Skip to content

Managed Security & SOC

Your Microsoft environment monitored, with a monthly report for auditors.

Alerts are handled, incidents contained within agreed response times, and every month you receive evidence per control. We operate Defender XDR, Microsoft Sentinel, Entra ID and Intune in your own tenant.

Book an introductory call How it works

Example of a monthly evidence report: MFA for all accounts, privileged roles and device compliance are evidenced, incidents are documented, monitoring is active.

For
Companies with 50 or more employees on Microsoft 365
Scope
Three tiers, from Secure Start to Detection & Response with Sentinel
Start
Onboarding in 4 to 8 weeks
Included
WCS portal, phishing simulation, monthly report
Price
from €2,500 per month, licences and Azure consumption billed separately

Sound familiar?

Small IT team, no time for alerts

50 employees or more, but nobody reviews the security alerts.

Auditors and insurers want proof

NIS2, ISO 27001 or your insurer ask for documented proof.

“All fine”, says your provider

They cannot document it, and nobody knows what happens at night.

Signal chain

How does a signal become evidence?

Secure Base operates the protection in your licences. Detection & Response adds Sentinel and round-the-clock monitoring. Switch tiers to see what is added.

Choose a tier

  1. 1 Sources

    Entra ID, devices, email

    + Azure and other sources

  2. 2 Detection

    Defender XDR

    + Sentinel with analytics rules

  3. 3 Triage by WCS

    Defined response times

    + around the clock

  4. 4 Response in your tenant

    Disable account, isolate device

    + Playbooks, automated

  5. 5 Evidence

    Monthly report per control

Signal chain in five steps. Secure Base: sources Entra ID, devices and email, detection with Defender XDR, triage by WCS with defined response times, response in your tenant by disabling accounts and isolating devices, monthly report per control. Detection & Response adds Azure and other sources, Sentinel with analytics rules, round-the-clock triage and automated playbooks.

An example from operations

What happens during an incident at 02:14?

A typical case in the Detection & Response tier, step by step. The time is an example; the response time is the one in your contract.

Step 1 / 5

Three tiers

Which tier fits you?

Secure Start

from €2,500 per month

For companies with 50 or more employees who want their security alerts handled.

  • Defender XDR alerts reviewed and acted on during business hours
  • WCS portal for requests, approvals and reports
  • Phishing awareness training and simulation for your employees
  • Monthly report

Secure Base

from €3,500 per month

We also operate the protection that comes with your licences.

  • Everything in Secure Start
  • Operation of Entra ID, Conditional Access, Defender for Office 365, Intune and Defender for Endpoint
  • Incident response with defined response times
  • Monthly evidence per control

Detection & Response

from €5,500 per month

For environments that must be monitored around the clock.

  • Everything in Secure Base
  • Microsoft Sentinel with analytics rules and playbooks
  • Round-the-clock monitoring, including public holidays
  • Further sources such as Azure and longer retention

Microsoft licences and Azure consumption come on top. The security assessment shows which tier fits.

How does operation start?

  1. Fixed price

    Security Assessment

    Review the tenant against baselines, choose the tier.

  2. 4 to 8 weeks

    Onboarding

    Access rights, escalation paths, runbooks. With Sentinel, typically 3 to 6 months to steady operation.

  3. Continuous

    Ongoing operation

    Monitoring, response, rule maintenance.

  4. Every 3 months

    Quarterly review

    Review status, deviations and scope together.

Where does your tenant stand today?

The fixed-price Security Assessment clarifies licences, gaps and the right tier.

Request the fixed-price Security Assessment

What changes?

Today

  • Alerts go unhandled
  • MFA coverage and admin rights unclear
  • No evidence for auditors
  • Incidents without a procedure

With managed security

  • Triage by WCS following a defined procedure
  • MFA and roles reported monthly
  • A report an auditor can read
  • Runbooks and handover without lock-in

Frequently asked questions

What is the difference between managed security and a SOC?

A SOC (security operations centre) monitors alerts and responds to incidents. Managed security also operates the protection itself; with us, the SOC is the Detection & Response tier.

Do I need Microsoft Sentinel or is Defender XDR enough?

Defender XDR keeps data available for hunting for 30 days by default. You need Sentinel for longer retention, further sources such as Azure, or your own rules and playbooks.

How much does managed security for Microsoft 365 cost for a mid-sized company?

Secure Start costs from €2,500 per month, Secure Base from €3,500 per month and Detection & Response from €5,500 per month, depending on users, devices and data volume. Licences and Azure consumption come on top. After the Security Assessment you receive a proposal with a clearly defined scope.

What happens if a security incident occurs at night or at the weekend?

In the Detection & Response tier, monitoring runs around the clock, including public holidays. Triage and containment follow contractually defined response times.

Secure Base or Detection & Response?

In 30 minutes we clarify which tier fits.

Book an introductory call