SECURITY SERVICES
Security monitoring and investigation
Understand what your security tools are telling you. We review alerts from the systems in scope, investigate suspicious activity and explain what your team needs to do next.
Who this is for
For businesses that have IT support and security tools, but need a defined process for reviewing alerts and following up on findings.
An assessed alert, a recommended response and a named owner for the next step.
SECURITY SERVICES
What the service covers
Devices
We review relevant alerts from device protection tools and investigate the activity behind them.
User accounts
We assess unusual sign-ins, changes to access permissions and related account activity.
Networks and cloud services
We review available security records from the networks and cloud services included in the agreement.
Investigation and coordination
We assess the findings, explain the business risk and agree the response with the people authorised to make those decisions.
What you receive
- A record of the systems and alert sources included in monitoring.
- Investigation summaries with the relevant evidence and recommended next steps.
- Agreed contacts, responsibilities and permissions for response actions.
- A reporting schedule and a way to track findings that still need action.
AN ILLUSTRATIVE EXAMPLE
An unfamiliar account sign-in
A successful sign-in to a company account is recorded from an unfamiliar device and location.
What we check
- 01
Review the sign-in result, device information and authentication records.
- 02
Confirm the user’s activity through a trusted contact method.
- 03
Check for related changes and signs of unauthorised access.
If the findings indicate a compromised account, we take the authorised containment steps and coordinate follow-up work with IT.
CYBERTILLA / HOW WE WORK
How we work
- 01
Define coverage
We agree the systems, information sources, monitoring hours and contacts.
- 02
Connect and check
We confirm that the agreed sources provide usable security information.
- 03
Review and investigate
We assess alerts and investigate activity that needs closer attention.
- 04
Follow through
We record decisions, coordinate agreed actions and follow up on unresolved findings.
Monitoring hours, response times and authorised actions are specified in the proposal. Around-the-clock human monitoring requires separate confirmation.
BEFORE MONITORING STARTS
Clear coverage, hours and responsibilities.
Your proposal records how the service will operate. These details distinguish the tools running in your environment from the people reviewing findings and carrying out actions.
- Systems and sources
- The devices, accounts and services included, available integrations and any gaps in coverage.
- Human review and escalation
- The hours when specialists review alerts, the escalation contacts and the arrangements outside those hours.
- Authority to act
- Who can approve and carry out account restrictions, device isolation or other response actions.
- Reporting and costs
- The reporting schedule, how open actions are tracked, the service fee and any separate costs for software, data processing or storage.
A few practical questions
Can you use our existing tools?
Yes. We first review the tools and information already available. We propose additional tools only where they are needed for the agreed service.
Does every alert mean there is an incident?
An alert is a reason to investigate. We assess the available evidence and context before deciding whether an incident response is needed.
Who can block an account or isolate a device?
The service agreement defines who can approve and carry out each action. We do not assume authority over your systems.
LET’S FIND A STARTING POINT
Let’s discuss your security needs.
Tell us about your systems, existing IT support and the concern you want to address. We’ll discuss a suitable scope of work.