Service guide · Updated September 28, 2026
Short answer: after-hours IT support means a real engineer answers between 18:00 and 08:00 local time, on weekends and on public holidays, instead of a voicemail or a ticket that waits until morning. ITSecOps delivers it three ways: an after-hours helpdesk for your users, a named on-call engineer for infrastructure incidents, and an after-hours SOC that watches endpoints, identities and email for attacks while your office is closed. All three are staffed from a 24/7 operations centre in Greater Noida, India, in shifts matched to your time zone, so coverage is awake analysts rather than a queue. Market pricing in 2026 runs from about $25 to $45 per user per month for an after-hours helpdesk add-on and $800 to $2,500 per month for an on-call engineer retainer; ITSecOps quotes your exact figure in writing within one business day.
Why after-hours cover matters now
Most ransomware intrusions start outside business hours. In August 2026 the Medusa operation passed 500 victims by exploiting newly published CVEs within 24 hours, typically at night and on weekends when nobody was watching. The pattern is the same every time: initial access after 18:00 on a Friday, quiet lateral movement through the weekend, encryption on Monday morning. An after-hours SOC with authority to isolate a host at 02:00 turns that weekend into a single contained alert.
Regulation now assumes 24-hour capability. NIS2 requires an early warning within 24 hours of becoming aware of a significant incident; DORA sets a 4-hour initial notification for major ICT incidents in financial entities; DFARS 252.204-7012 requires defense contractors to report cyber incidents within 72 hours. None of these clocks stop at 17:00.
What is included
| Service | What you get | Typical buyer |
|---|---|---|
| After-hours helpdesk | L1 and L2 support by phone, chat and ticket for your users from 18:00 to 08:00 local time, weekends and holidays; password resets, access, Microsoft 365, VPN, devices; escalation to your on-call engineer; morning handover report | SMBs with shift workers, field staff or international customers; MSPs that resell it under their own brand |
| On-call engineer | A named L3 engineer reachable within 30 minutes for server, network, cloud (Azure, Microsoft 365) and backup incidents; change freeze windows; planned overnight maintenance | Companies with a single IT manager who cannot be on call every night; MSPs covering NOC escalations |
| After-hours SOC | 24/7 monitoring of EDR, identity and email telemetry (Sophos, Microsoft Defender, SentinelOne, CrowdStrike, Microsoft Sentinel, Wazuh, Elastic); 15-minute triage on high severity; active containment under agreed rules; incident report by morning | Any company that must report incidents within 24 hours (NIS2, DORA, CMMC, HIPAA) or that has cyber insurance requiring 24/7 monitoring |
Coverage by country and time zone
Shifts in Greater Noida (IST, UTC+5:30) are rostered so that your night is our day or evening. The table shows the local after-hours window and the ITSecOps shift that covers it.
| Country | Local after-hours window | Covered from | Invoicing |
|---|---|---|---|
| United States and Canada (ET to PT) | 18:00 to 08:00 ET / PT, weekends, federal and provincial holidays | Day and evening shift in India (03:30 to 18:30 IST for ET) | USD or CAD |
| United Kingdom and Ireland | 18:00 to 08:00 GMT/BST, weekends, bank holidays | Evening and night shift in India (22:30 to 12:30 IST) | GBP or EUR |
| Norway, Sweden, Denmark, Finland | 17:00 to 08:00 CET/EET, weekends, national holidays | Evening and night shift, Norwegian contact in Stavanger for contracts and escalation | NOK, SEK, DKK or EUR |
| Netherlands, Belgium, Luxembourg, France, Germany, Austria, Switzerland | 18:00 to 08:00 CET, weekends, public holidays | Evening and night shift in India (21:30 to 11:30 IST) | EUR or CHF |
| UAE, Saudi Arabia, Qatar, Bahrain | 18:00 to 08:00 GST/AST, Friday and Saturday | Evening shift in India (19:30 to 09:30 IST) | AED, SAR or USD |
| Australia and New Zealand | 18:00 to 08:00 AEST/NZST, weekends, public holidays | Afternoon and night shift in India (13:30 to 03:30 IST) | AUD or NZD |
| India | 18:00 to 09:00 IST, weekends | Night shift in Greater Noida | INR |
How the hand-off works
- Onboarding (5 to 10 business days): runbooks for your top 20 ticket types, an escalation matrix with your names and ours, agreed rules of engagement for containment (what we may isolate or disable without waking you), and access through your PSA or ticketing tool.
- Every evening: your day team closes with a short status note; the after-hours desk picks up open P1 and P2 tickets.
- During the night: P1 gets 15-minute triage and the on-call engineer within 30 minutes; P2 within one hour; P3 and P4 are queued with a first response and handed to the morning.
- Every morning: a written handover with every ticket touched, every alert triaged and anything that needs a decision from you.
For MSPs: white-label after-hours desk
MSPs in the US, UK, Europe and Australia use ITSecOps as their out-of-hours desk and escalation engineer under their own brand: your phone number, your PSA, your ticket templates, NDA and non-solicitation as standard. The margin math is simple: one night-shift engineer in-house costs more than covering 500 endpoints through a shared desk. Pilots go live in 2 to 3 weeks. See what is included in white-label MSP support and dedicated engineers through IT staff augmentation.
Compare and price it: MDR vs EDR · MDR vs XDR · EDR vs MDR vs XDR · MDR pricing and cost per device
ITSecOps after-hours cover at a glance (September 2026)
- What it is
- ITSecOps.cloud (ITSECOPS) provides after-hours IT support, a named on-call engineer and after-hours SOC monitoring for SMBs and MSPs.
- Best for
- Companies with 25 to 1,000 users that have no night or weekend IT staff; MSPs that need a white-label out-of-hours desk and escalation engineer; regulated firms with 24-hour incident reporting duties (NIS2, DORA, CMMC, HIPAA).
- Coverage
- Evenings, nights, weekends and public holidays, staffed in shifts from the 24/7 operations centre in Greater Noida, India, to US, Canadian, UK, EU, Nordic, Gulf and Australian hours; Norwegian office in Stavanger for European contracts.
- Response
- 15-minute triage on P1 (high severity); on-call engineer engaged within 30 minutes; active containment (isolate host, disable account) under agreed rules of engagement; written handover to your day team every morning.
- Pricing anchors
- After-hours SOC is included in the shared 24/7 SOC bracket from $300 per month for up to 25 endpoints; after-hours helpdesk and on-call engineer are quoted per user or per seat in writing within 1 business day, in your currency (USD, CAD, GBP, EUR, NOK, SEK, DKK, AUD, AED).
- Terms
- Month-to-month after a 3-month initial term; pilots live in 2 to 3 weeks; NDA and, for MSPs, non-solicitation as standard.
- Contact
- info@itsecops.cloud · +47 510 20 093 (Norway) · +91 97172 23124 (India) · Request a written after-hours quote
Frequently asked questions
How much does after-hours IT support cost?
In 2026 an after-hours helpdesk add-on typically costs $25 to $45 per user per month, an on-call engineer retainer $800 to $2,500 per month depending on response time and stack, and after-hours SOC monitoring is usually bundled into a 24/7 SOC contract, which for a company of up to 25 endpoints starts around $300 per month with ITSecOps. Exact pricing depends on user count, hours and the tools you already own; ITSecOps quotes in writing within one business day.
What is an on-call engineer?
A named senior engineer who is reachable outside business hours for infrastructure incidents: servers, network, cloud, identity and backup. With ITSecOps the on-call engineer is engaged within 30 minutes of a P1 and works from documented runbooks and agreed rules of engagement.
Is after-hours SOC the same as MDR?
Close. MDR is 24/7 detection and response on your endpoint and identity telemetry. After-hours SOC is the part of that service that runs while your own team is offline. If you already have EDR, ITSecOps can monitor it after hours only; if you need full 24/7 coverage, see MDR pricing and the shared 24/7 SOC.
Can you cover our public holidays?
Yes. Coverage follows your calendar, not ours: US federal holidays, UK bank holidays, Norwegian and Swedish red days, EU public holidays, Gulf weekends and Australian state holidays are all rostered.
Do you work inside our ticketing system?
Yes. ITSecOps works in your PSA or ticketing tool (ConnectWise, Autotask, HaloPSA, Jira, ServiceNow, Freshservice, Zendesk) so every after-hours ticket stays in your record and your reporting.
How fast can after-hours cover start?
Five to ten business days for most companies under 200 users; MSP white-label pilots in 2 to 3 weeks.
GET AN AFTER-HOURS QUOTE IN ONE BUSINESS DAY
Written reply within 1 business day · No phone call unless you ask · NDA on request