Services
What we take on
Managed detection, vulnerability assessments, and incident response for growing businesses.
Scope
Everything we take on, written as a matrix.
One row per service. Empty cells stay empty — where there is no note, there is no extra claim.
| Ref | Service | What we deliver |
|---|---|---|
| 01risk.assessment | Risk assessment | External and internal vulnerability testing with a remediation roadmap ranked by exploitability, business impact, and implementation effort. Reports are written for both technical and executive audiences — your CISO and your board can both act on the findings. Retesting is included in the scope to confirm that critical items were closed, not just acknowledged. |
| 02managed.detection | Managed detection | Log collection, SIEM correlation, alerting, and human triage with documented escalation paths so you know who calls whom when an alert fires at 2 AM. We tune alert thresholds during the first 30 days to reduce noise without suppressing real events. Monthly reporting includes alert volume, true positive rate, and mean time to triage. |
| 03incident.response | Incident response | Containment, forensic analysis, and communications support on retainer or per-event basis — whichever fits your risk profile and budget. Retainer clients receive a documented incident response plan reviewed annually and tested with a tabletop exercise. Post-incident reports include a timeline, root cause, and control recommendations to prevent recurrence. |
| 04compliance.readiness | Compliance readiness | SOC 2 readiness, cyber insurance questionnaire support, and client security questionnaire assistance with evidence already organised. We map your existing controls to the framework, identify gaps, and prioritise remediation by which gaps create the most compliance exposure. Evidence collection and maintenance are built into our ongoing monitoring workflows. |
How it works
A written loop, with a gate before anything ships.
Each engagement is the same shape. The interesting part is not the sequence — it is where the sequence stops and waits for you.
01
Baseline
Asset inventory, identity review, and quick-win hardening documented and implemented in the first two weeks.
02
Monitor & tune
Alert thresholds adjusted to reduce noise while maintaining detection of real events — reviewed monthly.
03
Review quarterly
Posture report with trend data and retest of previously critical findings to confirm closure.
Questions
The ones we get asked before the work starts.
- Do you need access to our network?
- Scoped access is required for assessments and lightweight agents are deployed for managed detection — both defined in the statement of work and revocable at any time. We document all access grants and review them at each renewal. No remote access is maintained between engagements without your explicit authorisation.
- Is 24/7 response available?
- Premium tiers include after-hours alert triage with defined response time commitments. Standard tiers define business-hours SLAs clearly in the service agreement — there are no undisclosed exclusions for evenings or weekends. Retainer clients in any tier receive an after-hours emergency contact for confirmed active incidents.
- Do you focus on Microsoft 365?
- Identity, email, and SharePoint hardening are core offerings because that is where most mid-market organisations have the highest exposure. We also cover cloud workloads in AWS and Azure and on-premises infrastructure. Scope is defined in assessment so recommendations reflect your actual environment.
- What does the monthly reporting include?
- Alert volume, true positive and false positive rates, mean time to triage, open vulnerability status, and any new threat intelligence relevant to your industry. Reports are reviewed with your team on a scheduled call so the numbers have context rather than sitting in a portal you have to interpret alone.
Write to Soft Signal House
Managed detection, vulnerability assessments, and incident response for growing businesses.