Skip to content

Managed Security & SOC

Your Microsoft environment monitored, with a monthly report for auditors.

Alerts are handled, incidents contained within agreed response times, and every month you receive evidence per control. We operate Defender XDR, Microsoft Sentinel, Entra ID and Intune in your own tenant.

Book an introductory call How it works

Example of a monthly evidence report: MFA for all accounts, privileged roles and device compliance are evidenced, incidents are documented, monitoring is active.

For
Companies with 50 or more employees on Microsoft 365
Scope
Defender XDR, Entra ID, Intune, optionally Microsoft Sentinel
Start
Onboarding in 4 to 8 weeks
Result
Monthly evidence per control; tenant and data stay with you
Price
from €3,500 excl. VAT per month, licences and Azure consumption billed separately

Sound familiar?

Small IT team, no time for alerts

50 employees or more, but nobody reviews the security alerts.

Auditors and insurers want proof

NIS2, ISO 27001 or your insurer ask for documented proof.

“All fine”, says your provider

They cannot document it, and nobody knows what happens at night.

Two tiers

How does a signal become evidence?

Secure Base operates the protection in your licences. Detection & Response adds Sentinel and round-the-clock monitoring. Switch tiers to see what is added.

Choose a tier

  1. 1 Sources

    Entra ID, devices, email

    + Azure and other sources

  2. 2 Detection

    Defender XDR

    + Sentinel with analytics rules

  3. 3 Triage by WCS

    Defined response times

    + around the clock

  4. 4 Response in your tenant

    Disable account, isolate device

    + Playbooks, automated

  5. 5 Evidence

    Monthly report per control

Signal chain in five steps. Secure Base: sources Entra ID, devices and email, detection with Defender XDR, triage by WCS with defined response times, response in your tenant by disabling accounts and isolating devices, monthly report per control. Detection & Response adds Azure and other sources, Sentinel with analytics rules, round-the-clock triage and automated playbooks.

An example from operations

What happens during an incident at 02:14?

A typical case in the Detection & Response tier, step by step. The time is an example; the response time is the one in your contract.

Step 1 / 5

What is included?

Identity and access

Entra ID, Conditional Access, MFA, privileged roles.

Email protection

Defender for Office 365 and authentication of your domains.

Endpoint

Intune and Defender for Endpoint, compliant devices only.

Sentinel and playbooks

Central logs, analytics rules, automated response.

Incident response

Triage, containment, communication, documentation.

Evidence per control

Monthly report showing where each control is configured in the tenant.

How does operation start?

  1. Fixed price

    Gap Assessment

    Review the tenant against baselines, choose the tier.

  2. 4 to 8 weeks

    Onboarding

    Access rights, escalation paths, runbooks. With Sentinel, typically 3 to 6 months to steady operation.

  3. Continuous

    Ongoing operation

    Monitoring, response, rule maintenance.

  4. Every 3 months

    Quarterly review

    Review status, deviations and scope together.

Where does your tenant stand today?

The fixed-price Gap Assessment clarifies licences, gaps and the right tier.

Request the fixed-price Gap Assessment

What changes?

Today

  • Alerts go unhandled
  • MFA coverage and admin rights unclear
  • No evidence for auditors
  • Incidents without a procedure

With managed security

  • Triage by WCS following a defined procedure
  • MFA and roles reported monthly
  • A report an auditor can read
  • Runbooks and handover without lock-in

Frequently asked questions

What is the difference between managed security and a SOC?

A SOC (security operations centre) monitors alerts and responds to incidents. Managed security also operates the protection itself; with us, the SOC is the Detection & Response tier.

Do I need Microsoft Sentinel or is Defender XDR enough?

Defender XDR keeps data available for hunting for 30 days by default. You need Sentinel for longer retention, further sources such as Azure, or your own rules and playbooks.

How much does managed security for Microsoft 365 cost for a mid-sized company?

Operations cost from €3,500 excl. VAT per month, depending on users, devices, tier and data volume. Licences and Azure consumption come on top. After the Gap Assessment you receive a proposal with a clearly defined scope.

What happens if a security incident occurs at night or at the weekend?

In the Detection & Response tier, monitoring runs around the clock, including public holidays. Triage and containment follow contractually defined response times.

Secure Base or Detection & Response?

In 30 minutes we clarify which tier fits.

Book an introductory call