Managed detection & response
Analysts triage every alert from endpoint, cloud, identity and email, around the clock.
SOC ONLINE — 3 REGIONS · 214 ANALYSTS
Your 24/7 security team. Already on shift.
Cipheron watches your endpoints, cloud and identities every second of every day, and contains attacks before they become headlines.
4 minMean time to detect
27 minMean time to contain
1.2BEvents analysed / day
02:14:07BLOCK203.0.113.42SQLi probe on /api/v2/logindropped
02:14:08BLOCK198.51.100.7Credential stuffing, 312 req/minrate-limited
02:14:09ALERT192.0.2.199Beacon to known C2 from FIN-LT-044isolated
02:14:11BLOCK203.0.113.9JNDI lookup payload in User-Agentdropped
02:14:12INFOvault-prodHoneytoken integrity checkok
02:14:14BLOCK198.51.100.88RDP brute force, 1,204 attemptsgeo-fenced
02:14:15ALERT192.0.2.31Impossible travel: j.hale@ Oslo → LimaMFA reset
02:14:17BLOCK203.0.113.150Malicious macro in invoice_0921.docmquarantined
cipheron@soc:~$ tail -f /var/log/threats
Defending 640+ banks, hospitals, factories and fleets
Northwall BankKestrel HealthArcline LogisticsVantor EnergyHalden RetailOriel CloudPinegate InsuranceMeridia Labs
01 — Coverage
One team across detection, response and recovery.
Incident response
A named commander contains the threat within your SLA and leads recovery end to end.
Proactive threat hunting
Hypothesis-driven hunts across your telemetry for attackers who never tripped an alert.
Exposure management
Continuous attack-surface scans with prioritised, ticketed fixes your team can ship.
- Blocked in last 60 s1,284
- Sensors online12,480
- Hostile sources / hr3,912
- Campaigns tracked147
- Mean time to detect4m 12s
02 — Visibility
Every sensor. Every second.
One analyst console correlates 1.2 billion events a day into a handful of incidents that actually need a human.
- Endpoint, cloud, SaaS, identity and email in one timeline
- Detections mapped to MITRE ATT&CK techniques
- Threat intel from 40+ curated feeds, refreshed hourly
03 — Posture
How exposed are you right now?
Enter your domain for an instant outside-in check of mail security, TLS, exposed services and leaked credentials.
- No login, no agent, no data stored
- The full report covers 60+ external checks
- Free follow-up call with an analyst
Posture score86grade B+
- TLS 1.3 + HSTS enforcedPASS
- SPF / DKIM / DMARCPASS
- Exposed admin panelsWARN
- High-risk open portsPASS
- Leaked credentials (90 days)FAIL
- DNSSEC signedPASS
// Demo only. Scores are simulated in the browser; nothing leaves this page.
04 — Response
Contractual response times. Not best effort.
Every plan includes written service levels, measured from the first alert and reported monthly.
| Severity | Example | Acknowledge | Contain | Updates | On-site |
|---|---|---|---|---|---|
| P1 Critical | Active breach, ransomware, data exfiltration | 5 min | 30 min | Every 30 min | 4 h |
| P2 High | Confirmed compromise of a host or account | 15 min | 2 h | Every 2 h | 24 h |
| P3 Medium | Suspicious activity or policy violation | 1 h | 8 h | Daily | On request |
| P4 Low | Hardening advice, informational findings | 4 h | 3 days | Weekly | — |
- T+00:00
Detect
Correlated alert fires across endpoint, identity and network.
- T+00:04
Triage
Analyst confirms scope; incident commander paged.
- T+00:15
Contain
Host isolated, sessions revoked, IOCs blocked fleet-wide.
- T+01:00
Eradicate
Persistence removed; affected accounts rotated.
- T+24:00
Report
Root cause, timeline and hardening plan delivered.
05 — Proof
Security leaders sleep better.
They isolated a ransomware beacon on a finance laptop at 03:12 and had the root cause in our inbox before breakfast.
Elena VargaCISO, Northwall Bank
We replaced a SIEM, an MDR contract and two dashboards with one Cipheron pod. Alert noise dropped by 92%.
Tomas ReinerHead of IT, Arcline Logistics
Their pentest found an auth bypass three other vendors missed, then retested the fix within 48 hours at no cost.
Aisha ColemanVP Engineering, Kestrel Health
06 — Pricing
Priced per endpoint. No surprises.
Monitoring, response and reporting included. Cancel with 30 days’ notice.
Essentials
24/7 eyes on every endpoint.
$9 / endpoint / mo
- 24/7 monitoring & triage
- EDR sensor included
- Monthly posture report
- P1 acknowledge in 15 min
Most deployed
Managed XDR
Endpoint, cloud and identity, one pod.
$19 / endpoint / mo
- Everything in Essentials
- Cloud + identity telemetry
- Active response & isolation
- Weekly threat hunting
- P1 acknowledge in 5 min
Enterprise SOC
A dedicated analyst pod.
$34 / endpoint / mo
- Everything in Managed XDR
- Named analysts & custom detections
- 40 h incident-response retainer
- On-site within 4 hours
- Quarterly purple-team exercise
cipheron@soc:~$ ./engage --now
Put a SOC on shift tonight.
Onboarding takes 5 to 10 business days. Talk to an engineer, not a salesperson.