What Happens When We Find Something

Before anything happens #

We agree the plan at the start, so nobody improvises later. Before go-live, we do four things:

• Name your business contact and your technical contact.
• Agree with you what counts as critical, high, or lower, and who gets called in what order.
• Run one test alert from start to finish, including the call and the guided action.
• Deliver a first baseline report, after a baseline period in which we tune the alert thresholds.

The test run matters most. A call list that has never been used is only a guess. After the test, you know what the call sounds like, and your IT person or managed service provider (MSP) knows what they will be asked to do.

When an alert comes in #

Your endpoint and email tools raise alerts all day. Not every one is real. During business hours, we check that our data sources are healthy, review new alerts in severity order, gather the minimum evidence, and rule out known harmless activity. Then we write a case record, so there is a written account from the first step.

If an alert is real, you get a phone call from a person you have met. The call covers three things, in plain English:

1. What happened.
2. What it touches.
3. What to do first.

We notify you according to the matrix you agreed at the start. Then we record what you decided and what was done.

Who decides and who acts #

We advise and document. Your IT person or MSP carries out containment, such as isolating a device or disabling an account, unless a written agreement authorizes something else. That agreement states who may isolate a device, disable an account, contact law enforcement, notify an insurer, or engage breach counsel. You settle that before an incident, not during one.

During the work, your IT person or MSP gets clear steps, one at a time, with someone from us on the line. They keep the keys. A notification or guidance from us is not the fix itself. We work alongside your IT person or MSP. We do not replace them.

How fast, and what happens outside business hours #

Our business hours are weekdays, 8 a.m. to 5 p.m. Eastern, except US federal holidays. Within those hours:

• Critical: an immediate analyst call, guidance, and a written escalation.
• High: acknowledged within four business hours, and the owner is advised.
• Medium or low: we investigate, tune, track trends, and report.

Evenings, weekends, and federal holidays all work the same way. We are not watching outside business hours. An automated critical alert goes straight to your named contacts, and you may call the incident-response partner. We follow up at 8 a.m. on the next weekday that is not a federal holiday. High alerts wait for the next business window, unless automation or the endpoint-protection partner’s own policy escalates them. Medium and low alerts wait for the next business window too. (Endpoint protection from a partner is optional. If you add it, the partner’s own team monitors it.)

A real 2 a.m. emergency goes to a pre-arranged incident-response partner, under separate terms. Their number and the plan are on your contact sheet before you ever need them. Put that sheet where more than one person can find it.

An illustration, and what gets written down #

This is an illustration. It is made up. It did not happen to anyone.

• 9:42 a.m. An alert shows a sign-in to an employee’s mailbox from another country. We start checking.
• 9:50 a.m. The sign-in does not look like harmless activity. We call the owner and explain what happened, what it touches, and what to do first.
• 10:05 a.m. The IT person, with an analyst on the line, removes a mail rule that was set up after the sign-in.
• 10:40 a.m. We confirm the activity has stopped and tell the owner it is all clear.

Notice who did what. We found it and made the call. The owner decided. The IT person acted.

The case record notes what was detected and when, the evidence behind it, the severity and the business reason for it, what we did, when you were told, what you decided, and how it closed.

Each month, those records feed one short evidence file with three parts. (For how to use it at insurance renewal, see What Goes in a Monthly Evidence File, and How to Use It at Insurance Renewal.) Coverage shows which sources were expected and healthy, and any gaps. Alerts and cases lists alerts by severity, cases opened, how fast each was acknowledged, what is still open, calls made, and how each was resolved. Decisions lists top risks, changes made, and next actions, each with an owner and a due date, plus evidence each was closed.

The file has an honest limit: it records real monitoring and real response. It isn’t a compliance certificate. Your broker, carrier, or customer decides whether it answers their questions.

What we do not do #

• We do not take over your IT person’s job.
• We do not promise prevention.
• We do not do digital forensics, give legal advice, or send regulatory notices. Breach counsel is not part of the service.
• We do not promise that an insurer will accept the evidence file.
• Each customer stays responsible for its own compliance program and its own relationship with its broker, carrier, or assessor.

If a provider cannot tell you where its own limits are, ask again before you sign.

Questions worth asking any provider, including us #

1. Who calls whom, and when? Is it a person you have met, and is the order written down?
2. What happens outside business hours? Who gets the alert, and who follows up the next morning?
3. Who is allowed to isolate a device or disable an account, and where is that written?
4. What is written down afterward, and what will it not claim?

At SOC-Lite, a named analyst reviews your alerts, calls you when one is real, works with your IT person or MSP on the fix, and keeps the evidence. A visibility check is free, it takes 20 minutes, and you talk to us by phone or at your office. Book a visibility check