// 01 — DETECT
Managed detection & response
24/7 analysts triage alerts from endpoint, cloud, identity and email.
- Sensor deployment & tuning
- Custom detections
- Monthly threat report
Security services, fully staffed.
Six services, one team, one set of service levels. Pick what you need today and add the rest as you grow.
// 02 — RESPOND
Incident response retainer
Pre-negotiated hours, a named commander and forensics when you need them.
- Bridge within 5 minutes
- Legal & insurer liaison
- Post-incident report
// 03 — HUNT
Threat hunting
Weekly hypothesis-led hunts mapped to MITRE ATT&CK.
- Hunt reports
- New detections shipped
- Adversary emulation
// 04 — TEST
Penetration testing
Web, network, cloud, mobile and red-team engagements.
- Fixed-price scoping
- Developer-ready fixes
- Free retest
// 05 — HARDEN
Exposure management
Continuous external scanning with prioritised remediation.
- Asset inventory
- Ticketed fixes
- Board-level risk trend
// 06 — ACCESS
Zero-trust access
Replace VPNs with identity- and device-aware access to every app.
- Passkeys & FIDO2
- Device posture
- Policy as code
Response
Service levels in writing.
Measured from first alert. Reported monthly. Credits if we miss.
| Severity | Example | Acknowledge | Contain | Updates | On-site |
|---|---|---|---|---|---|
| P1 Critical | Active breach, ransomware, data exfiltration | 5 min | 30 min | Every 30 min | 4 h |
| P2 High | Confirmed compromise of a host or account | 15 min | 2 h | Every 2 h | 24 h |
| P3 Medium | Suspicious activity or policy violation | 1 h | 8 h | Daily | On request |
| P4 Low | Hardening advice, informational findings | 4 h | 3 days | Weekly | — |
- T+00:00
Detect
Correlated alert fires across endpoint, identity and network.
- T+00:04
Triage
Analyst confirms scope; incident commander paged.
- T+00:15
Contain
Host isolated, sessions revoked, IOCs blocked fleet-wide.
- T+01:00
Eradicate
Persistence removed; affected accounts rotated.
- T+24:00
Report
Root cause, timeline and hardening plan delivered.
Onboarding
Protected in under two weeks.
01
Scope
Map assets, owners and escalation paths in one workshop.
02
Deploy
Roll out sensors via your existing device management.
03
Tune
Two weeks of baselining removes the noise.
04
Operate
24/7 monitoring, monthly reviews, quarterly exercises.
cipheron@soc:~$ ./engage --now
Not sure where to start?
Get a free posture review with a senior analyst. You keep the findings either way.