A watch floor that never blinks, with people behind it.
The model does the noticing. A human analyst does the judging. Every escalation that reaches your team has already been triaged, timestamped and, where it can be, resolved, which is why the volume you receive is small and the accuracy is high.
Four jobs, continuously.
Monitoring is not watching a screen. It is a set of specific tasks with owners and handover notes.
Triage
Every flagged deviation is reviewed by an analyst before it can reach your inbox.
Context assembly
Trace, timeline and recommended action are written before you are contacted.
Pre-authorised action
Containment you have already approved is executed without waiting for a reply.
Handover
Shift notes are written by people, so nothing is lost at the change of watch.
Escalation you can trust because it is rare.
Ninety-one per cent of flagged deviations close without your involvement. That number is the point of the service.
- Always-on triageAnalysts review every flagged deviation before it reaches your inbox.
- Context, not just alertsEach notice arrives with the trace, the timeline and a recommended action.
- Escalation you can trustOnly what genuinely needs a decision from your team ever gets one.
Fitting into how you already operate.
Four practical arrangements agreed before go-live.
Contact tree
Who gets called, in what order, at what hour, for what severity.
Authorisation map
Which containment actions are pre-approved, per segment, in writing.
Reporting rhythm
A weekly written review and a monthly call, both with an agenda you set.
Threshold tuning
Your pushback on any escalation feeds directly into the model's thresholds.
Numbers we will put in the contract.
Targets, with the measurement method stated.
| Measure | Target | Measured how |
|---|---|---|
| Escalation response | <15 min | From threshold to contact attempt |
| Mean time to detect | <5 min | From first deviation to scored alert |
| Median containment | <6 min | From decision to isolation confirmed |
| Weekly review delivery | Every Monday | Written, sent before 09:00 |
| Cover | 24/7/365 | Including public holidays |
What teams ask before they switch.
Straight answers, including the ones that make a sale harder.
Is this the same as Cyber Guard?
Do you need access to our systems?
What if we only need out-of-hours cover?
Can we speak to the analysts directly?
Ask the people who would be on your account.
A conversation with an analyst rather than an account manager, bring operational questions.