Alerts alone do not stop an attacker. MDR adds investigation and response: confirmed threats are contained on your behalf within the limits you set, and each case is explained in plain language.
You decide how far response can go, from recommendations only to automatic containment of defined cases. Every action is logged and reviewed with you.
Why it matters
Threat investigation, not just alert forwarding
Containment actions within limits you authorize
Case write-ups with root cause and next steps
Detection tuned to your environment and threats
Direct line to an analyst during an incident
Who delivers each serviceSome managed services are delivered by a vetted delivery partner rather than by CISO Consulting's own team. Each service states who delivers it, and the proposal confirms the delivering party and the contract before you commit. Explore managed security
How the engagement runs
- 1AgreeResponse limits, contacts and approval rules
- 2DeploySensors, integrations and baselines
- 3RespondInvestigate, contain and report each case
- 4ReviewLessons learned and tuning every month
What you receive
- Response authorization matrix
- Case reports for every confirmed incident
- Monthly detection and response report
- Detection tuning log
Packages
| Essential | AdvancedRecommended | Enterprise | |
|---|---|---|---|
| Monitoring hours | Business hours | Extended hours | Round the clock |
| Log and sensor coverage | Core sources | Core and cloud sources | All sources, including custom and OT |
| Response | Notify and recommend | Guided containment | Authorized containment |
| Critical alert triage target | One hour | Thirty minutes | Fifteen minutes |
| Reporting | Monthly | Weekly and monthly | Weekly, monthly and board-ready |
| Service review | Quarterly | Monthly | Monthly with executive review |
The exact scope and targets are confirmed in your proposal.
Questions
Can you act without asking us first?
Only for the actions you pre-authorize in the response matrix. Everything else is recommended and waits for your approval.
Which tools do you work with?
The service is tool-aware, not tool-bound. We confirm supported platforms during scoping.