Detect. Stop. Explain.
A security operations centre (SOC) is a control room for IT security. Ours is based in Germany and staffed around the clock. It spots attacks on your devices and in your cloud, stops them and finds out what happened. We are not tied to any vendor: we run the solution you already use.
Why a SOC?
Spotting attacks is not a product you buy. It is a job somebody has to do every day.
Attacks do not keep office hours
Ransomware tends to strike at night, at weekends and on public holidays. That is exactly when nobody is watching the screen. An alert at 3am only helps if somebody checks it at 3am.
An alert without assessment is not protection
Device security software reports a lot. Someone has to tell false alarms from the early signs of an attack. Otherwise people tune out, and the one alert that matters gets lost.
An in-house SOC ties up people permanently
Round-the-clock operation means shift work, cover for holidays and sick days, and constant training. For most mid-sized firms, money is not the problem. The skilled staff simply are not there.
NIS2 and ISO 27001 ask for evidence
Installing something is not enough. You must show that you detect, assess and respond to incidents, with records anyone can follow. Running a SOC gives you exactly that along the way.
We do not arrive with a product you have to buy.
Many providers sell their own software along with the SOC. And then they recommend their own product remarkably often. We earn on running the service, not on licences. That lets us give you unbiased advice.
Your solution, our operation
We work with the security software (EDR or XDR) you already run. Your investments are kept. You do not have to switch to work with us.
No SIEM of your own required
We bring the analysis platform. If you already run a SIEM, we work inside it. We do not put a second one next to it.
Product-neutral advice
If you have nothing in place yet, our recommendation follows your environment and your requirements — not a vendor partnership.
No licence margin
We earn on the operation, not on reselling licences. That leaves our recommendation without a second, hidden motive.
What our SOC does
Six building blocks that together make the difference between watching and acting.
Staffed SOC operation
Around the clock, 365 days a year, with our own team. Nothing is passed on to other contractors. And there is no anonymous ticket queue.
Review of your alerts
We run the device and cloud security tools you already use. We assess their alerts ourselves, with a second pair of eyes. Nothing is just forwarded automatically.
Containment within agreed limits
When it counts, we cut affected devices off the network and lock accounts and sessions. That stops the attacker from spreading. We stay within the limits you set beforehand.
Threat hunting
We actively search for odd activity that did not trigger an alert. This is how we find attackers who work hard to stay quiet.
Digital forensics
Once something has happened, we secure traces and rebuild the timeline. Every piece of evidence stays traceable and holds up in court.
Reporting and maturity
Regular reviews with trend lines. We tell you how mature your security is. And we explain where an investment really pays off.
How we get started
From the first conversation to live operation — with no surprises when it counts.
Scoping
Which systems matter? Which reporting lines apply? Who can be reached when it counts? And how far may we act without asking first?
Connection
We connect the data feeds from your devices, servers and cloud services. We take over your existing tools instead of replacing them.
Baseline
We watch your setup for a while. That way we can tell normal from suspicious behaviour. Without this step, any SOC mostly produces false alarms at first.
Operation
We detect attacks, an analyst assesses them, and we contain them within the agreed limits. Everything is documented and traceable.
Handover to incident response
If an alert becomes a real incident, our incident response team takes over. It already has all the context we gathered. The handover point is fixed in advance.
Service review
We go through it together on a regular basis. What happened? What worked? Where is the next investment worth making?
Managed detection and response is not SIEM outsourcing
The difference is not the technology. It is about who is allowed to act when it counts.
| Our MDR | Classic SIEM outsourcing | |
|---|---|---|
| Who assesses the alert | An analyst with incident experience | Often a rule, then the customer |
| Authority to act | Containment within contractually defined limits | The notification is forwarded, action happens in-house |
| Tooling lock-in | Vendor-independent, your existing solution | Often tied to the provider platform |
| Where the analysts sit | Our own team in Germany | Frequently a multi-stage outsourcing chain |
| Forensics | Part of the service | Commissioned separately |
| Reporting | Service review with maturity recommendation | Alert statistics |
What you get
- A service report with trend lines rather than a bare alert count
- A traceable history of every assessed alert
- Jointly agreed emergency procedures for the most common cases
- A maturity recommendation with a reasoned order of priority
- An emergency contact chain that is genuinely reachable when it counts
- A defined handover point to incident response
If it happens anyway
A SOC lowers the chance that an alert turns into damage. It cannot rule it out. For the real thing, the same team is ready, and it already knows your setup.
Frequently asked questions
- Are you tied to a particular vendor?
- No. We run the security software for your devices (EDR or XDR) that you already use, and we review its alerts. We do offer our own EDR, SecTepe Endpoint, but the SOC does not require it. If you have nothing in place yet, we advise based on your setup, your compliance needs and your budget. SecTepe Endpoint is one option among several, not a condition.
- Do we need our own SIEM?
- No. A SIEM collects and analyses the logs of your systems. We bring that platform with us. If you already run a SIEM, we work inside it. We do not set up a second one next to it. Both work. We decide together which fits better when we agree the scope.
- Who decides whether an endpoint gets isolated?
- You do, in the contract. Option one: we act on our own within clear limits. Then we cut an infected device off the network at once, without asking first. Option two: we reach you through an agreed on-call line. We act only once you approve. We put those limits in writing, so nobody has to improvise when it counts.
- Where is our data processed?
- In Germany. Alerts, analysis and storage stay in German data centres. The analysts are our own people. Nothing is passed on to other contractors. That is why we run the SOC ourselves rather than buying it in.
- What does onboarding look like?
- First we agree on scope, systems and reporting lines. Then we connect the data feeds from your systems. For a while, we just watch. That way we learn what is normal for you and what is suspicious. Without that baseline, any SOC mostly produces false alarms in its first weeks. Only then does live operation start, with agreed emergency procedures.
- What happens when an alert turns into a real incident?
- Our incident response team takes over. It already has everything the SOC gathered: the logs, the background and the timeline. The handover point is set in advance. So no time is lost starting from scratch.
- What does running the SOC cost?
- It depends on the number and type of connected systems, how far we may act on our own, and how long we keep data. After a free scoping call, you get a quote with a clearly defined scope. Licences for your device security software are not included. Those stay with you and your vendor.
You can watch it yourself — or let us do it.
We run security operations for mid-sized companies and public authorities. Let us talk about your environment — without a product recommendation in our bag.
Arrange a SOC callHow we work with you
We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.
1. Free initial conversation
We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.
2. Current state review
We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.
3. Delivery with a dedicated lead
An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.
4. Running and reviewing
After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.