Managed security operations
Know who reviews your alerts and how important incidents reach your team.
We pay for Defender and a firewall. Nobody reads the alerts.
Something suspicious happened and we found out a week later.
If there's an incident at 10am, who is actually responsible?
For businesses with security tools but nobody watching them.
Every alert gets a named owner during business hours (9am to 5pm, Monday to Friday). We investigate, tune out the noise, coordinate action with your team and keep an incident register you can show anyone who asks.
Scope boundary
Our own coverage is 09:00–17:00 Sri Lanka time, Monday to Friday, excluding public holidays. Automated alerts are not continuous human monitoring: 24/7 coverage is available only through a separately contracted and tested partner.
- Alerts acknowledged within agreed time targets
- Investigation notes and escalation runbooks
- Pre-agreed containment actions we can take without waiting
- Monthly report: what we saw, what we did, what's still open
Included in Managed Protect and above. Excludes tax, licences and third-party fees; scope confirmed in writing before work begins.
Acknowledgement targets (within support hours)
These are acknowledgement targets, not resolution guarantees.
The path every in-scope alert follows
Signal
Defender, Microsoft 365 or your firewall raises an alert.
Acknowledge
A named person picks it up within the agreed target: one hour for P1.
Investigate
Sign-ins, devices and mailbox rules are checked to confirm what is real.
Contain
Pre-agreed actions: disable an account, isolate a device, block a sender.
Report
Your contact is updated; it goes in the incident register and monthly report.
Often paired with
Start with the Health Check
Tell us which system your business can least afford to lose, or which customer review is coming up. We'll scope a fixed-fee check around it and send a one-page proposal within two working days.