Managed SOC & MDR (incident response)

Humans on watch, not just alerts

When something happens, analysts detect, investigate, contain and walk you through to recovery — then hand you a post-mortem. This isn’t an alert board you have to triage alone at 3 a.m.: it’s a team that takes the wheel.

Our methodology is built on real in-house incident-response and forensics practice, with tooling self-hosted in Europe.

Who it’s for

• SMBs with obligations — cyber insurance requiring MDR, large-account clients, a regulated sector: you have to prove continuous monitoring.
• Teams that already have EDR/XDR — you have detection, you’re missing the 24/7 human layer to investigate and decide.
• Organisations with no in-house SOC — you can’t hire an analyst team of your own, but you need one.

Features included

• 24/7 monitoring (SIEM + EDR/XDR), extended hours on Essentialpro
• Human triage, up to a named analyst on Signaturesignature
• Incident investigation, in-depth (DFIR) on Signaturesignature
• Active containment and response, on-site if needed on Signaturesignature
• Proactive threat hunting, from quarterly to continuous by tier
• Incident-response hours included each year (retainer)
• Monthly report + post-mortem, quarterly executive review on Signaturesignature
• Tabletop exercise annually or twice a year by tier

The incident-response runbook

When an alert becomes an incident, a written sequence starts — the same one every time, whatever the hour.

SLA by severity

First-response times are contractual and credited if missed. They depend on the severity of the incident and your tier.

Frequently asked questions