Secure it · SEC-02
Managed Detection & Incident Response
Someone watching your logs at 3am. And a team ready to move when the alert is real.
24/7 monitoring, threat hunting and incident response for organisations that can't staff a full security operations centre. We tune detections to your environment so analysts chase real threats, and when something does go wrong we contain it, investigate it and tell you exactly what happened.
What's included
Pick what you need. We'll tell you what you've missed.
24/7 managed detection & response
Continuous monitoring of endpoints, identity, cloud and network telemetry with analyst triage. You get calls about incidents, not noise.
SIEM design & tuning
Deploy or fix Microsoft Sentinel, Wazuh, Elastic or Splunk. Log sources prioritised, detections written for your environment, false positives killed.
Incident response retainer
Guaranteed response times, pre-agreed terms and a team that already knows your network when ransomware hits.
Digital forensics
Disk, memory and log forensics to establish root cause, scope of compromise and evidence that holds up for legal, insurance and regulators.
Threat hunting
Hypothesis-driven hunts across your telemetry for attackers who got past the alerts. Mapped to MITRE ATT&CK.
Vulnerability management
Continuous scanning, asset inventory, risk-based prioritisation and patch tracking. A shrinking backlog you can report on monthly.
Endpoint & email security
EDR rollout and tuning, email authentication (SPF, DKIM, DMARC) and phishing defence that actually blocks the business email compromise attempts.
Threat intelligence
Brand monitoring, leaked credential alerts and dark-web monitoring focused on threats aimed at Nigerian and African organisations.
How it runs
The process.
- 1
Onboard
Connect log sources, baseline normal activity, agree escalation paths and run-books.
- 2
Detect
Correlated alerts triaged by analysts around the clock. Context added before anyone wakes you up.
- 3
Respond
Isolate hosts, disable accounts, block indicators. Contain first, then investigate.
- 4
Recover
Eradicate persistence, restore safely and confirm the attacker is gone.
- 5
Improve
New detections and hardening from every incident, so the same trick doesn't work twice.
What you walk away with
Deliverables.
- Defined response SLAs by severity
- Monthly security operations report with trends and actions
- Custom detection rules mapped to MITRE ATT&CK
- Incident reports with timeline, root cause and lessons learned
- NDPA breach notification support within the 72-hour window
- Quarterly purple-team exercises to prove detections fire
FAQ
Questions we get asked.
We already have antivirus. Why do we need this?
Antivirus stops known malware. Most serious breaches now use stolen credentials and legitimate admin tools that antivirus ignores. Detection and response is about spotting that behaviour and stopping it fast.
Do we have to replace our existing tools?
No. We work with what you have wherever it's workable, and only recommend changes where there's a real coverage gap.
What happens if we're breached before signing up?
Call us anyway. We take emergency incident response engagements and can be working on your environment within hours.
Often paired with
Penetration Testing & Red Teaming
We attack your systems the way a real adversary would. With permission, and a report you can act on.
Governance, Risk & Compliance
Certifications that reflect how you actually operate. Not a binder that sits on a shelf.
Business Continuity & Disaster Recovery
When the data centre floods or ransomware locks everything, you'll already know what to do.
Let's talk about SOC & IR.
Send a few lines on what you need and when. You'll get a reply from a practitioner, not a sales rep, within one working day.