Managed SOC / MDR
Security operations, delivered as a service.
Managed Detection and Response (MDR) gives you the capability of an internal security operations centre — telemetry, detection, investigation and response — without building, staffing or retaining one.
Customer Security Portal
Monitoring active
Your organisation
Security posture
Open incidents
4
Critical
1
High
2
Medium
1
Endpoints
184
Servers
22
Identities
216
Recent activity
last 7 days
- high
Possible account compromise
user: j.okafor@ · Entra ID sign-in
Today 09:14
- medium
Suspicious PowerShell activity
WS-024 · encoded command
Today 04:38
- low
Vulnerability detected
WEB01 · outdated component
Yesterday
INC-2481 · Possible account compromise
- Detected
- 09:14:22
- Triaged
- 09:19:05
- Notified
- 09:24:41
- Status
- Contained
- Analyst
- Assigned
- Evidence
- 6 artefacts
Illustrative interface — representative of the reporting concept, not live customer data.
What's included
Seven functions that have to work together.
Buying any one of these in isolation produces data. Running them as a single operation produces security outcomes.
We Monitor. We Inform You.
Your endpoints, servers, identities, cloud workloads and network are watched continuously — and the moment something matters, you hear it from us.
Security telemetry is collected from the systems that actually matter to your business, then normalised so events from different sources can be correlated against each other. Monitoring runs continuously; you do not have to watch anything yourself.
The second half is the part that matters: when activity is confirmed as a genuine threat, we contact you directly — with what happened, what it affected, how urgent it is and what we recommend doing next. You are never left to discover an incident from a dashboard nobody opened.
Alert Triage
Separating the handful of events that require action from the thousands that do not.
Every detection is assessed against asset criticality, user context, prior behaviour and known-good activity in your environment before it reaches you.
Tuning is continuous. A detection that produces noise is investigated and refined, not silenced.
Threat Detection
Detection content mapped to real attacker behaviour, not just signatures.
Suspicious authentication, privilege escalation, credential access, persistence, defence evasion, lateral movement and command-and-control patterns.
Detection logic is written and maintained by the same people who run offensive assessments — so it reflects how intrusions actually unfold.
Investigation
Analysts reconstruct what happened, in what order, and what it touched.
An alert is a single frame. Investigation produces the timeline: initial access, what the account or host did next, what data or systems were in scope, and whether the activity is contained.
You receive the reconstructed narrative and the evidence behind it, not a raw event dump.
Incident Response
Confirmed incidents are classified, escalated and driven to containment.
Response actions are agreed with you in advance so there is no ambiguity during an incident about who can isolate a host, disable an account or block an address.
We coordinate with your IT team, your MSP or your vendors as required, and stay engaged through remediation.
Threat Hunting
Proactively looking for what automated detection did not flag.
Hypothesis-driven hunts across collected telemetry, informed by current attacker tradecraft and by findings from our own offensive engagements.
Hunts that find something become new detection content. Hunts that find nothing still tell you where your visibility gaps are.
Direct Notification
Confirmed incidents reach a human on your side by phone, WhatsApp or email — whichever route you nominate.
You tell us during onboarding who should be contacted, on which channel, and at what severity. Critical incidents get a call; lower severities get written notification. Nothing important waits in a queue for someone to notice it.
Every notification carries the same structure: what we detected, what it affected, our assessment of severity, the evidence behind it, and the action we recommend — so the person receiving it can decide immediately rather than asking follow-up questions.
Security Reporting
Regular reporting written to be read by both engineers and executives.
Incident summaries, detection coverage, recurring weaknesses and prioritised recommendations you can actually action.
Reporting is designed to support PTA, SBP and SECP evidence requirements, and board reporting, without being padded to look substantial.
How the SOC is built
From your estate to an incident you can act on.
Security telemetry moves through collection, analytics and detection before it ever reaches an analyst — and nothing reaches you until a human has established what it means.
Scroll the diagram horizontally to see the full flow.
Collected, not scraped
Telemetry is collected from sources you approve, over encrypted channels, at a depth agreed during scoping.
Correlated across sources
An identity event, an endpoint detection and a firewall log describe one story. They are only useful together.
Improved continuously
What incidents and offensive engagements reveal becomes new detection content, so coverage compounds.
Source types shown describe the customer-side systems telemetry is collected from. They do not imply vendor partnerships, certifications or endorsements.
What reaches you
Actionable incidents, not alert noise.
Everything between a raw event and your inbox is our work, not yours. By the time you are contacted, the activity has been detected, reviewed by an analyst, investigated and classified.
An alert-forwarding service moves the problem to you with extra steps. Your team still has to establish context, still has to investigate, and still has to decide — only now with less information than the tool that raised it.
A managed SOC absorbs that work. You receive a classified incident with evidence and a recommended course of action.
Event to notification
- 1
Security Event
Raw telemetry from your estate
- 2
Automated Detection
Analytics and detection rules
- 3
SOC Analyst Review
Human assessment of context
- 4
Investigation
Timeline and scope reconstruction
- 5
Incident Classification
Severity and impact assigned
Customer Notification
Actionable incident, with evidence
- 7
Response / Remediation
Containment and follow-through
How your SOC works
Six steps from connection to continuous improvement.
Onboarding is a defined sequence, not an open-ended project. Each step has an owner, an output and an agreed definition of done.
- 01
Connect
Security agents and log sources are connected to the monitoring platform. We agree scope, asset criticality and escalation paths before anything goes live.
- 02
Collect
Telemetry is collected from endpoints, servers, identity providers, applications and network infrastructure, then normalised into a common event model.
- 03
Detect
Detection rules and security analytics identify suspicious activity — authentication anomalies, privilege changes, malware behaviour, persistence and lateral movement.
- 04
Investigate
Analysts correlate related events, establish what actually happened, and determine whether the activity is benign, suspicious or a confirmed incident.
- 05
Respond
Confirmed incidents are classified and escalated through the agreed path, with containment and remediation actions coordinated against pre-approved playbooks.
- 06
Improve
Findings from incidents, hunts and offensive assessments feed back into detection content, so coverage improves against the attacks that matter to you.
Security architecture
Your data stays yours.
Analysts operate across monitored environments so expertise compounds. Customer data does not travel with them — each environment is logically separated and access-controlled.
Conceptual architecture. Specific platform, topology and control implementation details are shared under NDA during scoping rather than published.
Pricing
Enterprise-grade security operations, priced for Pakistani organisations.
Billed in rupees, scoped to what you actually run. No dollar-denominated surprises at renewal, and no rate card that ignores your environment.
Managed SOC / MDR
per endpoint / server
Final pricing depends on estate size, coverage hours and environment complexity, and is confirmed in writing after scoping.
What that covers
- Telemetry collection from your endpoints, servers, identities and cloud
- Detection content, written and maintained against real attacker techniques
- Alert triage — you never receive the raw queue
- Analyst-led investigation with a reconstructed attack timeline
- Incident notification with evidence and a recommended course of action
- Response coordination within the authority you pre-approve
- Regular security reporting for both engineers and leadership
What moves the number
Stated openly, so nothing appears for the first time in a proposal.
- Estate size
- Number of endpoints, servers and identities actually in scope — not a headcount-based band.
- Coverage hours
- Business hours, extended hours or continuous coverage, including 24/7 options.
- Environment complexity
- Number and type of telemetry sources, and how much normalisation they require.
- Response authority
- Whether we are pre-authorised to contain, or escalate only.
- Compliance obligations
- Evidence and reporting requirements from PTA, SBP, SECP or your customers.
- Engagement mix
- Whether monitoring is combined with penetration testing or assurance work.
Scoped before quoted
We establish what you run and where the risk sits before quoting. A number produced before that is a guess with a price attached.
Priced in rupees
Billing in PKR, so your costs do not move with the exchange rate. No dollar-denominated surprises at renewal.
No padding
We will tell you when a smaller engagement answers your question — including when the honest answer is that you do not need us yet.
Penetration testing and security assurance engagements are priced per engagement rather than per endpoint, because they are scoped by what is being tested and how deeply — not by how many machines you own. Tell us what you need assessed and you will get a fixed written quote before any work starts.
Service levels
Scoped to your requirements, agreed in writing.
We don't publish a headline response time, because a number set before anyone has seen your environment isn't a commitment — it's a marketing figure. Service levels are defined against the dimensions below and written into the agreement.
Monitoring Coverage
Which systems, identities and environments are in scope, and at what depth.
Response Requirements
Target acknowledgement and escalation timelines for each severity level.
Operating Hours
Business-hours, extended-hours or continuous coverage, including 24/7 options.
Business Criticality
Which assets and processes justify the fastest response, and which do not.
Organisation Size
Endpoint and server counts, user population and rate of change.
Response Authority
Which containment actions we are pre-authorised to take on your behalf.
Coverage options include 24/7, scoped during onboarding.
Questions
Managed SOC, answered.
Typically endpoint and server security telemetry, identity and authentication logs, cloud platform audit logs, and network or firewall logs. The exact set is agreed during scoping based on which systems carry your actual risk.
No. Triage and investigation happen before you are contacted. You receive classified, evidenced incidents with a recommended course of action — not an alert feed.
On the channel and to the people you nominate during onboarding. Critical incidents get a phone call; lower severities get written notification by WhatsApp or email. Every notification states what we detected, what it affected, the severity, the supporting evidence and our recommended action.
Where you pre-authorise them. Response authority — such as isolating a host, disabling an account or blocking an address — is agreed in advance and documented so there is no ambiguity during an incident.
Customer telemetry is logically separated with access controls that restrict each customer's access to their own environment. Analysts work across customers; customers do not.
From Rs 10,000 per endpoint or server, billed in Pakistani rupees so your costs do not move with the exchange rate. What moves the figure is estate size, coverage hours, environment complexity, response authority and any compliance evidence requirements.
Get started
See what monitoring your environment would actually involve.
We start by understanding what you run, what you already have in place and where the real risk sits — then scope monitoring against that, not against a package.
- 1Tell us about your environment
- 2We scope what's actually needed
- 3You get a written assessment plan