fSecurity AI+
ENES

SOC as a Service

Managed cybersecurity for SMBs.

Your company does not need to build a security team to be protected. We install a lightweight agent on every computer and server, connect your cloud services, and our analysts watch, investigate and contain threats with AI-assisted triage. The same team that attacks companies for a living tells you whether you would detect it.

How it works

Collect, detect, respond. Then prove it.

  1. 1

    Collect

    A lightweight agent on every computer and server, plus your cloud services. Nothing to buy or rack.

  2. 2

    Detect

    Rules mapped to MITRE ATT&CK and Sigma, plus behavioural baselines for every device and user. Alerts in seconds.

  3. 3

    Triage with AI

    AI groups, enriches and prioritizes every alert. An analyst decides what is real.

  4. 4

    Respond

    Block a malicious IP or domain on the device, isolate a compromised computer, disable a session. Reversible and logged.

  5. 5

    Prove

    Our offensive team runs the techniques the SOC says it detects. You get proof, not a promise.

  6. 6

    Report

    A one-page monthly report for management, the technical annex for IT, and evidence for your auditor.

What we watch

  • Windows, macOS and Linux computers and servers
  • Microsoft 365 and Google Workspace
  • Sign-ins, identities and privileged accounts
  • Cloud logs and SaaS activity
  • Software inventory and known vulnerabilities
  • File integrity on critical systems

What we detect

  • Ransomware and malware behaviour
  • Compromised accounts and impossible travel
  • Intrusions that start with phishing
  • Lateral movement inside the network
  • Data exfiltration
  • New admin accounts and suspicious persistence

Why it is different

The team that attacks is the team that watches.

Most SOCs tell you they would detect an attack. We run the attack. Every finding from our pentests becomes a detection rule, and every rule is tested by our offensive team. If a technique gets through, we fix the detection and show you the before and after.

pentest>  reused credentials on the VPN
          -> access to the internal network
rule>     VPN sign-in from a new ASN
          + service account outside hours
test>     technique re-run by the offensive
          team: ALERT in 11 s, contained
status>   detected and proven

Packages

Sized to your company.

The technology is the same in every package. What changes is how many hours a human is watching, how fast we respond and how deep the compliance goes. Quotes after a 30-minute call.

Small1–50 employeesMid-size50–250 employeesEnterprise250+ or regulated
ForCompanies with no security team, often no in-house ITCompanies with IT but no security specialists, or that need audit evidenceRegulated entities and critical infrastructure
Devices and cloud servicesUp to 25 devices, 2 cloud servicesUp to 100 devices, 5 cloud services250+ devices, cloud sources as needed
Human monitoringMon–Fri 8:00–18:00, on-call for critical incidentsMon–Sat 7:00–22:00, on-call 24/724/7/365, analyst on shift
Automatic containment24/7 for known threats24/7, plus manual containment by the analyst24/7, with playbooks agreed with you
Response time, critical1 hour30 minutes15 minutes
Log retention90 days180 days180 days, extended archive on request
Threat huntingMonthly inventory and vulnerability reviewQuarterlyMonthly
Detection validation by our offensive teamOnce a yearTwice a yearEvery quarter, purple team
Incident response includedTriage and containment8 hours a year40 hours a year, forensic report for major incidents
Compliance and reportingMonthly executive reportISO 27001 / SOC 2 / NIST CSF evidence, quarterly reviewRegulator mapping (SUGEF, PCI DSS), board presentation
ChannelEmail and on-call WhatsAppDedicated Teams or Slack channelLead analyst assigned
Talk to us about the SOC

Protected in four weeks

The SLA starts in week 4, not at signature, because a SOC that has not learned your normal only produces noise.

  1. Week 0

    Contract, data-processing agreement, escalation contacts and containment authorization

  2. Week 1

    Agents deployed and cloud services connected

  3. Weeks 1–2

    Baseline: the platform learns what normal looks like for every device and user

  4. Weeks 2–3

    Tuning to remove noise and agree what is contained automatically

  5. Week 4

    SLA starts and you receive your first security posture report

What it does not include

  • Deep remediation such as patching or network redesign (we recommend it, or deliver it as Consulting)
  • Managing your perimeter firewalls or network equipment
  • Data recovery or ransom negotiation
  • Devices without the agent: we cannot watch what we cannot see

Your data

Monitoring data is handled under a data-processing agreement and the data-protection law that applies to you, with our technology providers listed as sub-processors in the contract. AI analysis runs with zero data retention.

Talk to us about the SOC