Under attack right now? Emergency incident response: a senior responder calls you back within 30 minutes, 24/7.
Quick answer: Most SOC services bundled with an endpoint or backup product, such as the managed SOC offered with Huntress, Acronis and similar platforms, are built to do one job well: confirm a threat on a device that runs their agent, isolate it and tell you. Their reach ends at the endpoints where their agent is installed, and they do not know how your environment fits together. What they usually leave to you is the work that follows across the rest of your environment: finding how the attacker got in, resetting the identities and sessions they used, closing the firewall rule or patching the appliance they came through, checking every system that has no agent, and hardening the estate so it does not happen again. ITSECOPS is that next layer. We work alongside your existing EDR or MDR, not instead of it, with delegated access to your infrastructure, 24/7 from our delivery center in Noida, India, with offices in Kansas City, USA and Stavanger, Norway.
Why this matters now: the gap attackers use
The Sophos Active Adversary Report 2026, based on 661 incident response and MDR cases, found that 67% of root causes were identity related: stolen credentials, brute force and phishing. Attackers reached Active Directory in a median of 3.4 hours. Isolating a laptop does not undo a stolen password, a malicious inbox forwarding rule or a newly created admin account. Those live in your identity provider, your email tenant and your servers, outside the endpoint agent.
On Sunday 27 September 2026, two Citrix NetScaler zero days were confirmed as exploited and administrators were told to take exposed appliances offline or patch them. A NetScaler appliance runs no endpoint agent, so no endpoint SOC can isolate it. Somebody with access to the network had to act, that weekend.
What a bundled vendor SOC typically covers, and what it leaves to you
| Stage after a detection | Typical bundled EDR or MDR vendor SOC | ITSECOPS, the next layer |
|---|---|---|
| Detect and confirm a threat on a device running the agent | Yes, this is its core strength | We take those alerts in, plus identity, email, firewall and cloud logs |
| Isolate the device | Yes | Coordinated with you, plus containment beyond the device |
| Clean up the infected endpoint | Often guided or one click remediation on that host | Done hands on, then verified |
| Reset compromised identities, revoke sessions and tokens, remove rogue mailbox rules | Usually a recommendation for your team | Done by us in Entra ID, Active Directory, Microsoft 365 or Google Workspace |
| Knows your environment: which port, service account or server production depends on | No, it sees what its agent sees | Yes, documented at onboarding and kept current with your team |
| Firewalls, VPNs, appliances, servers and SaaS without the agent | Outside the agent’s reach | In scope: rules closed, appliances patched, exposure removed |
| Root cause analysis: how did they get in? | Limited to what the agent saw | Full root cause report with a timeline |
| Low and medium severity alerts, posture drift | Usually deprioritised to focus on confirmed high severity threats | Reviewed every day as hardening work |
| Hardening so it does not repeat | Not part of the service | Daily proactive hardening, tracked against Microsoft Secure Score and your compliance frameworks |
This is not a criticism of those platforms. Isolation within minutes is exactly what you want from them. The problem is the handoff: the ticket closes at “host isolated”, and the real work lands on an internal IT team that is already stretched, or on nobody at all.
Why a one click “remediate” button is not enough
A vendor SOC that only sees its agent cannot know that the port it wants to close also serves your production website, that the process it wants to kill belongs to your ERP, or that the service account it wants to disable runs the overnight payroll job. A generic remediation applied without that context can stop the attack and take the business offline at the same time.
ITSECOPS works with your team directly. During onboarding we map your critical systems, their dependencies and your change windows, and we keep that map current. When we contain an incident, we choose the action that stops the attacker without breaking production, and when a decision carries business risk, we make it with you, not for you.
How the next layer works with the tools you already have
- Keep your EDR or MDR. Huntress, Acronis, Sophos, Microsoft Defender, SentinelOne or CrowdStrike: alerts from your platform route to our 24/7 team alongside identity, email, firewall and cloud logs.
- Delegated access and an agreed runbook. We operate inside your environment with least privilege delegated admin roles and a written runbook that states what we may do without calling you first (reset a user, revoke sessions, block an address) and what needs your approval (shut down a production server).
- Investigate to root cause. Every confirmed incident gets a timeline: entry point, accounts used, systems touched, data at risk.
- Remediate across the estate. Identities, mail rules, firewall rules, patches, appliances and backups are checked and fixed, and persistence is removed beyond the one isolated host.
- Harden every day. Between incidents we do not wait for the next alert. Conditional access gaps, legacy authentication, missing MFA, exposed ports, unpatched servers and misconfigurations are worked off as a daily queue, so your Secure Score and framework posture improve month after month.
Who this is for
- CIOs and IT managers who already pay for MDR but still end up doing the cleanup themselves.
- CISOs who need a root cause and evidence for the board, insurers or regulators, not only “threat neutralised”.
- MSPs running Huntress or a similar stack who need a white-label team to do remediation and hardening behind their own brand: see white-label MSP support.
Frequently asked questions
Our MDR isolated a machine and closed the ticket. Are we safe?
Not necessarily. Isolation stops that one device from spreading the threat. It does not reset the credentials the attacker used, remove mailbox forwarding rules, close the entry point or check systems that have no agent. Treat a closed isolation ticket as the start of the investigation, not the end of it.
Do we need to replace Huntress, Acronis or our current EDR to work with ITSECOPS?
No. We work alongside your existing platform. Keep the agent you trust; we add investigation, remediation across the whole environment and daily hardening on top of it.
What is the difference between MDR and a managed SOC?
MDR is usually built around one detection product and its agents. A managed SOC watches the wider environment, including identity, email, firewall, cloud and servers, and owns response beyond the endpoint. ITSECOPS combines both and adds the remediation and hardening work. More detail: MDR vs EDR and managed detection and response.
Who fixes the root cause after a security alert?
In most bundled models the root cause fix falls to your internal IT team or your MSP. With ITSECOPS it is part of the service: we investigate, write the root cause report and make the fix with delegated access.
Do vendor SOCs look at low and medium severity alerts?
Most prioritise confirmed, high severity detections so they can respond quickly across thousands of customers. Lower severity signals often show the early stage of an attack or slow posture drift, so we review them every day as part of hardening.
Can an automated remediation break our production systems?
Yes, it can. Closing a port, killing a process or disabling an account without knowing what depends on it can take a production website or business application offline. That is why ITSECOPS maps your environment with your team before we respond, and agrees in advance which actions need your approval.
How do you access our systems safely?
Least privilege delegated admin roles, named engineers, MFA enforced on every account we use, every action logged in the ticket, and a written runbook that defines what we can do on our own and what needs your approval.
How fast do you respond?
Our target for acknowledgement and first triage of a high severity alert is under 15 minutes, 24 hours a day, 7 days a week, including weekends and public holidays. See weekend and after hours cyberattack response.
What does this cost?
Shared 24/7 SOC coverage starts at $300 to $900 per month for up to 25 endpoints, with servers counted double. Full brackets: SOC as a service pricing 2026.