Services
Take one or take all three. If you are not sure where to start: vulnerability management produces audit evidence fastest, and security engineering is the right first move if your SIEM is noisy enough that handing it to anyone would just move the noise. We will tell you which one you need on the first call.
Monthly retainer
Every alert is triaged and investigated by a named analyst. What comes back to you is a written verdict with the evidence attached: what fired, what we looked at, what we concluded, what we want you to do. P1s come by phone, not by email.
What “covered hours” means. Your night is our working day, which is why off-hours is the tier we lead with and the one we are best at. Awake analysts at desks, not someone woken at home. Your own people keep your business hours. We would rather say that on a public page than sell you round-the-clock cover we have not staffed yet.
Monthly retainer
Scanners are not the hard part. The hard part is deciding which of this week’s findings actually matter and getting someone to fix them. That is the work we take.
Project · retainer · dedicated
Most security tooling underperforms because nobody had three uninterrupted weeks to finish deploying it. Buy this as a fixed-scope project, as a monthly expert-on-demand retainer, or as a named full-time engineer who works to your direction.
A monitoring provider that quietly benefits from a broken log source is worth less than no monitoring at all, because you think you are covered. So the notification duties are written down:
Three things we deliberately do not exclude, and it is worth checking whether anyone else you are evaluating excludes them. Our own power and connectivity. An analyst being ill. A week where your alert volume triples. Those are ours to absorb.
The clock starts when the alert reaches our queue.
| Severity | Triage begins | You are notified | What it means |
|---|---|---|---|
| P1 · Active intrusion | 15 min | 30 min | Confirmed or in-progress compromise. We phone you. |
| P2 · Credible threat | 30 min | 2 hours | Strong indicators that need a decision from you today. |
| P3 · Investigation | 4 hours | Daily | Worth understanding. Not worth waking anyone. |
| P4 · Informational | Next day | Weekly | Noise, context, and candidates for tuning. |
These apply during covered hours, against the scope we agree for your environment. Every verdict carries the name of the analyst who reached it, and that is in the contract, not only on this page.
The clock starts at our queue rather than at the event in your environment, because the gap between those two is your log pipeline and not our analysts. We measure that gap and publish it to you every month. In most environments it surfaces a problem nobody was watching.
Five numbers: SLA attainment, alert volume, true-positive rate, mean time to triage, and escalations raised. Your ingestion lag alongside them. We picked numbers we would still be willing to show you in a bad month, which is the only test a reporting pack has to pass.
When we miss a commitment you get a written root-cause review within five business days. Not a credit. Discounting your bill for a month in which we missed something is a strange thing for either of us to want.
A separate service and a separate fee, never folded into a monitoring retainer. We build the integrations and the automation while nothing is happening, and we lead the response when something is.
Vega · CrowdStrikeMicrosoft Sentinel and Panther on request
CrowdStrike Falcon
Wiz · Upwind
Tenable
Recorded Future
That list is short on purpose. Every additional SIEM and EDR combination multiplies the runbooks, the detection content and the analyst training behind it, and a provider that claims to support everything supports most of it badly. If your stack is not here, ask. We will tell you straight whether we can run it properly or not. If you do not have a SIEM at all yet, that is a security engineering project first and monitoring afterwards, and we do both.
We do not publish numbers, and not as a sales tactic. The figure depends on how many endpoints you have, how much you ingest a day, how many assets we scan, and which of the three services you take. Quoting without those is guessing, and a guess you would later have to correct is worse than a blank page.
Send the form and you get a real figure for your environment, worked out by the person who would be running the work.
What you will get on that call is the comparison that actually matters: one retainer against the fully loaded cost of the US analysts the same coverage would require in-house.
Commercial terms are not listed here either. We put them in writing and take you through them before you sign anything.
A short form, then a real number. No brochure, no sequence. It helps to know:
Do not have all of that to hand? Send what you have. The first call fills in the rest.
01
Your stack, your obligations, what is coming due. We will say plainly whether we are the right fit.
02
What you run, how noisy it is, who owns what. This is the part that lets us put a number on it honestly.
03
On your real alerts, with our analysts writing real verdicts. Both sides get an honest look before either is committed.
04
Runbooks, tuning, and named analysts assigned to your account. Usually two to four weeks.
Then a paid 30-day proof of concept on your real alerts, before either side is committed to anything.