Converged SOC/NOC, cyber resilience and OT/IoT defence
Attacks detected and contained around the clock, from the data centre to the plant floor
The systems most worth attacking are the hardest to watch
Attacks do not wait for office hours, and the systems most worth attacking are often the hardest to watch: payment rails, core platforms, and the operational technology (OT) that runs plants, grids, ports and buildings. Security and network teams often look at the same incident from two consoles and miss what joins them.
Ransomware raises the stakes. When backups can be encrypted along with everything else, an attack turns into a long outage and a decision about whether to pay.
What changes for you
One team on watch
Security and network events seen together, around the clock, by engineers who can act on them.
OT protected without disruption
Control systems monitored and defended in ways that respect plant safety and uptime.
Recovery you can count on
Backups an attacker cannot alter, a clean place to restore into, and a response plan your team has rehearsed.
What we deliver
Converged SOC and NOC
A security operations centre (SOC) watches for attacks; a network operations centre (NOC) watches availability and performance. Ours is one AI-assisted team on watch around the clock, so an outage and an intrusion are never investigated apart.
Threat hunting
Engineers search your telemetry for attackers who have slipped past the alerts, guided by current threat intelligence.
Automated SOAR remediation
Security orchestration, automation and response (SOAR) playbooks that contain common attacks at once, such as isolating a device or disabling an account, with a person approving anything disruptive.
OT and SCADA security
Protection for industrial control systems and SCADA, the software that supervises plants and networks, designed with your engineers to observe control traffic without interfering with it.
Smart-grid and smart-city IoT security
Security for the sensors, meters, cameras and controllers that run grids, buildings and cities, from device identity to network segmentation.
Ransomware resilience and clean-room recovery
Immutable backups that cannot be altered or deleted, and an isolated clean room where systems are rebuilt and checked before they return to service.
Incident response retainers
Engineers ready to respond under agreed terms, with your systems, contacts and plans known before the incident, not learnt during it.
Your own SOC, built and handed over
A SOC set up for you, run with your staff, then handed over with its playbooks, tools and full operational ownership.
How the work runs
Onboard
We connect your logs and network data, learn what normal looks like and agree who is called for what.
Write the playbooks
We agree how each kind of incident is handled, which actions run automatically and which need your approval.
Watch and hunt
We monitor around the clock, hunt for threats and tune detection as your systems change.
Respond
We contain incidents with your team, keep the evidence, restore service and find the cause.
Rehearse and improve
We rehearse recovery and response with your team, and report on incidents, trends and risks.
Standards and tools
- Standards and regulations
- NIS2
- EU DORA
- Saudi NCA ECC
- SAMA
How to start
Our managed services work to published response and resolution times for each severity, written into your agreement. For organisations that want their own SOC, we build it, run it with their staff and hand it over in full.
What happens next
Pre-consulting session
A free 30-minute online pre-consulting session: we go through your goals, systems and constraints.
Readiness review
In a free 48-hour readiness review, a Principal Architect checks your project against the 6-point Definition of Ready and recommends the track that fits.
Choosing the track
Scope-ready projects receive a binding proposal within 3–5 business days. Concept-stage projects start in the Blueprint Studio. A live system that is failing, undocumented or needs integration starts with a diagnostic of 1–2 weeks. The Blueprint Studio and the diagnostic each have a fixed fee, quoted in the proposal.
Delivery in five stages
Mobilisation, sprints with live demonstrations, integration and hardening, acceptance and go-live, then managed services. After launch comes a warranty period, then optional support and maintenance.
Fixed-outcome projects and round-the-clock managed services
Fixed-scope, milestone-driven delivery with named delivery leads, and round-the-clock application managed services under SLA governance.
Hybrid delivery and build-operate-transfer hubs
On-shore technical leadership with vetted nearshore and offshore capacity, complete build-operate-transfer capability centres and workforce localisation.
The quickest way in is the Post-quantum (CBOM) and agent security audit package, one of our rapid engagement packages.
Questions and answers
Why combine the SOC and the NOC?
Because many incidents are both. A slow system can be an attack, and an attack often shows first as a performance problem. One team with one view of security and network events finds the cause sooner and avoids two teams working against each other.
Can you monitor our OT networks without disrupting operations?
Yes. Monitoring is designed with your control engineers to observe control traffic rather than change it, and any change on plant systems follows your change and safety procedures. Safety and uptime come first.
How quickly do you respond to an incident?
Response and resolution times are set for each severity, from a critical outage or breach down to a minor request, and are written into your agreement. Our service levels page lists them.
What is clean-room recovery?
Restoring systems into an isolated environment first, checking that the restored systems and data are free of the attacker, and only then returning them to service. It stops a recovery from reinfecting the network.
Should we outsource the SOC or build our own?
Both can work. Outsourcing gives you cover around the clock from the first day; building your own keeps the skills in-house, which some regulators and national programmes require. We can do either, or run the SOC first and transfer it to your team later under a build-operate-transfer model.
Ready to build? Ask for a proposal.
Send your requirements or RFP. Our architects validate them and return a binding, fixed-scope proposal.
What happens next
Readiness review
In a free 48-hour readiness review, a Principal Architect checks your project against the 6-point Definition of Ready and recommends the track that fits.
Binding proposal
After architecture validation at no cost, you receive a binding, fixed-scope proposal within 3–5 business days: milestones, architecture, team structure and SLAs. We sign a non-disclosure agreement (NDA) with you on request, before you share your requirements.
Mobilisation
Once you sign, our engineering pods begin Sprint 0 within 5–10 business days of contract signature.
Delivery in five stages
Mobilisation, sprints with live demonstrations, integration and hardening, acceptance and go-live, then managed services. After launch comes a warranty period, then optional support and maintenance.