Practice 02
Managed SOC & Defensive Operations
Detection, investigation, and response from analysts who know your environment, with monitoring that does not stop when the office closes.
Why it matters
Alerts arrive around the clock, but nobody owns them once the office closes.
Staffed analysts monitor 24/7/365. We use your existing SIEM and EDR, and this page names no product platform.
Detection content is written for your estate. A default rule pack that nobody has read is not a detection program.
The service is for organizations that need coverage now and want their own people to grow into it. It is not a way to outsource judgment forever.
Who it is for
Organizations that cannot yet staff a full security operations team, and teams that need a partner beside the analysts they already have.
Risks it addresses
- Alerts that fire with no one assigned to investigate
- Default detection rules that miss the techniques you actually face
- Incidents that start outside office hours
What is in scope
- SOC as a Service
- MDR
- SIEM deployment and tuning
- EDR/XDR monitoring
- Threat hunting
- Threat intelligence
- Incident response
- IR retainer
- Digital forensics (DFIR)
- SOC build and maturity assessment
- Compromise assessment
Cybersecurity for Banks, Government & Industry
Banking, payments, and fintech
Controls and evidence for payment and banking environments, including the Central Bank of Egypt cybersecurity framework, PCI DSS, and SAMA CSF where those obligations apply.
Telecom and digital services
Protection for the platforms, the customer data, and the availability those businesses sell. NTRA requirements are named where they apply.
Industry, manufacturing, and critical infrastructure
Testing and monitoring planned so a production environment stays up, including OT/ICS where that is in scope. NCA ECC is named where that obligation applies.
Government and public sector
Governance, monitoring, and training for public bodies. The NCA Essential Cybersecurity Controls are named where that obligation applies.
Healthcare
Systems that hold personal data, including Egypt's Personal Data Protection Law where that obligation applies.
Oil, gas, and energy
Testing and monitoring for operational environments, including OT/ICS where that is in scope.
Insurance and non-bank finance
Governance and testing where FRA requirements apply, alongside the applications those firms run.
Retail and e-commerce
Customer-facing stores and payment flows, including PCI DSS where card data is in scope.
Education
Training for the people who run the institution, plus testing and monitoring of the systems they rely on.
Methodology
How it runs
- 01
Sources
Agree the systems, the retention, and the hours of coverage before a single alert is promised.
- 02
Detections
Tune what you already have and add the cases that are missing.
- 03
Operate
Investigate, escalate, and record. You always know who has a case.
- 04
Improve
A monthly review, new detections, and a drill when you want one.
What you receive
Monitoring, investigation, and response with a named owner and a written record for every case.
- Onboarding of the log and alert sources that matter
- Detection content mapped to the techniques you actually face
- Triage and investigation with a written record of every case
- Incident response support against an agreed plan
- A monthly review of what fired, what was noise, and what should change
After the engagement
Monthly review and continuous tuning
Each month we review what fired, what was noise, and what should change, then add or tune detections. Drills run when you want one.
How we stand behind the work
Commitments that apply to this practice.
Scope in writing
Systems, rules of engagement, and what done means are agreed before testing or monitoring starts.
Evidence over volume
Findings name the system, the condition, and the business consequence. A long list with no order is not a result.
No surprise in production
Assessment and defensive work is scheduled so operations stay up. Sensitive findings get a live channel, not a surprise in the final PDF.
Handover, not a drop
Briefings, retests, and retained support are part of the engagement. The report is not the end of the conversation.
Questions
Frequently asked questions
Does this replace our own team?
No. The service gives you coverage now and is designed for your own people to grow into it. It also works beside analysts you already have.
Which log sources do you need?
We agree the systems, the retention, and the hours of coverage before any alert is promised, and onboard the sources that matter first.
How will we know what was investigated?
Every case has a written record, and you always know who owns it.
Talk to our security experts
Discuss Managed SOC & Defensive Operations with a specialist.
A short brief is enough: the environment, the deadline, and whether you need a test, a control program, or coverage for the team.