Security operations,
run by people who own the outcome.
Detection and response, operational technology, offensive testing, risk, and consultancy. Four of them are delivered by one 24/7 SOC on one platform, so the things we find in one practice are worked by the analysts running the others. The fifth you buy by the project.
Five practices that
share one operation.
Most providers sell these as separate engagements with separate teams and separate reports. We do not, and the difference shows up in the handovers.
A penetration test that finds a weakness should end with a detection built for it. An OT assessment that surfaces an unmonitored plant network should end with that network in the same queue as everything else. A compliance obligation should be met with evidence the SOC already produces rather than a document written to satisfy it.
That only works if one team runs all of it. So these practices are not five business units — they are five ways into the same operation, staffed by the same analysts and reporting through the same escalation path.
Consultancy is the one that works differently, and it is worth being straight about it. The first four are bought on a subscription and land in the SOC. Consultancy is expertise by the day: a vCISO, an architecture review, a SIEM migration, an incident to be led. It is usually how people arrive, and it is priced by the project rather than by the month.
Five ways in.
One operation.
-
Detection & Response
Finding what is happening on your estate and doing something about it. The managed SOC, the SIEM engineering underneath it, and the detection content that makes both worth having.
-
OT Security
The estate that cannot go offline: industrial control systems, connected device fleets and the building systems a property depends on. Passive, agentless, availability first.
-
Offensive Security
Finding it before somebody else does. Testing that ends in detections and fixes rather than a PDF, because a finding nobody actions is a finding you paid for twice.
-
Risk & Compliance
The obligations, the third parties and the governance. Framework work backed by an operation that can produce the evidence rather than describe it.
-
Consultancy & Professional Services
Expertise by the project rather than by the month. A vCISO, a security architecture, a SIEM migration, an incident led by someone who has led one before. Day rate, fixed scope or retained, and we will tell you which before you ask.
The Managed AI SOC
is the front door.
If you are not sure which of the five you need, this is almost always the conversation to have first.
- A 24/7 manned SOC where AI agents carry triage, investigation and hunting, and a senior analyst signs every verdict before it reaches you.
- Average verdict in 3m 30s, or 7m 50s with Advanced Investigation, measured across the SOC rather than quoted from a datasheet.
- Every investigation produces a full report, an escalation write-up where escalated, a closing statement and a draft email — so the work is legible to somebody who was not in it.
- It is also the operation the other detection, OT and offensive work feeds into, which is why it tends to come first. Consultancy is the exception: that one usually runs alongside rather than into it.
One platform, built from our own procedures.
CYBERSHIELD AI is the agentic platform the SOC runs on. The procedures its agents execute are the ones our analysts wrote over years of running Microsoft Sentinel in production, rather than a model trained on public threat data.
How we work, answered.
Do we have to buy all of this?
No. Most engagements start with one practice, and for the majority that is the managed SOC. The five are built to work together rather than to be sold together, so adding one later does not mean re-running discovery or standing up a second team.
How is consultancy different from the other four?
It is bought by the project rather than on a subscription, and it does not land in the SOC queue. A vCISO, a security architecture, a SIEM migration or a compromise assessment is a piece of work with a start and an end, priced on a day rate, a fixed scope or a retainer. The other four practices are ongoing operations. It is also, in practice, how most people meet us.
Is this a platform or a service?
Both, and they are bought differently. CYBERSHIELD AI is the platform our SOC runs on and can be licensed on its own. The services are delivered by our analysts using it. If you have your own SOC, the platform is the conversation; if you want the outcome rather than the tooling, the service is.
Who actually does the work?
A 24/7 manned SOC. AI agents carry triage, investigation, hunting and enrichment, and a senior analyst is accountable for every verdict that reaches you. Autonomy is configurable per agent and per tenant, so what runs unattended is your decision rather than ours.
How does this work alongside our existing team?
Co-managed delivery is normal rather than an exception. Where you already have capability you want to keep using, the split of responsibilities is agreed during scoping — what we work, what you work, and where the handover sits — rather than assumed and then argued about during an incident.
Are you a Microsoft shop?
Yes. Wizard Cyber is a Microsoft Solutions Partner for Security holding all four security specialisms, and we have run Microsoft Sentinel in production since 2019. The one deliberate exception is operational technology, where we treat every OT platform as an equal because the expertise that makes monitoring useful sits with our analysts rather than with any one vendor.
Where does an engagement start?
With a conversation about what you run and what worries you about it, followed by a demo against your own scenarios rather than a canned one. Nothing is deployed and nothing is priced before the scope is agreed in writing.
Tell us what you run
and what worries you about it.
A demo against your own scenarios rather than a canned one, with an analyst rather than a salesperson. Nothing is deployed and nothing is priced before the scope is agreed in writing.