Managed Security Operations
An identity-led managed SOC, built around your maturity
Most attacks on midsize and regulated organisations start with a compromised account. Our CREST-accredited SOC brings identity context into every triage and every containment decision, across three service levels that grow with you.
ALERTS TRIAGED WITHIN 15 MINUTES · INCIDENTS CONTAINED WITHIN 60
CREST-accredited SOC · ISO 27001 · ISO 9001 · Staffed 24/7 from the UK, South Africa and India
What we hear most often
Solving common security operations challenges
A stolen login looks like a normal working day
Most of the incidents we handle start with an identity: a phished password, a stolen session token, an MFA prompt approved at 2am, a mailbox rule nobody remembers setting up. To most monitoring tools, that looks like someone doing their job.
You don’t know what’s happening out of hours
You’re only as secure as your quietest hours. Nights, weekends and bank holidays are when your team isn’t watching and attackers are. An on-call rota means someone gets woken up once an alert has already escalated.
When something goes wrong, you’re firefighting in real time
An incident isn’t routine work. Without deep experience every decision takes longer, every action carries risk, and the clock is against you.
Your tools aren’t working as well as you think
You’ve invested in security tools, but they’re not fully integrated, configured or optimised. Gaps between systems mean threats slip through and weaknesses stay hidden until someone exploits them.
You can’t prove you’re secure
You’ve implemented controls but you can’t assess how well they are working. That makes it harder to prioritise risk, justify spend, or reassure leadership when it matters.
You’re not seeing the full picture
Security data lives in different tools, owned by different teams, telling different stories. Without a unified view, real threats get lost in the noise or missed entirely.
From hardening to the board report
Harden, detect, respond, recover, govern.
Most managed security providers sell detection and alerting. Our service is defined across the full lifecycle, so the work starts before an incident, leaving less to detect, and carries on after it until recovery is confirmed and reported. Identity runs through every stage.
Harden
Vulnerabilities ranked by how exploitable they are and tracked to remediation, configuration drift flagged, and identity controls reviewed: conditional access, privileged roles, dormant accounts. Your team patches. We tell you what matters and check it’s done.
Detect
Endpoint, network, cloud and identity telemetry correlated in one place. Entra ID sign-in, audit and privileged-role activity are mandatory log sources.
Respond
Every alert triaged within 15 minutes, critical incidents contained within an hour. Identity containment covers password resets, session revocation, sign-in blocks and privileged-role removal.
Recover
We check restored systems are clear of known threats, watch for the attacker coming back, and bring real threat scenarios into your disaster recovery and continuity exercises.
Govern
A monthly service review that scores how the service is maturing, deepening at each tier to executive and board reporting on risk, resilience and continuity.
Solid: included at this tier. Outlined: limited coverage at this tier.
Underneath every stage is the security of the SOC itself, assessed independently every year under CREST Security Operations accreditation and ISO 27001.
Three countries, one SOC.
Our analysts are permanent Talanos employees in the UK, South Africa and India, working a follow-the-sun rota, so every shift is a day shift for someone. We don’t use subcontractors, and account and service management is UK-based.
Where you own the SIEM, your security data stays in your own UK tenant and our analysts work inside it through named, MFA-protected accounts.
Identity-led, in practice
Every genuine attack attempted to use a login.
Part of the service is separating the noise from the genuine incidents. All of the real attacks began with either a password, an account or a sign-in, which is why identity sits at the centre of how we detect and respond.
400+
events flagged
12
investigated in full
4
real attacks
0
caused harm
Over 200 attempts on one inbox
Attackers spent weeks trying to sign in as a senior executive, rotating through hundreds of addresses across multiple countries so that blocking one would never stop them. None got in. The pattern led us to the one older sign-in route still open on the account, the one MFA can’t protect, and we worked with the executive on a secure way to close it without losing the device they rely on.
A leaver’s account, left open
Attackers went for the account of a former employee that had never been closed. We picked up the activity and shut the account down before it caused any harm.
Two Tor sign-ins among tens of thousands
The client’s users sign in from dozens of countries, and almost all of it is legitimate partner traffic. Alerting on country would have buried the team in noise. We mapped the expected footprint from the directory and alerted on how people connect instead, which put the two accounts signing in through Tor at the top of the list.
Choose your level
Three tiers. One provider. Your level of control.
Reactive
Foundational SOC
“We just need to know when something serious happens.”
- 24/7 monitoring, every alert triaged within 15 minutes
- Severity-based notification with recommended actions
- Identity, endpoint, network and cloud alerts correlated
- Vulnerability context used to prioritise incidents
- Investigation of scope, cause and impact
- Incident runbooks and evidence preservation
- Monthly SLA and activity reporting
We triage and advise. Your team contains.
Proactive
Integrated SOC
“We need to contain incidents fast, not just be alerted to them.”
- Everything in Reactive, plus:
- Detection tuning and custom rules for your critical systems
- Pre-approved containment and coordinated response
- Formal investigation reports and post-incident reviews
- Risk-based vulnerability prioritisation and remediation tracking
- Security input into DR and continuity exercises
We contain within agreed actions. You own the strategy.
Adaptive
Intelligence-driven SOC
“The board needs resilience metrics, not tool stats.”
- Everything in Proactive, plus:
- Threat hunting, with threat intelligence driving detection
- Automated enrichment and response orchestration through Enigma
- Attack simulation and control validation
- Continuous exposure reduction across attack paths
- Board-level resilience and risk reporting
We contain and orchestrate within agreed guardrails. You keep governance.
We meet you where you are, not where a vendor wants to sell to you.
Why our clients choose us
Trusted by regulated and midsize organisations.
They know our environment inside out and deliver insights that mean something, backed by real data. Having that level of visibility, and knowing we are protected around the clock, has honestly made my life so much easier.
Chief Information Security Officer
Global financial services firm, London
I am so glad we engaged Talanos a year ago. The team are all fantastic and we have taken great comfort knowing you are there supporting us.
Head of IT
Prominent literary institution, London
We view this engagement as a strategic step toward building a scalable and sustainable security operations capability. It supports our growth trajectory while ensuring we continue to meet and exceed customer and compliance expectations.
Principal Manager, Information Security
Insurance and claims processing SaaS platform, India
Pricing
No published price, but no mystery either.
The cost of a managed SOC is determined by two things: the level of service you need, and the size and shape of the estate it has to cover. Users, devices, data volume and compliance scope all move the number, and data volume is the one most people underestimate.
We give you an indicative figure on the first call, before you have committed to anything.
If you want the full breakdown of how providers structure pricing, what it costs to build the same capability in-house, and what to check before you compare quotes, we have written it up in detail.
Shared visibility
You see what we see.
Enigma is the platform our engineers built to run the SOC. When an alert fires, it gathers the evidence: the user’s sign-in history, the device record, the asset’s patch state and threat intelligence on anything suspicious. Then it runs the same triage workflow every time, on every shift. That consistency is how every alert is triaged within 15 minutes whatever the hour.
Enigma is automation: workflows our engineers write, test and control. It gathers and enriches the evidence, and an analyst makes the decision.
You work from the same screens our analysts do, so the monthly report contains nothing you’re seeing for the first time. Response orchestration is available on the Adaptive tier.
MDR or Managed SOC?
A Managed SOC is MDR plus hardening, recovery and governance.
These two services overlap more than most providers admit, so here is the honest version.
Same service levels on both: every alert triaged within 15 minutes, critical incidents contained within the hour.
Managed Detection & Response
Find threats and stop them.
- 24/7 monitoring and alert triage
- Investigation and containment within agreed rules
- SIEM, endpoint, cloud and identity telemetry
- Monthly reporting and service review
- 15-minute triage, critical incidents contained within the hour
Managed SOC
That, and reduce how often it happens.
- Everything in MDR
- Deeper investigation: artefact analysis and forensics
- Threat intelligence, contextualised to your sector
- Identity controls reviewed and hardened as well as monitored
- Exposure management, control validation and recovery support
- 15-minute triage, critical incidents contained within the hour
Start with MDR if you need coverage and containment now. Move to a Managed SOC when the question changes from whether you’re being attacked to whether you’re getting better.
From our SOC
Threat intelligence from our analysts.
What we’re seeing across client estates, written up by the analysts who investigated it.
Why threat hunting should be about finding gaps, not ghosts
If something were amiss in your environment right now, would you know? Threat hunting doesn't need an intelligence team. Start with your own blind spots, one...
Read the analysis →
A ClickFix Chain That Hides Its C2 on the Blockchain
Our threat research team came across a fake identity-verification page in the wild and decided to follow it all the way down - by hand, without...
Read the analysis →
What the dark web knows about you
The dark web isn't just a cybersecurity thriller plot — it's a thriving marketplace where your organisation's credentials, network access, and customer data are actively traded....
Read the analysis →Questions we are asked
What buyers ask before they commit.
What is SOC as a service?
A security operations centre run for you by a third party, rather than built and staffed in-house. You get the monitoring, the analysts and the tooling as a service, and you choose how much of the response you keep control of.
Is your SOC accredited?
Yes. Talanos holds CREST Security Operations accreditation, which covers the security operations centre itself. We are also ISO 27001 and ISO 9001 certified, hold Cyber Essentials Plus, and are FSQS registered.
Why does a SOC need to focus on identity?
Because that’s where most attacks start and where they’re stopped fastest. A phished password or stolen session token lets an attacker walk in as a legitimate user, so we treat Entra ID sign-in, audit and privileged-role activity as core sources and bring identity context into every triage. On Proactive and Adaptive we contain at the identity too: resetting passwords, revoking sessions and removing privileged roles within the hour.
Who is watching our environment overnight?
A Talanos analyst on a day shift. Our SOC runs a follow-the-sun rota across the UK, South Africa and India, staffed by permanent employees working under the same ISO 27001 controls, with no subcontractors. Account and service management is UK-based.
Where you own the SIEM, your security data stays in your own tenant in a UK region, we don’t copy it to our platforms, and our analysts work inside it through named, MFA-protected, least-privilege accounts. Either way, we act as your data processor under UK GDPR, and the data processing agreement sets out where your data is stored and who can access it.
Do you use AI in the SOC?
Where it earns its place, and under governance. The detection platforms we operate include behavioural analytics and machine learning that flag unusual activity. Enigma, our own platform, is automation rather than AI: its triage workflows are written and tested by our engineers, so an alert gets the same handling at 3am as at 3pm, and an analyst makes the call.
Every automated action is controlled, logged and approved, and automation and AI governance are part of what our CREST Security Operations accreditation assesses.
Do we need our own SIEM?
No. Some clients bring their own SIEM licence and we operate it. Others come onto ours. We will tell you which makes more sense for your data volume, because that is usually the largest and least predictable part of the cost.
What happens during an incident?
That depends on the tier. On Reactive we triage and notify, and your team contains. On Proactive we investigate and contain within pre-approved actions, alongside you. On Adaptive we contain and orchestrate the response within agreed guardrails, and you keep governance.
The escalation paths and the categorisation matrix are agreed with you during onboarding.
How is this different from MDR?
MDR detects threats and stops them. A Managed SOC does that and adds the work that reduces how often it needs to happen: deeper investigation, threat intelligence, identity hardening, control validation, recovery support and board-level assurance. The response times are the same for both.
Can we move up a tier later?
Yes, and it is a service-level adjustment rather than a fresh procurement. Most clients start at the level their current maturity calls for and move up as their programme develops.
Ready to talk
Ready to find the right tier for your organisation?
Indicative pricing on the first call. Cancel on three months’ notice at any point in the term. A 30-minute discovery call is all it takes.