Pulsar IT Managed SOC
Cybersecurity That Never Sleeps.
Protect your business with continuous threat monitoring, specialist security investigation and managed response capabilities through Pulsar IT.
24/7 Monitoring. Expert Investigation. Managed Protection.
What Is a Managed SOC?
Cyber threats don't stop when your business closes. Pulsar IT Managed SOC combines continuous security monitoring with specialist security analysts to help detect, investigate and respond to threats around the clock.
A security operations centre (SOC) is a team of security analysts, supported by monitoring technology, whose job is to spot suspicious activity on the systems they watch, work out whether it is a real threat and coordinate the right response. Most small and medium-sized businesses can't justify building their own SOC, so a managed SOC gives them access to that capability as a service.
Pulsar IT Managed SOC is a Pulsar IT managed service. Pulsar IT handles your onboarding, service management, escalation, reporting and the agreed response arrangements. The 24/7 analyst capability is provided by a specialist security operations partner supporting Pulsar IT, not by a security operations centre that Pulsar IT staffs itself. 24/7 analyst coverage applies only to endpoints and services that have been successfully onboarded. Endpoint coverage starts once each device has been onboarded; other services start once they are active and onboarding is complete.
Key benefits
- 24/7 analyst investigation of threats on covered devices
- Suspicious activity validated, so you hear about real threats rather than noise
- Supported containment, such as isolating an affected device, where you have authorised it
- Confirmed threats escalated to Pulsar IT with clear findings and next steps
- Security reporting alongside your everyday managed IT support
Why 24/7 Monitoring Matters
Attackers don't keep office hours. Malicious activity is often timed for evenings, weekends and bank holidays, when nobody is watching alerts and a compromised device or account can go unnoticed until Monday morning.
The longer an attacker goes unnoticed, the more time they have to move between systems, steal data or prepare ransomware. Investigating suspicious activity on covered systems as it happens, rather than the next working day, gives your business the best chance of containing a problem while it is still small.
Out-of-hours activity
A phishing link clicked late in the evening or a remote access tool installed overnight can be investigated straight away on covered devices.
Validated alerts, not noise
Analysts separate real threats from harmless alerts, so your team isn't asked to act on every warning a security product raises.
A clear next step
When a threat is confirmed, there is an agreed route to containment and escalation, rather than an alert sitting unread in an inbox.
What We Monitor
Different security services monitor different things, and they don't all carry the same level of coverage. We keep them separate, so you always know what is covered, by which service and to what level.
Endpoint detection and response
Onboarded workstations and laptops are covered by 24/7 SOC analyst investigation and supported containment. This is included in Advanced IT & Security and can be added to other plans; servers are covered where agreed in your proposal.
Microsoft 365 identity threats
Suspicious sign-ins and account activity, such as unusual locations or new mailbox rules, are monitored 24/7 only with the separate Microsoft 365 identity monitoring subscription. Microsoft 365 administration and security configuration are a different service.
Managed SIEM log sources
Security logs from approved sources, such as servers, Microsoft 365 audit logs, firewalls or cloud platforms, are collected and correlated. Analyst coverage depends on the source and is confirmed in your proposal.
Firewall and network logs
Firewalls under our Managed Firewalls service are monitored through automated SIEM analysis, with alerts reviewed by our team in line with your agreed service level.
Vulnerabilities
Missing updates and known weaknesses (CVEs) are found and fixed through our vulnerability scanning and CVE remediation services, which are separate from SOC threat monitoring.
Only systems that have been successfully onboarded receive 24/7 analyst coverage. Endpoint coverage starts once each device is onboarded; other services start once they are active and onboarding is complete. Your proposal lists exactly what is covered.
How Our SOC Works
Every alert on a covered system follows the same path, from the first sign of suspicious activity to a confirmed outcome and a record of what happened.
Detection
Security software on covered systems collects telemetry, such as running processes, persistence changes and suspicious behaviour, and the monitoring platform flags activity that looks malicious.
Investigation
Specialist SOC analysts review flagged activity on covered systems, around the clock, looking at what happened before and after the alert to understand it in context.
Threat validation
Analysts decide whether the activity is a genuine threat, a harmless false positive or something that needs more information, so real threats aren't lost in routine alerts.
Approved response
For confirmed threats, supported containment actions you have authorised in advance, such as isolating a device from the network, can be taken to limit the damage.
Escalation
Confirmed incidents are escalated to Pulsar IT with a summary of the findings, actions taken and recommended next steps. Pulsar IT contacts your nominated people in line with your agreed escalation plan.
Reporting
Pulsar IT records the incident, completes remediation that falls within your managed services and includes security activity in your regular service reporting.
- Endpoints, Microsoft 365 and firewallsEach source is covered only by the service subscribed for it
- Security monitoring and detectionTelemetry and logs analysed continuously for suspicious activity
- 24/7 SOC investigationFor covered SOC services only
- Approved containment and escalationSupported actions you have authorised; confirmed threats escalated to Pulsar IT
- Pulsar IT management and reportingRemediation within your managed services, follow-up and reporting
- Endpoints24/7 analyst investigation of onboarded devices (included in Advanced IT & Security)
- Microsoft 365 identities24/7 identity threat monitoring, only where separately scoped and subscribed
- Managed SIEM sourcesLogs collected and correlated; coverage confirmed per approved source
- FirewallsManaged Firewalls service: alerts reviewed in line with your agreed service level
- VulnerabilitiesScanning and CVE remediation through separate Pulsar IT services
What the endpoint SOC service covers
- Monitoring of covered Windows and macOS devices, and supported servers, through a lightweight security agent installed and managed by Pulsar IT
- Detection of suspicious behaviour and persistence, such as malicious processes, unexpected scheduled tasks and footholds used by attackers to stay on a device
- 24/7 investigation of alerts on covered devices by specialist SOC analysts
- Supported containment actions, such as isolating a device from the network while keeping it reachable for investigation, where you have authorised them
- Supported remediation steps, such as removing malicious files or persistence, or clear instructions passed to Pulsar IT where hands-on work is needed
- Works alongside the endpoint protection and antivirus already managed by Pulsar IT
- Incident summaries, escalation to Pulsar IT and inclusion in your service reporting
SOC-Backed Endpoint Security
Endpoints, meaning the workstations, laptops and servers your staff use every day, are where most attacks land. The Managed SOC endpoint service adds 24/7 specialist threat detection and response to the endpoint protection we already manage on your devices.
Covered devices benefit from continuous threat monitoring, specialist security investigation and supported response actions through Pulsar IT Managed SOC. SOC-backed endpoint monitoring is included in our Advanced IT & Security plan at £35 per device per month, with no additional SOC fee. With Co-Managed IT or Essential IT Support it can be added, priced on application.
Coverage for each device starts once it has been successfully onboarded. Pulsar IT confirms in writing which devices are covered and from when, and any device that cannot be onboarded, such as an unsupported operating system, is listed so you know it is not covered.
Managed SIEM
A SIEM (security information and event management) platform collects security logs from different systems, correlates them and looks for patterns that suggest an attack, such as repeated failed sign-ins followed by a successful one from an unusual place.
With Managed SIEM, we agree which log sources are collected, such as servers, Microsoft 365 audit logs, firewalls or cloud platforms, and how alerts from each source are handled. Not every log source carries the same level of analyst coverage, so we confirm the coverage, retention and alert handling for each source in your proposal. Additional log sources are priced on application.
Managed Firewall Security
Firewalls are covered by our separately priced Managed Firewalls service at £95 per firewall per month, excluding VAT. It includes firewall administration, updates, configuration management and log monitoring through our SIEM platform.
Firewall alerts are analysed automatically and reviewed by our team in line with your agreed service level, and approved automated responses run only where supported and authorised by you. Managed firewalls are not included in Pulsar IT Managed SOC or in any per-device plan.
Threat Investigation and Response
When suspicious activity is flagged on a covered system, SOC analysts investigate what happened, which device or account is affected and whether the activity is malicious. If it is a genuine threat, supported containment actions you have authorised in advance can be taken straight away, such as isolating a device from the network or, with identity monitoring, disabling a compromised account and ending its sessions.
Containment limits the damage but doesn't always finish the job. Where hands-on work is needed, such as rebuilding a device or resetting credentials, Pulsar IT carries it out within the scope of your managed services, or agrees any additional work with you first.
Incident Escalation
Pulsar IT and our specialist SOC partner work to an escalation plan agreed with you during onboarding. Confirmed threats are passed to Pulsar IT with the analysts' findings, the actions already taken and recommended next steps.
Pulsar IT then contacts your nominated people in line with the plan and your agreed service levels, coordinates remediation and helps you decide on next steps, such as contacting your cyber insurer. For larger incidents, our Security Monitoring & Incident Response Readiness service helps your team prepare in advance.
Problems solved
Nobody watching out of hours
Security alerts raised overnight or at weekends often sit unread until someone is back at their desk. Covered devices are investigated around the clock.
Too many alerts to judge
Security products raise warnings that are hard for a non-specialist to assess. SOC analysts validate them, so you hear about the threats that matter.
No security team of your own
Hiring and retaining security analysts for 24/7 cover is beyond most SMEs. A managed SOC provides that capability as a service.
Unclear who does what in an incident
An agreed escalation plan sets out who is contacted, which actions are authorised and how Pulsar IT follows up.
Insurer or client questions about monitoring
You can explain clearly what is monitored, by which service and to what level, because each source's coverage is set out in writing.
Service Coverage & Exclusions
Included as standard
- 24/7 SOC analyst investigation of alerts on successfully onboarded devices (included in Advanced IT & Security)
- Threat validation and alert triage for covered devices
- Supported containment actions you have authorised, such as device isolation
- Escalation of confirmed threats to Pulsar IT, with findings and recommended next steps
- Onboarding, agent deployment and service management by Pulsar IT
- Security activity included in your Pulsar IT service reporting
Optional or scoped
Available on request and confirmed in your proposal; not part of the standard service.
- 24/7 Microsoft 365 identity threat monitoring, a separately scoped option priced per user on application
- Additional Managed SIEM log sources, separately scoped and priced on application
- SOC-backed endpoint monitoring for Co-Managed IT and Essential IT Support plans, priced on application
- Managed Firewalls, priced per firewall
- Managed Endpoint Security & CVE Remediation for wider vulnerability management
- Incident response readiness planning and walkthroughs
What's not included
- Monitoring of systems, accounts or log sources that are not onboarded to an active Managed SOC service, including any period before onboarding is complete
- Microsoft 365 identity threat monitoring, unless added to your plan
- Managed firewalls, which are a separately priced service
- Full incident recovery, forensic investigation or legal advice beyond the agreed scope, which may be arranged separately or through your insurer
- Guaranteed response or resolution times beyond those in your agreed service levels
24/7 analyst coverage applies only to endpoints and services that have been successfully onboarded to an active Managed SOC service, and starts once onboarding is complete. Response actions run only where supported by the relevant products and authorised by you.
A managed SOC significantly improves your ability to detect and contain attacks, but no service can prevent every incident. Good backups, updates and staff awareness remain essential.
Who it's suitable for
- SMEs without their own security team or out-of-hours IT cover
- Businesses that hold sensitive customer, financial or personal data
- Organisations whose insurer or clients ask about security monitoring
- Pulsar IT managed IT customers who want stronger threat detection
- Businesses in Manchester and Greater Manchester, and across the UK, with remote or hybrid staff
Pricing
SOC-backed endpoint monitoring is included in Advanced IT & Security at £35 per device per month, with no additional SOC fee. With Co-Managed IT or Essential IT Support it is available as an add-on, priced on application. Microsoft 365 identity threat monitoring and additional SIEM log sources are separately scoped options for any plan.
Use the quote builder to add Pulsar IT Managed SOC to an indicative quote, or book a free security review and we'll recommend what fits.
Price
On Application
With Co-Managed IT or Essential IT Support, endpoint coverage is priced on application, based on the number of covered devices.
Included in the Advanced IT & Security plan (£35 per device per month).
What affects the price
- Your Pulsar IT plan (endpoint coverage is included in Advanced IT & Security)
- Number of covered workstations and laptops, and whether servers are included in scope
- Whether you add 24/7 Microsoft 365 identity threat monitoring, and for how many users
- Which additional log sources, if any, you want collected through Managed SIEM
- Agreed escalation contacts and response authorisations
All prices exclude VAT.
Add to Your QuoteFrequently asked questions
What is a Managed SOC?
A managed security operations centre (SOC) is a service in which specialist security analysts, supported by monitoring technology, watch your covered systems for suspicious activity, investigate it and coordinate a response. Pulsar IT Managed SOC is delivered by Pulsar IT with a specialist SOC partner providing the 24/7 analyst capability.
Does a small business need a SOC?
Many small businesses hold valuable data, make payments online and rely on email and Microsoft 365, which makes them a target. Most can't justify their own security team, so a managed SOC is a practical way to get 24/7 specialist investigation of covered systems. We'll help you decide whether it's right for you during a free security review.
What's the difference between SOC and SIEM?
A SIEM is technology: it collects and correlates security logs from different systems and raises alerts. A SOC is people and process: analysts who investigate alerts, decide whether they are real and coordinate a response. A SIEM can feed a SOC, but the two aren't the same, and not every SIEM log source has the same level of analyst coverage.
Is security monitored 24/7?
Endpoints that have been successfully onboarded to Pulsar IT Managed SOC, which is included in Advanced IT & Security, are investigated by SOC analysts 24 hours a day, 7 days a week, and so are Microsoft 365 identities where you add the separately scoped identity monitoring option. Endpoint monitoring starts once each device has been onboarded; identity monitoring starts once that service is active and onboarding is complete. Other monitoring, such as firewall alerting through Managed Firewalls, is automated, with alerts reviewed by our team in line with your agreed service level. Your proposal sets out exactly which systems are covered.
What happens if a threat is detected?
Analysts investigate and validate it. If it is a genuine threat, supported containment actions you have authorised, such as isolating the affected device, can be taken straight away. The incident is then escalated to Pulsar IT, who contacts your nominated people in line with your escalation plan and coordinates the follow-up.
Does the service include Microsoft 365?
No. 24/7 Microsoft 365 identity threat monitoring is a separately scoped Managed SOC option, priced per user on application, and is not included in any plan, including Advanced IT & Security. It is different from the Microsoft 365 Management & Security Baseline included with our plans at £125 per organisation per month, which covers administration and security configuration rather than 24/7 analyst investigation.
Is firewall monitoring included?
No. Firewalls are covered by our separately priced Managed Firewalls service at £95 per firewall per month, excluding VAT, which includes SIEM log monitoring with alerts reviewed by our team in line with your agreed service level.
Is incident recovery included?
Containment of confirmed threats on covered systems and remediation within the scope of your managed services are included. Larger recovery work, forensic investigation and legal or regulatory advice are not, and may be arranged separately or through your cyber insurer. We always agree additional work with you before it starts.
How does SOC monitoring work with managed IT support?
On Advanced IT & Security, SOC-backed endpoint monitoring is part of your managed IT plan. Pulsar IT installs and manages the security agent on your devices, agrees your escalation plan and receives escalations from the SOC. Because we also manage your IT, we can act on the findings, for example by rebuilding a device or resetting an account, and include security activity in your regular service reporting.
Strengthen Your Business Security
Find out how Pulsar IT Managed SOC could protect your business, with a free security review or an indicative quote.