Triage does not queue behind a shift pattern
Every alert is triaged, enriched and investigated as it arrives. Average time to a verdict is 3m 30s, measured across our own SOC and measured the same way at 04:00 as at 14:00.
Three SOCs · each manned 24x7x365
Someone is always
Someone is always
on the queue.
Not an on-call rota, and not an inbox somebody reads in the morning. A manned security operations centre, every hour of every day, with named analysts, a defined escalation path and agents that do not get tired at four in the morning.
SOC · on shift24x7x365
What manned 24/7 actually means
Most "24/7" means
Most "24/7" means
somebody is reachable.
It is worth asking any provider what happens to an alert that arrives at 03:00 on a Sunday. The answers vary more than the marketing does.
For a lot of services, 24/7 means an on-call phone and a rota. The alert waits, an automated acknowledgement goes out, and the actual investigation starts when the shift does. The clock on the incident is running the whole time.
Ours means the queue is staffed and the investigation starts immediately, because the agents that carry triage and investigation are running continuously and a senior analyst is on shift to sign the verdict. The four hundredth alert of the night gets the same investigation as the fourth.
The shift model, and who you get
Multiple SOCs,
Multiple SOCs,
and none of them closes.
Several security operations centres, with further offices in the UK, the USA, Pakistan and Kuwait. Every SOC is online around the clock.
That is deliberately not a follow-the-sun model. In follow-the-sun, one region covers its own daylight and hands the queue over at dusk, which means your incident changes hands because somebody else’s shift ended. Here every SOC is staffed at every hour, so cover does not depend on which part of the world happens to be awake.
- Senior analysts
- On shift in all three SOCs, around the clock. Every customer-facing decision is reviewed and approved by one before it reaches you.
- L3 analysts
- The tier an escalation lands on when policy cannot settle it. Not an on-call number, and not somebody who meets your estate for the first time at 03:00.
- Incident responders
- Available at every hour rather than assembled after the fact, so containment does not wait for a working day to start somewhere.
- AI developers
- Also on shift, in all three. If an investigation needs a tool that does not exist yet for your estate, the people who build it are already at work.
CYBERSHIELD AI does the heavy lifting now. What has not changed is who is behind it, and there is no hour of the week when that answer is different.
What happens overnight
The worst shift to be
The worst shift to be
the four hundredth alert.
In a human-only SOC, the small hours are when attention is thinnest and the queue is longest. That is not an insult to anyone on shift; it is arithmetic.
Investigation runs at the same standard
An escalation is worked through the same pipeline, against the same procedures, with the same completeness gate auditing it for evidence gaps before anything closes. Average verdict with Advanced Investigation is 7m 50s.
Hunting and watching carry on
The Watch agent keeps users under observation on a cycle and records every check, including the clean ones. Hunting runs to its schedule rather than to whoever has a quiet week.
A person still holds the line
High-impact actions are held for approval, and anything the policy cannot settle escalates to a human rather than being guessed at. Overnight does not mean unattended.
How an alert is investigated overnight The CYBERSHIELD AI platform
Escalation out of hours
The path is the same
The path is the same
at 03:00 as at 15:00.
Out-of-hours escalation is where most services quietly degrade. Ours is the same path, agreed with you before it is ever needed.
-
01
Agreed at onboarding
Who is contacted, in what order, for which severity, and what you want us to do without asking. Written down before anyone needs it rather than improvised during an incident.
-
02
Escalated, not parked
When an incident escalates it is handed back deliberately: the Sentinel incident is unassigned, set back to New and labelled for human review. The platform does not sit on work it has decided it cannot finish.
-
03
Contact by name
Notifications go to the right recipients for you and for that incident type, sent from the SOC mailbox, with every send recorded against the investigation.
-
04
Nothing lost to a shift change
The full case travels with the incident — evidence, timeline, what was ruled out and why — so a handover is a handover rather than a reintroduction.
How the SOC is measured
Aligned to SOC-CMM
Aligned to SOC-CMM
across all five domains.
The SOC Capability Maturity Model is the recognised standard for assessing how a security operations centre actually performs, rather than how well it presents.
Business
What the SOC exists to protect, and whether that is understood by the people funding it.
People
Skills, coverage and the shift model behind the service rather than on the org chart.
Processes
The procedures an analyst follows, written down, versioned, and the same on every incident.
Technology
The platform, the detections and the tooling the procedures actually run on.
Metrics
What gets measured, how, and whether the measurement survives being checked.
Questions
The 24/7 SOC, answered.
What is a Security Operations Centre (SOC)?
A staffed function that monitors an estate, investigates what it finds and responds to it. The useful question is not whether a provider has one, but whether it is manned around the clock and what actually happens to an alert that arrives at three in the morning.
What does 24/7 SOC monitoring include?
Continuous monitoring of your estate, triage and investigation on every alert rather than the ones somebody had time for, proactive threat hunting on a schedule, and response inside limits you set. A senior analyst signs the verdict before it reaches you.
How quickly does your SOC respond to a threat?
Average time to a verdict is 3m 30s, and 7m 50s where the Incident needs Advanced Investigation. Both are measured across our own SOC, and both clocks start at the same point: the moment a signal reaches us, not when an analyst opens it or a ticket is assigned.
Why outsource a SOC instead of building one in-house?
Round-the-clock cover is the expensive part. Staffing a manned queue every hour of the year takes far more than the headcount most organisations expect, and cost scales in whole people. Buying it means coverage that scales with the estate instead.
How does your SOC work with Microsoft Sentinel?
Sentinel is the one thing we need you to have. We read the incidents already in your workspace, investigate them, and write the classification, closing statement and labels back to the same ticket. Your data stays in your tenant on your retention.
How do I choose a SOC provider?
Ask what happens to an alert at three on a Sunday morning, who signs the verdict, and how the speed figures were measured. Ask to see a real investigation rather than a dashboard. The answers separate a manned operation from an on-call rota quickly.
Ask the awkward question
Ask us what happens
Ask us what happens
to an alert at 3am on a Sunday.
An hour with a SOC analyst: a live investigation, the escalation path you would actually use out of hours, and the two clocks explained including how they are measured.