Alert triage
Every EDR, ITDR, M365 MDR, email and network alert reviewed by a human. False positives filtered. Real positives actioned.
SERVICE · SOC
Humans on the
Humans on the
other end,
at 3 a.m.
24/7 Security Operations Centre (SOC) for UK SMBs
Security tools generate alerts. A Security Operations Centre answers them. Ours does it 24/7/365 with real analysts, pre-authorised response and a plain-English brief on your desk before breakfast.
Follow-the-sun
Human analysts
Pre-auth response
MTTD < 10 min
01 / WHAT THE SOC DOES
Triage.
Triage.
Contain.
Hunt.
Report.
Containment & response
Pre-authorised actions executed in seconds: isolate host, revoke sessions, disable account, kill process, roll back changes.
Incident management
P1 calls wake the right people — you, us, your execs — with a structured brief. Parallel comms during an event, not after.
Threat hunting
Monthly hunts across your telemetry. Living-off-the-land patterns, persistence mechanisms, low-and-slow BEC. The stuff alerts don't fire on.
Signal fusion
One incident seen across EDR + ITDR + email becomes one ticket, one timeline, one response — not three vendor portals.
Reporting
Monthly board-grade report. Incidents, near-misses, MTTD/MTTR, posture, what changed, what to approve. One page.
02 / LIFE OF A P1 ALERT
From noise
From noise
to contained
in under
30 minutes.
Indicative timing from a recent P1 response. Your mileage varies; our SLAs don't.
- T+00:00
Alert fires
EDR detects a process tree behaving badly on a finance laptop. Agent auto-isolates the host. Alert routed to the SOC queue as P1.
- Auto-isolation
- Priority routing
- Telemetry snapshot
- T+04:00
Analyst triages
On-shift analyst picks the alert up. Process tree reviewed, IOCs checked, user contacted, cross-correlated with identity and email signals. Verdict: true positive, active.
- Human triage
- Signal fusion
- Verdict documented
- T+12:00
SOC contains
Process killed. File changes rolled back. Session on that user revoked across M365. Related mail clawed back. Persistence mechanisms cleared.
- Kill + rollback
- Session revoke
- Persistence cleared
- T+25:00
Your contact called
Your on-call gets a phone call (not a ticket) with a plain-English brief: what happened, what we did, what to do next. Usually: reset credentials, comms to user.
- Phone call
- Plain-English brief
- Next-step actions
03 / WHY IT MATTERS
Tools don't
Tools don't
respond. People do.
EDR, ITDR, MDR — all brilliant, all worthless without a human on the other end authorised to act. The in-house version of this — an on-call rota across 3 analysts — costs half a million a year and still doesn't cover weekends properly. A shared SOC gets you the same outcome, nights and weekends included, for a fraction of it.
- ✓Real humans, real hoursNot an AI promise. Not a 9–5 mailbox. Actual analysts, always.
- ✓Pre-authorised responseContainment in minutes, not hours, because nobody's waiting on a 3 a.m. approval chain.
- ✓Board-grade reportingThe evidence your insurer, auditor and board actually want.
- ✓Cheaper than in-houseA fraction of the cost of 3 analysts and a SIEM licence of your own.
04 / FAQ
Questions
Questions
we hear a lot.
Is the SOC actually 24/7 with humans?
Yes. Three follow-the-sun shifts across UK, US and APAC. Every P1 alert is triaged by a human within minutes, not queued until morning.
Who staffs the SOC?
We partner with one of the large UK/US MSSPs for SOC operations — vetted analysts with regular threat-hunting rotations — and layer our own escalation, account management and client reporting on top. Vendor-neutral, we pick the best fit per client.
What can the SOC do without me?
Pre-authorised containment actions: isolate an endpoint, revoke sessions, disable a user, kill a process, remove an inbox rule, roll back file changes. Anything riskier requires your sign-off — reached by phone, not ticket.
Do I get reports I can give to the board?
Yes. Monthly one-pager: incidents, near-misses, MTTD/MTTR, posture trend, what changed. No 40-slide vendor portal tour.
Can we bring our own tooling?
Yes, within reason. We support SentinelOne, CrowdStrike, Defender, Huntress, Avanan, Mimecast, Abnormal, Cloudflare, DNSFilter. If your existing stack is one of those, we'll run it.
What about GDPR and data residency?
Telemetry stored in-region (UK/EU) by default. Data processing agreements in place with the SOC provider. Details provided during onboarding, we'll answer any DPO questions.
NEXT STEP
Meet the
Meet the
on-call analyst.
30-minute introduction. Meet an on-shift SOC analyst, see the console, walk a real incident from alert to report. No slides.