A complete security team, with nobody to hire.
The Virtual Security Team puts the roles of a security operations centre at your company disposal, with deadlines agreed in the contract and everything visible in the dashboard. If you already know your environment, you can go straight to contracting.
The roles the contract covers
Each speciality steps in when the work calls for it. Your company hires, trains and retains none of these professionals.
- Security analyst, tier 1
- Alert triage. Separates noise from what needs attention, within the agreed deadline.
- Security analyst, tier 2
- Investigates what clears triage. Reconstructs events and determines the scope.
- Security analyst, tier 3
- Complex cases and new threats. Runs threat hunting and tunes detections.
- Incident response analyst
- Containment, eradication and return to normal once an incident is confirmed.
- Security engineer
- Deploys and maintains defences, with hardening, tool integration and automation.
- Forensic analyst
- Evidence preservation and detailed reconstruction when the case calls for forensics.
Virtual CISO, the leadership package
Contracted separately, the Virtual CISO owns risk management, sets priorities, organises the team work and reports to the board in business language.
Monthly hours are fixed in the contract. Without this layer you have execution. With it you also have someone answerable for strategy.
Scope of the operation
Scope is agreed with your company and revisited when the environment changes.
- Monitoring of environments and security events
- Operational administration of the operations centre
- Incident management and follow-up
- Investigation, analysis and incident response
- Operation and support of SIEM, EDR, XDR and IDS/IPS
- Vulnerability management
- Hardening of environments and systems
- Log and indicator of compromise analysis
- Support for information security projects
- Support for compliance and regulatory alignment
- Creation of policies, procedures and playbooks
- Information security consulting
- Training and awareness
- Technical and executive reporting
- Handling of security tickets
What comes with the contract
- Root cause analysis
- Every closed ticket records why it happened, alongside what was done.
- Continuous maturity assessment
- The level is recalculated against the real environment, and the curve is documented.
- Process construction
- Missing procedures are written with the people who run them, then trained.
- Automation of routine work
- Repetitive work runs on its own, freeing specialist hours.
- Complete scope
- No per-module billing. What is in scope is included.
Agreed deadlines, kept visible
Each ticket type carries acknowledgement and resolution deadlines set in the contract. Priority is computed from severity, urgency and trend, with the criteria on record.
You follow it in the dashboard: inventory, open risks, vulnerabilities by severity, tickets with the clock running and the audit trail behind every action.
Two routes to the contract
The usual route starts with the free analysis: with a picture of the environment in hand, scope is defined on fact rather than assumption. If you have a recent assessment and know your priorities, you can go straight to contracting.