Defend
Security monitoring
Your devices, sign-ins and systems are watched centrally, what the monitoring finds is reviewed by the engineers who run your IT, and what we change because of it goes into your evidence file.
Watched by people who know what normal looks like.
A sign-in from a country your firm doesn’t work from, a laptop whose protection has stopped reporting, a backup job that quietly failed, a new forwarding rule in a mailbox: each is a small signal, and each is how an incident announces itself before it becomes one. Security monitoring collects these signals from your devices, your Microsoft 365 tenant and your servers in one place. What makes it worth having is the review: the engineers who run your IT read what it found, know what’s normal at your firm, and act on what isn’t. A monitoring nobody reads is a log. One our engineers read is how an incident ends as a note in the evidence file.
What we set up
Signals in one place, read by people who act on them.
What is watched is agreed with you and written down. Alerts are tuned to your firm, so the signals that matter aren’t buried under the ones that don’t.
-
Every device reporting
Laptops, workstations and servers report their protection, their patch level and anything their protection stopped. A device that goes quiet is a finding in itself.
-
Sign-ins watched
Sign-ins to your Microsoft 365 are reviewed for what doesn’t fit: unknown countries, impossible travel, repeated failures, a new device on an admin account.
-
Mailboxes watched
New forwarding rules, inbox rules that hide mail and unusual sending patterns are flagged, because that’s what an attacker sets up first after signing in.
-
Backups and systems watched
Every backup job, every server and every service that matters is on the monitoring, so a failure is seen by our engineers, not discovered on the day you need it.
-
Reviewed by our engineers
What the monitoring finds is read and judged by the engineers who know your setup, not left to a dashboard. What needs action gets it; what needs you gets a call.
-
What we changed, on record
A rule tightened, an account locked, a device re-enrolled: every change the monitoring led to goes into your evidence file with its date and reason.
On record
In your evidence file.
- What is watched: devices, sign-ins, mailboxes, backups and systems
- What the monitoring found in the period, in plain words
- What we changed because of it, each with its date and reason
- Which findings led to an incident, and the record of that incident
For the insurer’s question “is your security monitored, and by whom?”: the answer, with the record behind it.
What usually goes wrong without it.
-
Alerts nobody reads
The tools are in place and send a hundred alerts a day. Nobody is responsible for reading them, so the one that mattered sits unread with the ninety-nine that didn’t.
-
A device that stopped reporting
Protection that silently stopped on one laptop months ago. Nobody noticed, because nothing told anyone.
-
The forwarding rule found too late
An attacker’s rule has been forwarding a mailbox’s mail outside the firm for weeks. It’s found when a client asks why a stranger answered.
Also under Defend
- Email security Spam, phishing and malware filtered out before a mail reaches anyone, with long-term archiving.
- Multi-factor sign-in A second factor for every account, so a stolen password on its own opens nothing.
- Conditional access Who is signing in, from where and on which device, checked every time.
- Device protection Managed protection and threat detection on every laptop, workstation and server, to a documented baseline.
- Patching and vulnerability management Updates rolled out from one place, and the gaps that remain found and closed.
- Admin access Admin rights for few, by name; passwords in a vault; every use logged. Our own keys first.
- Backups and restore tests Backed up, restored on purpose before you need it, dated, and kept for the years you’re bound.
- Access reviews Who can open what, reviewed with you, so access that made sense last year doesn’t quietly stay.
- Incident response When someone clicks, or a server shows a ransom note: the same sequence every time, ending in the record.
- The evidence file What protects your firm, written down as it is, ready on the day an insurer, a client or an auditor asks.
- Insurer and client questionnaires Your insurer’s and your clients’ security questionnaires, answered with what’s true today, the gaps closed before renewal.
- Changing provider The old provider’s software and access removed, with a written check that nobody keeps a way in.
Questions we get
Who looks at the monitoring, and when?
The devices, sign-ins and systems report whenever something happens. Our engineers review what they report within our service hours, and outside them as agreed in your contract, at a cost agreed in advance. What is reviewed when is written down, so you know what you’re getting.
Will the monitoring see what our people do?
It sees signals, not work: where a sign-in came from, whether a device is protected, whether a rule was added to a mailbox. It doesn’t read mail or open files. What is watched is written down, and you can show it to your works council or your data protection officer.
What happens when the monitoring finds something?
An engineer reads it and judges it. Most findings are a device re-enrolled or a rule tightened, done and noted. A finding that looks like an incident starts the incident response: you’re told first, in plain words.
Does this replace device protection or multi-factor sign-in?
No. Those layers stop most things; the monitoring sees what got past them, or is trying to. It’s the layer that tells us something is wrong, so the others can be adjusted before it matters.
Start
Who is reading your security alerts today?
In a first call we go through what is watched at your firm today, who reads it, and what the last finding led to.
- No first level
- No surprises
- Pilot before you buy