MDR 24/7
Our Barcelona SOC watches your email, endpoints, cloud and identities around the clock. When something is real we do not send you a ticket: we contain it, then call you.
- Endpoints and servers
- Identity and email
- Cloud and network
- Threat hunting
- mean time to detect
- 38 s
- mean time to detect
- to contain a confirmed incident
- < 30 min
- to contain a confirmed incident
- false positives for you to handle
- 0
- false positives for you to handle
In detail
A full SOC without hiring twelve people.
Running your own 24/7 SOC takes at least eight to ten analysts to cover shifts, plus SIEM, EDR and threat intelligence licences. For most mid-sized companies it makes no economic sense. Our MDR gives you the same level of watch for a monthly fee.
We connect to what you already have (Microsoft Defender, CrowdStrike, SentinelOne, Google Workspace, AWS, firewalls) or deploy our own agent. Analysts review every alert, filter the noise and, when something is real, act: isolate the device, block the account and call you.
Every month you get a report on what happened, what we blocked and what to improve. Every quarter we tune detections to the new techniques we see across other clients.
Real scenarios
What we have stopped at 3 a.m.
Ransomware in staging
We spotted a remote access tool installed on a server out of hours. We isolated it in 4 minutes, before encryption began.
Stolen Microsoft 365 session
A sign-in from another country with a valid token. We revoked sessions, forced a password reset and removed a rule forwarding email to the attacker.
Crypto miner in AWS
Keys leaked in a public repository spun up 40 instances in another region. We stopped them before the bill passed €300.
What you get
Monitoring, response and visibility.
- 24/7 monitoring and triage of every alert
- Remote containment within minutes per the agreed playbook
- Direct line to an analyst during an incident
- Monthly report and quarterly review with your team
- Real-time dashboard of alerts and incidents
- Evidence ready for NIS2, ENS and ISO 27001 audits
How we engage
Plans by size.
Essential
Endpoints and email.
- Managed EDR
- Microsoft 365 or Google Workspace
- 24/7 response
- Most chosen
Complete
All your IT and cloud infrastructure.
- Servers, network and cloud
- Weekly threat hunting
- Incident response included
Critical
For regulated and OT environments.
- OT / ICS monitoring
- Dedicated analyst
- 15-minute containment SLA
Defence and response
What is included
- 01
Endpoints and servers
We deploy or reuse your EDR and run it for you.
- 02
Identity and email
We catch impossible logins, session theft and CEO fraud in Microsoft 365 and Google.
- 03
Cloud and network
AWS, Azure, firewall and VPN telemetry correlated in a single SIEM.
- 04
Threat hunting
Weekly proactive hunts driven by intelligence from our own incidents.
MDR 24/7
How we work
- 1
Onboarding
We connect sources and tune rules to your environment in two weeks.
- 2
Monitoring
Human analysts review every alert, day and night.
- 3
Containment
We isolate hosts, revoke sessions and lock accounts.
- 4
Monthly report
Clear metrics for leadership and concrete recommendations.
FAQ
Frequently asked questions
Do I need to buy another tool?
Not necessarily. We work with Microsoft Defender, CrowdStrike, SentinelOne and other common EDRs.
Does it cover NIS2 reporting?
Yes. We prepare the 24-hour early warning and 72-hour notification for you.
Do I have to replace my current tools?
No. We work with what you have whenever reasonable. If you lack an EDR, we propose one and deploy it ourselves.
What can you do without asking me?
Whatever we agree in the playbook. Typically we isolate devices and block accounts immediately, and check with you before actions that affect production.
Is there a lock-in?
No. Monthly contracts with 30 days’ notice. We would rather you stay because it works.
You may also need
Next step
Shall we talk about your case?
30 minutes with a partner, not a salesperson. No commitment.