Home / How it works
How working with us works
Six steps from the first call to renewal. The two things people ask about most, response times and reporting, have their own sections below.
- 1
Scoping call
Thirty minutes with an analyst, not a salesperson. We count endpoints, users, cloud accounts and sites, learn what keeps you up at night, and send a written quote the same day with the plan, any assessments and the total.
- 2
Order and playbook
You sign a one-page order under our terms of service. Onboarding starts with the containment playbook: what we may do on our own (isolate a laptop at 2 a.m.) and what needs your call (disable the CFO's account).
- 3
Deployment
The EDR agent goes out through your existing tooling, or we deploy it. Microsoft 365 or Google Workspace, your identity provider and cloud accounts connect through read-only integrations. Most clients are fully covered inside two weeks.
- 4
Tuning
Thirty days of learning your environment. Every suppressed detection is documented with a reason you can read in the portal, and the baseline vulnerability scan produces the first remediation list.
- 5
Steady state
Analysts triage around the clock. You hear from us when something needs a decision, in a weekly digest, in the monthly report and at a quarterly review that comes with a 90-day roadmap.
- 6
Renewal
Sixty days before the term ends you get a plan review: coverage, incidents, what changed in your environment and what we recommend for the next year. No automatic price increases.
What we need from you
A signed order
One page under our terms of service, with the plan, counts and any assessments. Public agencies order on a purchase order.
Read-only access
Admin consent for the Microsoft 365 or Google Workspace integration, a read-only cloud role, and a way to deploy the agent. No passwords by email, ever.
Two names
A technical contact and an executive contact, with mobile numbers, for the playbook. They are the people we call at 2 a.m.
Response times by severity
Every alert is triaged by an analyst. Severity is assigned on triage and drives the clock. The containment column applies to Professional and Enterprise plans; Essential plans rely on automated containment with analyst follow-up within four hours for critical alerts.
| Severity | Acknowledged | Contained | Examples |
|---|---|---|---|
| Critical | 15 minutes | 1 hour | Ransomware activity, active hands-on-keyboard intrusion, confirmed credential compromise of a privileged account, data exfiltration in progress |
| High | 30 minutes | 4 hours | Malware blocked but persistence suspected, successful phishing with session token theft, exposed service with a working exploit |
| Medium | 4 hours | 2 business days | Policy violations, risky OAuth consents, unmanaged device on the network, suspicious but unconfirmed activity |
| Low | 1 business day | Next monthly report | Informational detections, hygiene findings, vulnerability scan results below high severity |
Clocks run 24×7 for critical and high. Medium and low run during business hours, Pacific time. Monthly reports show actual times against these targets; missing a critical target twice in a quarter earns a service credit of 10% of that month's fee.
What you receive
Weekly digest
Every Monday: alerts triaged, cases opened and closed, anything waiting on you, and the top three things we would fix this week.
Monthly report
Detections by type and source, cases with timelines, mean time to acknowledge and contain against the SLA, vulnerability trend, coverage gaps, training results.
Quarterly review
An hour with your leadership: what happened, what it cost, how you compare to similar companies, and a 90-day roadmap with owners.
Audit evidence
Monitoring, scanning, training and incident records exported in the format your SOC 2, HIPAA or PCI DSS auditor asks for, on request.
When something happens
An analyst confirms the threat, contains it under the playbook and opens a case you can see in the portal. For critical and high severity the on-call contact gets a phone call, not an email. If the incident needs more than containment, an incident responder joins the case, and retainer hours or the emergency rate apply from the moment you say go. You get daily situation reports until it is closed and a final report with the timeline, root cause and what changes.
How assessments run
Scoping call, fixed quote, signed rules of engagement, a test window you set, daily check-ins on anything critical, a readout call within a week of testing, and a retest when you say the fixes are in. The report lands in the portal with the evidence; the attestation letter goes to whoever asked for the test.
Ready to put someone on watch?
Thirty minutes with an analyst, a written quote the same day, full coverage in about two weeks.