How we work
You have two other options and both are reasonable. A product-led vendor is cheaper and faster to switch on, as long as you are happy on their agent and their playbooks. A rate-led offshore provider is cheaper still and will send you a ticket queue. These six are the places we are deliberately more expensive and more work than either.
We work inside the tools you already chose: your SIEM, your EDR, your cloud security platform. Nothing to install, nothing to rip out, and no migration project hiding inside the onboarding. The cost to us is that we have to learn your environment instead of making you learn ours, which is why our supported list is short and grows slowly.
A primary and a secondary analyst are assigned to your account and stay on it. They are the people who learn that your build server always does that on Thursdays, which host actually matters, and who to call at 4am. You will know their names. They will know yours.
Our analysts work your night as their day, awake and at a desk during the hours you cannot staff. The shift that is hardest and most expensive to cover in the US is our ordinary Tuesday. We say this up front rather than in the vendor security review, and if a regulator or a customer contract makes a non-US SOC hard for you, tell us on the first call and we will say whether it is workable. A US team is planned for 2027.
Every verdict carries the name of the analyst who reached it, written into the contract rather than promised on a web page. The industry is moving toward automated closure, and some of that is good. But when you are reading a verdict at 7am with your CTO on the line, the question you have is who decided this and what did they look at. You should be able to ask them.
Licences stay in your name. The runbooks, detection content and documentation we write for you are yours, and they leave with you. There is an exit transition agreed before you start. We would rather be easy to leave, because that is what makes us reasonable to try.
We work inside your environment, in the region you chose. Your logs and alert data are never copied into systems of ours. When your own customers ask where their data lives, the answer does not change because you hired us.
Then a paid 30-day proof of concept on your real alerts, before either side is committed to anything.