Most breaches aren't missed. They're seen late, and answered slowly.

No. We operate your existing SIEM, EDR, identity and network security stack where it is fit for purpose. Where we recommend a change it is because it removes duplicated licence cost or closes a coverage gap we can evidence from the assessment — and the business case comes with the recommendation.

The SOC watches for threats; the NOC watches for availability and performance. Running them separately creates the ambiguity at the start of an incident, when an outage and an intrusion look identical. We run both from one operation against one asset view, so events are correlated before they are dispatched — and one queue carries both.

Only to the extent you authorise in writing before go-live. Most clients grant standing authority for host isolation, identity disablement and indicator blocking, and reserve decisions with business impact — taking a production system offline, for example — for a named approver. That boundary is agreed in the runbook rather than improvised during an incident.

Log and telemetry data stays in the region and tenancy you specify — typically your own SIEM instance. Analyst access is role-based, logged and reviewed, and restricted to the named team on your account. Residency, retention and access requirements are documented in the service description.

Our incident response team leads containment, forensics and recovery under the agreed runbook, with defined notification timelines to support your regulatory obligations. Post-incident you receive a root cause report, a control gap list and a remediation plan. Liability and notification terms are set out in the contract rather than left to good intentions.

Yes — that’s the co-managed model. Your team keeps daytime ownership and we cover out-of-hours and holidays with the same triage and escalation standards, handing live incidents over with full context at shift boundaries.

Controls and evidence are mapped to ISO/IEC 27001, NIST CSF 2.0, SOC 2, GDPR, PCI DSS 4.0, NIS2, DORA and HIPAA, so one control set services multiple obligations. Certification status of the underlying Teceze operation is confirmed in writing during due diligence.