Managed
Security Monitoring
Someone watching your systems when your team isn't.
Most attacks are not spotted as they happen. They are found days or weeks later, usually by accident, and by then the damage is done. Security monitoring is the arrangement that closes that gap — a provider watches for the signs of an attack in progress, investigates what looks real, and tells you when something needs your attention.
What security monitoring actually involves
Your systems already produce a large amount of activity data: logins, file access, network connections, changes to accounts and permissions. Most of it is normal. A small fraction is not. Monitoring means collecting that data centrally, applying detection rules that flag suspicious patterns, and having people examine the flags. The people part is what distinguishes a service from a product. Software will generate alerts happily and endlessly. Without someone to triage them, an unattended alert queue is not security — it is a record, after the fact, of what you missed. A good arrangement is specific about three things. What is being watched — laptops, servers, cloud accounts, email, or some combination. What happens when something is found — whether the provider notifies you and waits, or is authorised to act. And how quickly, including outside your working hours. These are the questions that separate a useful service from an expensive alert feed.
Who needs it
- Organisations with nobody covering evenings, weekends, or holidays
- Businesses where a customer, insurer, or regulator has asked how you would detect a breach
- Teams that own security tools generating alerts nobody has time to look at
- Companies handling sensitive data, where the difference between catching something in an hour and catching it in a month is substantial
What you get
Help choosing between the two main models
Some providers bring their own platform and you consume the outcome. Others operate security tools you already own, keeping your data in your own environment. Which suits you depends mainly on what you have already bought and whether data residency matters to you contractually.
Coverage matched to what you actually run
A cloud-native startup and a business with on-premise servers need different coverage. Providers matched to your setup rather than to a generic template.
Comparable proposals
Quotes structured against the same scope, setting out response times, escalation route, what onboarding involves, and what is billed separately.
Frequently asked questions
What do SOC, SIEM, and MDR mean?
A SIEM is software that collects and analyses activity data — a tool, not a service. A SOC, or Security Operations Centre, is the team of analysts who operate it. MDR, Managed Detection and Response, bundles the tool, the team, and an agreed response capability into a single service. For most smaller organisations MDR is the practical choice, because buying a SIEM with nobody to run it produces alerts and no outcomes.
Will the provider fix problems, or just tell us about them?
Both models exist and the difference is significant. Detect-and-notify means the provider alerts you and your team handles containment, which requires someone available to act. Managed response means they can take agreed actions themselves, such as isolating an infected laptop or disabling a compromised account. That is faster, but you are granting real authority over your systems. Decide which you want before comparing prices, because the two are not comparable.
How much does it cost?
Pricing is usually per device, per user, or by volume of data collected. Volume-based pricing carries the risk of the bill growing as your logging grows, which is worth understanding before you sign. Ask every provider to quote against the same list of systems, and confirm whether setup is included or charged separately.
How long does it take to set up?
Usually several weeks rather than days. Systems have to be connected, and the detection rules have to be tuned to your environment so you are not buried in false alarms. A service that goes live in forty-eight hours has almost certainly not been tuned, and your team will feel it in the alert volume.
We already pay for security software. Do we still need this?
Possibly not a new platform, but likely someone to run what you have. It is common to find organisations paying for capable tooling that is running on default settings with nobody reviewing the output. Several providers will operate your existing licences rather than sell you theirs, which is usually the cheaper route if you have already invested.