Service
We operate the platform we build for you — triage, hunting and containment by people who know your baseline, without you standing up a 24/7 SOC.
We watch your security alerts for you, around the clock, and act on the real ones. The difference from most providers is that you own the software and the data — if you ever take the work in-house or move to someone else, everything stays with you.
Most managed detection and response providers put your estate behind their stack and their process. We do the opposite: we build the platform, you own it and the data, and we operate it as an extension of your team.
Telemetry from endpoints, network, OT and identity flows to our analysts. We triage against a baseline we established during deployment — not a generic one — hunt on hypotheses drawn from your sector's actual threat profile, and contain through the same automation described in zero-trust segmentation.
The last line is the one most reports omit. If a part of your estate is not producing usable telemetry, you should hear it from us before you hear it from an incident.
| Severity | Example | Acknowledge | Contain | Who acts |
|---|---|---|---|---|
| Critical | Ransomware staging, domain admin compromise | 5 min | Automated, immediate | Platform, then Tier 2 |
| High | Credential dumping, C2 beacon | 15 min | 30 min | Tier 2 |
| Medium | Suspicious PowerShell, unusual admin activity | 1 hr | 4 hr | Tier 1 → Tier 2 |
| Low | Policy violation, unapproved software | Next business day | Per policy | Tier 1 |
Critical containment is automated because five minutes of human acknowledgement is already too slow for ransomware. The analyst's job on a critical is to verify and extend containment, not to initiate it.
Generic tuning is why most MDR relationships settle into mutual frustration. A backup agent reading every file looks identical to staged exfiltration unless the platform knows it is your backup agent.
| Your legitimate behavior | Generic verdict | After baselining |
|---|---|---|
| Backup agent bulk file read, 02:00 | Possible exfiltration | Known, suppressed; alerts only off-schedule |
| Developers compiling and running unsigned binaries | Suspicious execution | Scoped to dev subnet and dev identities only |
| Quarter-end batch touching every finance host | Lateral movement | Known calendar window; outside it, still alerts |
| Vendor remote session into plant HMI | Unknown remote access | Allowed from named source, time-boxed, recorded |
Every suppression is scoped and expires. An unscoped permanent suppression is a hole, and they accumulate silently.
Most managed detection and response vendors present similar capability slides. These are the questions that actually separate MDR service providers in practice:
| Question | Why it matters |
|---|---|
| Who owns the platform and the telemetry? | If they do, leaving costs you your detection history |
| Is tuning specific to us or shared across your book? | Generic tuning is the root of most alert fatigue |
| What can you contain without calling us? | Undefined authority means nothing happens at 03:00 |
| Does containment reach the network? | Endpoint-only containment leaves lateral movement open |
| How many alerts will need a human each week? | The only volume number that describes your workload |
| Can we read the detection logic? | Opaque rules cannot be defended to an assessor |
Serving AMER, EMEA and APAC is what makes this possible. Three eight-hour windows, each covered by analysts working their own daylight hours, with a written handover brief on every open investigation at each boundary. The alternative — one region staffing a night shift — produces measurably worse triage at exactly the hours intrusions are timed for.
| Window (UTC) | Primary | Covers business hours in |
|---|---|---|
| 00:00–08:00 | APAC | Australia, New Zealand, Japan, Singapore, India |
| 08:00–16:00 | EMEA | UK, Europe, Middle East, Africa |
| 16:00–24:00 | AMER | North America, Latin America |
Handover is a structured brief, not a shared inbox: every open investigation carries current hypothesis, actions taken, actions deliberately not taken, and the next step. Investigations dropped at a shift boundary are the most common quality failure in 24/7 operations.
Not alerts raised — alerts requiring a human. Four to eight per week is a load a small team can actually sustain. A service reporting thousands of "threats blocked" monthly is reporting its marketing funnel, not your risk.
Managed detection and response (MDR) is an outsourced service combining detection technology with human analysts who triage, investigate and contain threats on your behalf, typically around the clock. It differs from a traditional managed security service in that the provider takes response actions rather than only forwarding alerts.
EDR and XDR are products; MDR is a service. EDR covers endpoints, XDR correlates endpoint with network, cloud and identity, and MDR is people operating either of them for you. You can buy XDR and run it yourself, or buy MDR and have it run for you.
Bring us the estate you actually have — mixed OS fleets, ageing routers, unmanaged IoT — and we will tell you what can be unified under one agent and what needs custom work.
