Managed security (SOC/MDR) 24/7 with SLAs, playbooks and evidence

Hard2bit commits triage times by severity, not a single headline number. Critical incidents are triaged in under 15 minutes and escalated through agreed emergency channels with containment already in motion; high severity in under 30; medium and low within the working day. What matters as much as the figure is what the clock measures: ours starts when the alert fires, not when an analyst opens the ticket.

A playbook is the written decision path for one scenario — ransomware behaviour, business email compromise, impossible travel, credential stuffing. Each one states the trigger, the enrichment steps, the containment actions authorised without calling you, the ones that need your sign-off, who is notified and what evidence is preserved. Hard2bit rehearses them before go-live, because a playbook first executed during a real incident is a document, not a capability.

Escalation goes to a named person on your side agreed during onboarding, never a generic inbox, with a documented fallback if that person does not answer within the agreed window. For critical incidents out of hours we act first within the authority you granted and notify immediately after — waiting for a callback at 3am is how containment windows are lost.

A Hard2bit quote states the coverage window (8x5, 16x5 or 24x7), the telemetry sources in scope, the triage SLA by severity, which containment actions we may take without asking, the reporting cadence and whether an incident response retainer with reserved hours is included. If a quote does not separate monitoring from response authority, those are two very different services being priced as one.

SOC describes the function: the people, shifts and platform. MDR is what that function is contracted to deliver — 24/7 operations, technology plus analysts, procedures, SLAs and response, meaning investigation and containment, on top of monitoring. The commercial distinction is not technology, it is who is allowed to act when something is found.

Part of it. Several Hard2bit clients delegate a single service — vulnerability management, or a virtual CISO — and keep everything else in house. Others run a hybrid where their team covers business hours and we take nights, weekends and holidays. Full 24/7 operation with response authority is one end of a range, not the entry point.

Yes. We integrate Microsoft 365 and Defender signals, cloud sources and SIEM/EDR, and align alerts to use cases, playbooks and escalation. If you already own a SIEM we operate it rather than asking you to replace it, because ripping out a working platform adds migration risk without adding detection.

Scenario-based tuning, rules and thresholds, context enrichment, controlled suppression lists and periodic review, with signal-to-noise measured and reported. This is the part that decides whether the service works: an untuned SOC produces alerts nobody reads, and within a month your team has learned to ignore the channel it is supposed to trust.

Executive reporting with KPIs, incident summaries and the actions taken, trends, prioritised recommendations and operational evidence for audit. The same evidence is built to serve NIS2 and DORA reporting obligations, and ISO 27001 and ENS audits, so the reporting is not duplicated work.

Two to six weeks for most environments. The first week connects telemetry and agrees escalation paths; the rest is tuning and playbook rehearsal. Hard2bit runs in parallel with your existing arrangement before taking the rota, so there is no window where nobody is watching.