what to do next.
We set up and run security monitoring with you, triage alerts around the clock and help you respond when something goes wrong. It can be fully managed or co-managed with your team, under the same SLA targets as the rest of our managed services.
The problem
Why detection and response so often fail when it matters.
01
Alerts nobody reads
Security tools produce thousands of alerts a day. Without tuning and triage, the important one is lost in the noise.
02
Nobody watching at night
Attacks do not wait for office hours, but most internal teams only watch the console during the working day.
03
An incident plan that lives in a drawer
The plan was written for an audit and never rehearsed, so when an incident starts nobody knows who decides what.
04
Backups nobody has tested
Restores have never been tried at scale, and ransomware makes that the first real test.
What we deliver
Monitoring, response and recovery, run with you.
Choose fully managed, co-managed or specific services. Either way, you own the tools, the data and the playbooks.
24x7 monitoring and triage
Alerts triaged around the clock by analysts who escalate real incidents to your team with context and next steps.
Threat detection engineering
Detections mapped to MITRE ATT&CK, tested regularly and tuned so true threats stand out from the noise.
Vulnerability management programme
Continuous scanning, risk-based prioritisation and tracking of fixes with your teams until they are closed.
Incident response retainer and playbooks
A response plan and playbooks for your likely incidents, with our team on call and forensics specialists coordinated when needed.
Ransomware readiness and recovery testing
Tabletop exercises, backup and restore tests and hardening against the common ways ransomware spreads.
How we deliver
From onboarding to a SOC that knows your estate.
We follow the same onboarding as our other managed services: Assess, Transition, Stabilise, Optimise.
Always included
- A named senior lead who stays with you from scoping to retest
- Every finding ranked by risk, with clear fix guidance and a retest once you have fixed it
- Reports, configurations and runbooks documented and owned by you
- A founder reviewing the work every week, and an NDA signed before we touch anything
Typical tools
01
Weeks 1 to 2
Assess
We learn your estate, your current tools and the incidents you worry about most.
- Inventory of assets, log sources and tools
- Review of past incidents and existing plans
- Agree scope, escalation matrix and SLAs
02
Weeks 2 to 4
Transition
Log sources connected, detections switched on and runbooks agreed.
- Priority log sources onboarded
- Initial detection rules and dashboards
- Runbooks and escalation paths tested
03
Weeks 4 to 8
Stabilise
Noise cut, coverage checked and the team rehearsed.
- Alerts tuned to cut false positives
- Coverage gaps closed against MITRE ATT&CK
- First tabletop exercise with your leadership
04
Ongoing
Optimise
Detection, response and recovery improve month by month.
- Monthly service reviews and reporting
- New detections as threats and systems change
- Regular restore tests and exercises
Where we apply it
Industries we know well.
FAQ
Questions we hear a lot.
What are your response times?
Our SLA targets are a 15 minute response and 4 hour resolution for P1 incidents, and a 30 minute response and 8 hour resolution for P2. For security incidents, resolution means the threat is contained and you have a clear plan for recovery; full investigation and clean-up can take longer depending on the incident. Targets are agreed in your contract.
Fully managed or co-managed: which should we choose?
Fully managed suits teams without in-house security staff: we run monitoring, triage and first response, and escalate to you. Co-managed suits teams that have security people but need 24x7 cover or extra depth: your team keeps the decisions and we share the work. Most clients choose co-managed.
Do we have to buy new security tools?
Not necessarily. We start with the tools you already own, such as Microsoft Sentinel or Defender if you are on Microsoft 365, and only recommend new ones where there is a real gap. The tools, data and detections stay in your accounts and belong to you.
What happens in the first hours of an incident?
We confirm the alert, contain the threat where we are authorised to, for example by isolating a device or disabling an account, and bring your decision makers in through the agreed escalation path. We preserve evidence, coordinate forensics specialists if needed and help with regulator and customer notifications, including CERT-In reporting in India.
What is an incident response retainer?
An agreement that puts our team on call before you need it, with scope, contacts and access already set up. When something happens you are not negotiating a contract or explaining your systems from scratch. Retainers usually include a tabletop exercise and a review of your playbooks.
How do you help with ransomware readiness?
We test whether you can actually restore critical systems from backup, check that backups are isolated from the main network, harden the common entry and spread paths and run a tabletop so leadership has rehearsed the decisions they would face.
Cybersecurity services
Security across the whole estate.
Cybersecurity Services
Testing, cloud, application, compliance, operations and AI security from one senior team.
Security Assessment & Penetration Testing
VAPT for apps, APIs, cloud and networks, with findings ranked by risk and retested.
Cloud & Infrastructure Security
Posture, identity, Kubernetes and network security for AWS, Azure and GCP.
Application Security & DevSecOps
Security checks built into your pipeline, plus secure code review and training.
Security Compliance & Audit Readiness
ISO 27001, SOC 2, PCI DSS, DPDP Act, RBI and SEBI readiness, with evidence kept current.
AI Security & LLM Risk
Red teaming, guardrails and controls for copilots, RAG systems and AI agents.
Managed Services
Cloud, DevOps, QA and release management, run 24x7 against clear SLAs.
Talk to a founder about Security Operations.
Tell us where you are. We will come back within one business day with a point of view, not a sales deck.