04 / Operate / Managed SOC
ManagedSOC Services
One team running your security day to day.
Detection, engineering and response handled as a single accountable service.
What you get
- Monitoring across endpoints, identity, cloud and network
- Detection rules tuned to your environment
- Investigation of alerts and clear next steps
- Regular reporting on what was found and what changed
How it works
We connect to your existing tools where we can, fill gaps where we cannot, and run the same process every day so nothing depends on one person. Compare with co-managed SOC and 24/7 MDR.
What to expect
Onboarding in 90 days
A fixed plan takes you from a signed agreement to a running, tuned service.
Kickoff and discovery
Days 1 to 10 (days 1 to 14 for CMMC)
Stakeholders aligned, scope confirmed, discovery complete and access plan approved.
Visibility and access
Days 5 to 18 (days 7 to 21 for CMMC)
Privileged access in place, asset and identity baseline built, first log sources connected.
Tooling deployment
Days 10 to 30 (days 14 to 35 for CMMC)
EDR, SIEM, vulnerability and monitoring platforms deployed and reporting.
Baseline and tuning
Days 21 to 45 (days 28 to 50 for CMMC)
Security posture baseline and gap report, detection tuning, and the shared responsibility matrix finalized.
Go-live and handoff
Days 35 to 50 (days 45 to 60 for CMMC)
Runbooks live, service levels active, first reports delivered and formal acceptance.
Stabilization
Days 51 to 90 (days 61 to 90 for CMMC)
False positives reduced, trend reporting, your first quarterly business review and an improvement roadmap.
Windows are targets. Hybrid, multi-tenant or GCC High environments can take longer, and we agree a realistic schedule at kickoff. CMMC engagements also settle the CUI boundary during discovery.
Service levels
Monitoring retainers run 24x7. Unless your agreement sets its own, we work to these targets.
| Priority | Acknowledged within | Target response |
|---|---|---|
| Critical | 15 minutes | 4 hours |
| High | 1 hour | 8 hours |
| Medium | 4 hours | 24 hours |
| Low | 8 hours | 72 hours |
- Tickets confirmed to you within 1 hour and assigned to an analyst within 1 hour
- Status updates at least every 24 hours while a ticket is open
- A monthly security report in the first week of each month
- A quarterly business review in the first week of each quarter
These are default targets. If your agreement sets its own service levels, those take precedence.
Experienced a breach?
Call our 24/7 emergency line: 877-778-2476.
“I love you guys... I sleep better at night now that I know you guys.”
Bring us the complicated part.
Talk with a credentialed CISO and an accountable team. Email [email protected] or call (877) 77-vCISO.