How the watch works, from the first call to the monthly report.
Everything below is written into the contract. None of it is a slide we show once and forget.
The four weeks before the watch goes live.
What happens each week, and what we need from your team. Most companies are covered 21 to 28 days after they sign.
Three watches a day, one room, handovers you can read.
Every handover at 07:00, 15:00 and 23:00 is written down: open cases, what each client’s runbook allows, and anything unusual from the last eight hours. Your account lead reads them too.
What we agree before we start.
A one page runbook for your company, signed by you and reviewed every quarter. These are the defaults most clients keep.
We act without calling
Isolate a laptop or server from the network
Revoke sessions and force a password reset
Block a sender, domain or IP address
Hold outbound mail from a mailbox we suspect
We call you first
Disabling an account used by a machine or service
Anything touching ERP, payroll or plant systems
Isolating more than five devices at once
Contacting your customers, vendors or insurer
We never touch
Payments, bank details or payroll records
Production lines, medical devices or controllers
Backups, beyond checking they exist
Anything the runbook does not list
When something fires at night.
The same order every time, whether it is 14:00 on a Tuesday or 02:14 on a Sunday.
The report your insurer and auditor will ask for.
Delivered on the first Monday and walked through on a 45 minute call. It shows every alert we triaged, every incident minute by minute, the hours we covered and three fixes in the order that matters.
The contract terms, in plain words.
Thirty minutes to find out who is watching your network tonight.
Bring your last insurance questionnaire or audit finding. We tell you in plain words where you are exposed after hours and what closing it would cost, then send a written quote within two business days.