THREAT-WATCHMANAGED DETECTION & RESPONSE
24/7 SOC Monitoring & MDR
Continuous monitoring, detection, and response across your environment, watched by people who can act, not just a dashboard that pages someone eventually.
What you get
Plenty of MDR is sold as a dashboard and a generic playbook. THREAT-WATCH puts a 24/7 Security Operations Center (SOC), accountable THREAT-WATCH engineers and a defined response authority behind it, so alerts are triaged and acted on with your specific environment in mind, and you always know who is accountable for what happens next.
Continuous coverage
Monitoring runs every hour of every day, across endpoints, network, and cloud telemetry, with no gaps for weekends or after-hours.
Human-led triage
AI-correlated detections are reviewed and actioned by our 24/7 SOC analysts, not auto-closed or forwarded without context.
Direct engineering escalation
When something needs containment, it goes straight to the engineers accountable for your environment, not a generic ticket queue.
Built for NIS2 evidence
Monitoring and response activity is logged in a way that supports NIS2 incident-reporting and audit requirements, not just internal metrics.
How MDR works with THREAT-WATCH
Managed detection and response is a process, not a product. These are the stages every client goes through, from the first scoping call to the reports your leadership reads.
Scoping and onboarding
We agree what is in scope: endpoints, servers, cloud tenants, identity and the network segments that matter. We work with the EDR you already run; platforms outside our standard stack are scoped individually, which can extend onboarding. Before monitoring goes live, the response authority, meaning what the SOC may isolate or disable without asking first, is written into your Service Agreement.
Continuous detection
Telemetry from endpoints, identity, network and cloud flows into the THREAT-WATCH platform, where AI-assisted correlation groups related signals into a single detection instead of a stream of unrelated alerts. Threat hunting runs alongside automated detection, looking for activity that rules alone would miss.
Human triage in the 24/7 SOC
Every detection that needs judgment is reviewed by an analyst in the 24/7 Security Operations Center (SOC). Benign activity is closed with a recorded reason, suspicious activity is investigated further, and confirmed malicious activity moves straight to response.
Containment and escalation
Within the agreed response authority, the SOC contains first: isolating a host, disabling a compromised account or blocking a malicious connection. The case is then escalated to THREAT-WATCH engineers and to your own contacts through the channel your plan provides. Average detect-and-respond: 7 minutes cloud, 16 on-prem (a published platform average, not a contractual SLA).
Reporting and review
Each incident is documented with a timeline, the actions taken and the evidence behind them, so you have a record for internal review, auditors, insurers and, where relevant, NIS2 reporting. From Gold up, a quarterly review with our CEO puts the results in front of your leadership.
What is covered, and what is not
Covered
- Windows, macOS and Linux endpoints and servers running a supported EDR
- Identity activity such as suspicious sign-ins, privilege changes and account misuse
- Cloud and SaaS tenants connected to the platform
- Network telemetry from the segments agreed during scoping
- Threat hunting, triage, containment within the agreed response authority, and incident documentation
Not covered by MDR on its own
- Systems that send us no telemetry. If a device or tenant is not connected, we cannot see it, which is why scoping matters.
- Full investigation and recovery work beyond containment, which is incident response (15 hours a year included on Gold and Platinum, billed per hour on Bronze and Silver).
- Operational technology networks, covered by the separate OT/ICS security service.
- Penetration testing and red team exercises, delivered through vetted partners.
How MDR supports your NIS2 obligations
Article 21 of NIS2 requires essential and important entities to take appropriate measures for incident handling, business continuity and assessing whether their security controls actually work. Continuous monitoring with documented triage and response is direct evidence for the incident-handling measure. The incident record also gives you what you need for Article 23: an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within one month of the notification. We prepare the technical content for those reports. The reporting obligation itself stays with your organization, and the filing goes out under your name.
Which plans include MDR
24/7 SOC monitoring and MDR are part of every THREAT-WATCH plan, from Bronze to Platinum. What changes between plans is how you reach us and who is involved. Bronze includes a business-hours line, and the SOC calls you when an incident is critical. Silver adds a 24/7 hotline for critical incidents. Gold adds a named lead engineer, the CEO’s personal mobile number and a quarterly CEO review. Platinum gives you a dedicated engineer on a direct mobile line.
Compare plans →FAQ
How is this different from a SIEM alert subscription?
A SIEM subscription gives you alerts; MDR gives you a team that investigates and responds to them. We watch the platform so your team doesn't have to staff a 24/7 rotation internally.
Do you replace our existing security tools?
Not necessarily. We work with the EDR you already run, and our detection layer typically integrates with your network and cloud tooling too. Platforms outside our standard stack are scoped individually, which can extend onboarding.
What happens when a real incident is detected?
Our SOC begins containment immediately under the response authority agreed in your Service Agreement, then hands off into our incident response process if the situation escalates.
Is the SOC really staffed 24/7?
Yes. For clients, the Security Operations Center (SOC) runs around the clock, every day of the year, including weekends and public holidays. Detections are triaged at any hour, and containment within your agreed response authority does not wait for office hours.
How fast do you respond?
Average detect-and-respond: 7 minutes cloud, 16 on-prem. That is a published platform average across environments, not a contractual SLA or a promise for any single incident.
What can the SOC do without asking us first?
Whatever your Service Agreement authorizes. Typical pre-approved actions are isolating an endpoint, disabling a compromised account or blocking a malicious connection. Anything more disruptive, such as shutting down a production server, is agreed with your contacts first.
Do we need to buy a SIEM first?
No. The THREAT-WATCH platform handles collection and correlation. If you already run a SIEM, we can work alongside it where it fits.
Will we be flooded with alerts?
No. Filtering the noise is the point of MDR. You hear from us when something needs your decision or your awareness, with context on what happened and what has already been done about it.
Are we locked in if it does not work out?
No. There is no lock-in. If you decide to move on, we hand over in an orderly way so you are not left without visibility in the meantime.
Related Services & Resources
Talk to us about MDR
Tell us about your environment and we'll walk through how 24/7 coverage would work for your team.