Security that fits how you actually work.
Soft Signal House helps growing companies reduce cyber risk through assessments, managed monitoring, and incident response — practical controls sized to your team, not an enterprise checklist dropped on a ten-person operation.
Recent clients
Every step written down. Nothing proceeds past the review gate unsigned.
- 01baselineAsset inventory, identity review, and quick-win hardening documented and implemented in the first two weeks.
- 02monitor.tuneAlert thresholds adjusted to reduce noise while maintaining detection of real events — reviewed monthly.
- 03review.quarterlyPosture report with trend data and retest of previously critical findings to confirm closure.
In production
200+
Clients protected
15min
Critical alert triage SLA
10
Security analysts
100%
Quarterly posture reporting
01
Risk assessment
External and internal vulnerability testing with a remediation roadmap ranked by exploitability, business impact, and implementation effort. Reports are written for both technical and executive audiences — your CISO and your board can both act on the findings. Retesting is included in the scope to confirm that critical items were closed, not just acknowledged.
02
Managed detection
Log collection, SIEM correlation, alerting, and human triage with documented escalation paths so you know who calls whom when an alert fires at 2 AM. We tune alert thresholds during the first 30 days to reduce noise without suppressing real events. Monthly reporting includes alert volume, true positive rate, and mean time to triage.
03
Incident response
Containment, forensic analysis, and communications support on retainer or per-event basis — whichever fits your risk profile and budget. Retainer clients receive a documented incident response plan reviewed annually and tested with a tabletop exercise. Post-incident reports include a timeline, root cause, and control recommendations to prevent recurrence.
04
Compliance readiness
SOC 2 readiness, cyber insurance questionnaire support, and client security questionnaire assistance with evidence already organised. We map your existing controls to the framework, identify gaps, and prioritise remediation by which gaps create the most compliance exposure. Evidence collection and maintenance are built into our ongoing monitoring workflows.
How it works
A written loop, with a gate before anything ships.
Each engagement is the same shape. The interesting part is not the sequence — it is where the sequence stops and waits for you.
01
Baseline
Asset inventory, identity review, and quick-win hardening documented and implemented in the first two weeks.
02
Monitor & tune
Alert thresholds adjusted to reduce noise while maintaining detection of real events — reviewed monthly.
03
Review quarterly
Posture report with trend data and retest of previously critical findings to confirm closure.
What people say
The people who signed off on the work.
They stopped a BEC attempt because MFA was deployed the week before — after an assessment identified exactly that gap.
Chris Dalton
Managing partner, law firm
Insurance questionnaire went from two weeks of panic to an afternoon with their evidence pack.
Nina Patel
CFO, SaaS company
Questions
The ones we get asked before the work starts.
- Do you need access to our network?
- Scoped access is required for assessments and lightweight agents are deployed for managed detection — both defined in the statement of work and revocable at any time. We document all access grants and review them at each renewal. No remote access is maintained between engagements without your explicit authorisation.
- Is 24/7 response available?
- Premium tiers include after-hours alert triage with defined response time commitments. Standard tiers define business-hours SLAs clearly in the service agreement — there are no undisclosed exclusions for evenings or weekends. Retainer clients in any tier receive an after-hours emergency contact for confirmed active incidents.
- Do you focus on Microsoft 365?
- Identity, email, and SharePoint hardening are core offerings because that is where most mid-market organisations have the highest exposure. We also cover cloud workloads in AWS and Azure and on-premises infrastructure. Scope is defined in assessment so recommendations reflect your actual environment.
- What does the monthly reporting include?
- Alert volume, true positive and false positive rates, mean time to triage, open vulnerability status, and any new threat intelligence relevant to your industry. Reports are reviewed with your team on a scheduled call so the numbers have context rather than sitting in a portal you have to interpret alone.
Write to Soft Signal House
Managed detection, vulnerability assessments, and incident response for growing businesses.
Contact
Ask something specific.
Tell Soft Signal House what you need and we will come back with a written next step, not a brochure.