Security Monitoring & Incident Response Readiness
Know What's Watching. Know What to Do.
Good security means spotting problems early and knowing what to do when something goes wrong. Pulsar IT combines automated security monitoring in our managed services with practical incident response planning, so your business is better prepared.
What is Security Monitoring & Incident Response Readiness?
This page covers two connected things. The first is security monitoring: how suspicious activity is spotted and handled within our existing managed services. The second is incident response readiness: making sure your business has a clear, practical plan for what happens if an attack or data breach does occur.
Monitoring is built into our Managed Firewalls and Managed Endpoint Security services. A SIEM (security information and event management) platform collects and analyses security logs automatically, our team reviews the alerts that need a decision in line with your agreed service level, and approved automated responses run only where your systems support them and you have authorised them. For 24/7 investigation by specialist SOC analysts, covered devices and subscribed services can be added to Pulsar IT Managed SOC.
Readiness is a separate, scoped piece of work. We help you decide who does what during an incident, who to call, how to preserve evidence and how to communicate with staff and customers. Then we walk your team through a realistic scenario, so the plan is tested before it's needed.
Key benefits
- A clear explanation of what is monitored and how alerts are reviewed
- A written incident response plan with roles, contacts and escalation steps
- Basic evidence-preservation steps your team can follow
- An agreed approach to communicating with staff, customers and suppliers
- A walkthrough that tests the plan with your own people
How does it work?
Monitoring and readiness work together. Monitoring raises the alarm; the plan tells everyone what to do next.
Review current arrangements
We look at what is monitored today, any existing plans or policies, the insurance requirements you're aware of, your key systems and suppliers, and who would need to be involved in an incident.
Write the plan
We draft a practical incident response plan with you, covering roles, decision-makers, contact and escalation lists, first steps for common incidents, evidence basics and communications.
Walk it through
We run a walkthrough, sometimes called a tabletop exercise: your key people talk through a realistic scenario step by step, and we note any gaps.
Update and hand over
We update the plan with what the walkthrough found and hand over the final version and contact list, with a recommendation to review it whenever people, suppliers or systems change.
- Your firewalls and devicesSecurity logs and events from managed firewalls and endpoints
- Automated SIEM analysisLogs collected and analysed continuously; suspicious activity flagged
- Alert review by our teamIn line with your agreed service level; 24/7 SOC investigation only with Pulsar IT Managed SOC
- Approved responseAutomated actions only where supported and authorised; next steps agreed with you
- Spot and reportAn alert, a suspicious email or a system behaving oddly
- ContainFollow the plan's first steps, such as disconnecting an affected device
- Escalate and notifyDecision-makers, IT, your insurer and, where required, regulators or the police
- Recover and learnRestore services, review what happened and update the plan
What the readiness work covers
- Incident roles: who leads, who makes decisions and who handles IT, communications and suppliers
- A contact and escalation list, including out-of-hours numbers for key people and suppliers, kept somewhere accessible if systems are down
- First steps for common incidents, such as ransomware, a compromised email account, a lost laptop or payment fraud
- Evidence preservation basics: what to avoid deleting, wiping or rebuilding before advice is taken, and how to record what happened and when
- A communications approach for staff, customers and suppliers, including who may speak on the business's behalf
- Prompts to consider whether your cyber insurer, the Information Commissioner's Office (ICO) or the police need to be contacted
- Links to your backup and recovery arrangements, so recovery decisions are realistic
- A walkthrough exercise and an updated plan reflecting what was learned
Scenarios we can walk through
Ransomware on a shared drive
Files suddenly won't open and a ransom note appears. Who disconnects what, who calls the insurer, and how do you decide what to restore first?
A compromised mailbox
A customer asks about an odd payment request sent from your email account. How do you secure the account, find out what was sent and warn the people affected?
An alert late on a Friday
Monitoring flags unusual sign-ins outside office hours. Who is contacted, which actions have already been authorised and what can wait until Monday?
A redirected payment
A supplier's bank details were changed by email and a payment has gone. Who contacts the bank, who reports it and what checks change afterwards?
Who Else May Need to Know
During a serious incident you may have obligations, or good reasons, to contact people outside the business. Your plan should identify them in advance, so nobody is searching for contact details under pressure.
Your cyber insurer
Many cyber insurance policies expect prompt notification and may ask you to use the insurer's nominated response providers. Check your policy and record the claims contact in your plan.
The Information Commissioner's Office
If personal data is affected, you may need to report a personal data breach to the ICO, and time limits can apply. Your data protection lead should be involved in that decision early.
Law enforcement
Cyber crime and fraud can be reported to the police through Action Fraud, the national reporting service in England, Wales and Northern Ireland, or to Police Scotland in Scotland.
Customers, suppliers and your bank
Depending on what happened, you may need to warn customers, contact affected suppliers or ask your bank to try to stop or recover a payment.
This is general information, not legal advice. Your obligations depend on your circumstances, contracts and insurance, so take legal or professional advice where needed.
Problems solved
Unsure what is actually monitored
Many businesses assume someone is watching everything, all the time. We explain plainly what is monitored, how alerts are reviewed and what runs automatically.
No plan, or one nobody has read
A document written years ago rarely reflects current people, suppliers or systems. A plan your team has walked through is far more useful.
Key contacts missing in a crisis
Insurer claims lines, supplier support numbers and directors' mobiles are hard to find when systems are down. The plan keeps them together and accessible.
Evidence lost in the rush to fix
Wiping and rebuilding straight away can destroy information needed to understand what happened or support an insurance claim.
Mixed messages to staff and customers
Without an agreed approach, people may say too much, too little or the wrong thing at a sensitive time.
What's included
Included as standard
- Review of your current monitoring, plans and arrangements
- A written incident response plan tailored to your business
- A contact and escalation list
- Evidence preservation and communications guidance within the plan
- A walkthrough of the plan with your team
- Updates to the plan following the walkthrough
Optional or scoped
Available on request and confirmed in your proposal; not part of the standard service.
- Ongoing security monitoring through Managed Firewalls and Managed Endpoint Security
- Additional walkthroughs with different scenarios or teams
- A periodic review of the plan as your business changes
- A Backup Security & Recovery Assessment to check your recovery assumptions
What's not included
- 24/7 SOC analyst monitoring, which is a separate Pulsar IT Managed SOC subscription; standard monitoring is automated, with alerts reviewed by our team in line with your agreed service level
- Legal, regulatory or public relations advice
- Forensic investigation and incident response beyond the agreed scope, which may be arranged separately or through your insurer
- Monitoring of systems not covered by a Pulsar IT managed service
- Commitments to specific response or recovery times beyond your agreed service levels
The monitoring described here is automated. Alerts are reviewed by our team in line with your agreed service level, and automated responses run only where supported by your systems and authorised by you. 24/7 SOC analyst coverage applies only to endpoints and services onboarded to Pulsar IT Managed SOC, which is included in Advanced IT & Security.
A plan reduces confusion and delay, but it can't prevent every incident or decide its outcome. Decisions about notifying regulators, insurers or the police remain with your business, and we don't provide legal advice.
Who it's suitable for
- Businesses without a written incident response plan
- Organisations whose insurer or clients ask about incident procedures
- Businesses that hold personal or sensitive customer data
- Teams that rely on one or two people who 'just know what to do'
- Managed firewall or endpoint security customers who want to know what happens after an alert
Pricing
Security monitoring is part of our managed firewall and managed endpoint security services. The incident response readiness work on this page is priced based on scope.
Use the quote builder to add Security Monitoring & Incident Response Readiness to an indicative quote, or book a free security review and we'll recommend what fits.
Price
Price Based on Scope
Price to be confirmed following a review of your requirements.
What affects the price
- Size and structure of your organisation
- Whether you have an existing plan
- Number of sites and key systems
- Number of people taking part in the walkthrough
- Third parties to include, such as your insurer or key suppliers
- Format and number of exercises
All prices exclude VAT.
Add to Your QuoteFrequently asked questions
What does 'in line with our agreed service level' mean out of hours?
Logs are collected and analysed automatically all the time, but unless a system is covered by Pulsar IT Managed SOC, alerts are not investigated by analysts around the clock. Alerts that need a decision are reviewed by our team within the hours and timescales set out in your agreed service level, and automated responses you have authorised, such as blocking known malicious traffic, can run in the meantime where your systems support them. Your incident plan should reflect this, including who in your business is contacted out of hours.
Which systems does the monitoring cover?
It covers the systems in your Pulsar IT managed security services: firewall logs through Managed Firewalls, where monitoring is included at £95 per firewall per month excluding VAT, and endpoint security events through Managed Endpoint Security. Systems outside those services aren't monitored by us, and the plan should take that into account.
What is a tabletop exercise?
It's a discussion-based rehearsal. Your key people meet, in person or on a video call, while we talk through a realistic scenario step by step. Nothing is actually attacked or switched off; the point is to find gaps in the plan safely.
Will you tell us whether to report a breach to the ICO?
We'll help you gather the facts and make sure the question is asked early, and the plan will include where to find the ICO's guidance. The decision, and any legal advice, rests with your business and your advisers.
We already have a business continuity plan. Do we need this?
Possibly not as a separate document. Continuity plans often cover fire, flood or power loss but not cyber incidents in detail. We can add a cyber incident section to what you already have rather than start from scratch.
Let's Secure Your Business
Find out how Pulsar IT can help protect, manage and improve your IT environment.