Managed Security Operations

Enterprise-Level Security Operations Without the Cost of Building Your Own SOC

Cyber security isn't something you can simply configure and forget.

Your business is constantly changing. New devices are added, employees join and leave, vulnerabilities are discovered, Microsoft 365 configurations change and attackers develop new techniques.

At the same time, your IT team may already be dealing with hundreds of other priorities.

Who is watching your security environment?

Who investigates suspicious activity?

Who knows whether a security alert is actually serious?

Soltech IT's Managed Security Operations service provides ongoing security expertise, monitoring and management to help protect your organisation without the cost and complexity of building your own internal Security Operations Centre.

What Are Managed Security Operations?

Managed Security Operations provides an ongoing security function around your organisation.

Rather than relying solely on automated security products, our service combines security technology, monitoring, analysis and human expertise.

We help you:

• Monitor your security environment
• Identify suspicious activity
• Investigate security alerts
• Prioritise cyber risks
• Respond to threats
• Review security controls
• Improve your security posture
• Provide management reporting

The result is a more proactive approach to cyber security.

Your Security Shouldn't Stop at 5pm

Cyber criminals don't work office hours.

An attack could begin:

• Overnight
• At weekends
• During a bank holiday
• While your IT team is unavailable
• When employees are working remotely



A security alert generated at 2am isn't much use if nobody sees it until Monday morning.

Managed Security Operations provides ongoing security oversight so that potential threats can be identified and investigated more quickly.

What Does a Managed Security Operations Team Do?

A security operations function typically performs several key activities.

Monitor

Watch for suspicious activity across your security environment.

Detect

Identify potential threats and unusual behavior.

Investigate

Determine whether an alert represents a genuine security incident.

Prioritise

Assess the severity and potential business impact.

Respond

Take appropriate action to contain or remediate threats.

Report

Provide clear information to management about security activity and risk.

Improve

Use findings to strengthen your security controls.

What Can We Monitor?

Depending on your environment and service requirements, Managed Security Operations can bring together security information from:

• Microsoft 365
• Microsoft Entra ID
• Endpoints
• Servers
• EDR
• Firewalls
• Email security
• Cloud services
• Identity systems
• Security applications
• Network infrastructure

This creates a broader picture of what is happening across your organisation.

Detecting Suspicious Activity

Modern attacks don't always look like traditional malware.

An attacker may use legitimate tools, stolen credentials or compromised accounts.

We can look for indicators such as:

• Unusual login activity
• Suspicious authentication
• Unexpected administrator changes
• Abnormal endpoint behaviour
• Malicious processes
• Unusual network activity
• Attempts to disable security controls
• Suspicious account behavior

The objective is to identify potential attacks before they become major incidents.

Human Security Analysis

Security products can generate thousands of alerts.

The challenge isn't simply generating alerts.

It's determining:

Which alerts actually matter?

Security specialists can investigate activity and establish whether something is:

• Normal
• Suspicious
• A false positive
• A potential compromise
• An active security incident

This helps prevent your IT team from being overwhelmed by security alerts.

Managed Security Operations & MDR

Managed Security Operations and Managed Detection & Response (MDR) are closely related but can be positioned differently within your service offering.

MDR

Primarily focuses on detecting, investigating and responding to active threats.

Managed Security Operations

Provides a broader ongoing security function that can include:

• Security monitoring
• Threat detection
• Incident investigation
• Security configuration
• Risk management
• Vulnerability management
• Security reporting
• Security improvement

In simple terms:

MDR focuses heavily on "Is someone attacking us?"

Managed Security Operations asks "How secure are we, what is happening, and what should we do about it?"

For many organisations, the two services work together.

Managed Security Operations & Managed Security Risk

These services complement each other.

Managed Security Risk focuses on understanding and reducing your cyber exposure.

Managed Security Operations focuses on the ongoing operation, monitoring and management of your security environment.

Together:

Identify Risk → Reduce Risk → Monitor → Detect → Respond → Improve

Microsoft 365 Security Operations

Microsoft 365 is a major part of many organisations' security environments.

We can provide ongoing oversight across areas such as:

• Entra ID
• MFA
• Conditional Access
• Administrator accounts
• Exchange Online
• Defender
• SharePoint
• OneDrive
• Teams
• Intune

This helps ensure your Microsoft 365 security isn't simply configured once and then forgotten.

Endpoint Security Operations

Your endpoints provide valuable security information.

Using technologies such as EDR, we can identify suspicious behaviour including:

• Malware
• Ransomware activity
• Malicious scripts
• Credential theft
• Suspicious applications
• Abnormal processes
• Attempts to disable protection

Where appropriate, compromised endpoints can be isolated while an investigation takes place.

Vulnerability Management

Security operations shouldn't only focus on attacks that are already happening.

We also need to reduce the opportunities attackers have to get in.

Our service can incorporate vulnerability management, helping identify:

• Critical vulnerabilities
• Missing security updates
• Unsupported systems
• Vulnerable applications
• Network device weaknesses
• Internet-facing exposure

Issues can then be prioritised according to risk.

Security Configuration Management

A security product is only as good as its configuration.

We can help monitor and review security controls across areas such as:

• Microsoft 365
• Endpoints
• Firewalls
• Email
• Identity
• Backup systems

This helps reduce the risk of security controls becoming incorrectly configured or ineffective over time.

Incident Response

When a serious threat is identified, the priority is to contain it.

Managed Security Operations can support the incident response process:

Detect → Investigate → Contain → Remediate → Recover

This can include:

• Investigating compromised accounts
• Isolating affected endpoints
• Removing malicious activity
• Resetting credentials
• Reviewing system access
• Supporting recovery
• Identifying the root cause

Security Reporting for Management

Cyber security can be difficult for directors and business owners to understand.

You shouldn't have to interpret thousands of technical alerts.

Our reporting can focus on:

Current Risk

What are the biggest risks facing your business?

Security Events

What significant security activity has occurred?

Incidents

Were any genuine threats identified?

Vulnerabilities

What needs to be addressed?

Improvements

How is your security position changing?

This provides management with a clearer view of cyber risk.

Security Operations for Small & Medium-Sized Businesses

Building an internal Security Operations Centre can be expensive.

You may need:

• Security analysts
• Security engineers
• Monitoring platforms
• SIEM technology
• EDR
• Threat intelligence
• Incident response capability
• 24/7 staffing

For many small and medium-sized businesses, this simply isn't practical.

Managed Security Operations provides access to specialist security capabilities without requiring you to build the entire function yourself.

Security Operations for Professional Services

Professional services businesses are attractive targets because they often hold significant amounts of confidential information.

This includes:

• Accountants
• Solicitors
• Financial advisers
• Insurance businesses
• Consultants
• Recruitment companies

Managed Security Operations can provide additional protection for organisations handling sensitive customer and financial information.

Security Operations for Schools

Schools and Multi Academy Trusts face a particularly challenging cyber security environment.

They have:

• Large numbers of users
• Staff devices
• Pupil devices
• Microsoft 365
• Sensitive information
• Financial systems
• Remote access

Managed Security Operations can provide additional security expertise without requiring schools to employ their own dedicated security team.

Security Operations & Cyber Essentials

Managed Security Operations complements Cyber Essentials, but does not replace it.

Cyber Essentials provides a recognised baseline of technical security controls.

Managed Security Operations provides ongoing monitoring and management.

The two services therefore address different parts of your cyber security strategy.

Security Operations & Cyber Essentials Plus

Cyber Essentials Plus provides independent technical verification of security controls.

Managed Security Operations provides ongoing oversight between certification assessments.

Together they can help organisations maintain a stronger security posture throughout the year.

Security Operations & Cyber Insurance

Cyber insurers increasingly expect businesses to demonstrate that security is actively managed.

Depending on your policy, this may include requirements around:

• MFA
• Endpoint protection
• Backups
• Vulnerability management
• Security monitoring
• Incident response

Managed Security Operations can help organisations maintain visibility over these areas.

Your insurer's specific requirements should always be checked against your individual policy.



A Complete Managed Cyber Security Service

Managed Security Operations can bring together multiple Soltech IT services.

Prevent

• Cyber Essentials
• Email Security
• Microsoft 365 Security
• MFA
• Secure Configuration

Reduce Risk

• Managed Security Risk
• Vulnerability Management
• Cyber Security Auditing
• Penetration Testing

Detect

• EDR
• MDR
• Dark Web Monitoring
• Security Monitoring

Educate

• Security Awareness Training
• Phishing Simulation Testing

Respond

• Incident Response

Recover

• Backup & Disaster Recovery

This creates a complete security lifecycle rather than a collection of disconnected products.

Why Choose Soltech IT?

Soltech IT already understands your IT environment.

That matters.

Security recommendations need to work alongside your:

• Microsoft 365
• Servers
• Network
• Devices
• Applications
• Users
• Backup systems
• Existing IT support

Our cyber security specialists can work alongside your IT environment to provide a practical, joined-up security service.

Frequently Asked Questions

What is Managed Security Operations?

It is an ongoing managed service providing security monitoring, investigation, risk management, response and security improvement without requiring the business to build its own internal security operations team.

Is Managed Security Operations the same as MDR?

Not exactly. MDR focuses primarily on detecting, investigating and responding to active threats. Managed Security Operations can encompass a broader range of ongoing security activities.

Do small businesses need Managed Security Operations?

Many small and medium-sized businesses don't have the resources to employ dedicated security specialists or operate a 24/7 SOC. A managed service can provide access to these capabilities without the cost of building them internally.

Is Managed Security Operations 24/7?

The exact monitoring and response arrangements depend on the service package. Soltech IT can define the monitoring, escalation and response levels appropriate for your organisation.

Does this replace our IT support?

No. Managed Security Operations complements IT support by providing specialist cyber security monitoring and management.

Your Business Deserves More Than a Security Product

Buying security technology is relatively easy.

Knowing what the technology is telling you, understanding the risk and taking action is much harder.

Managed Security Operations from Soltech IT Ltd provides the ongoing expertise needed to turn security technology into an active cyber defence.

Don't Just Buy Cyber Security. Manage It.



Contact Soltech IT Ltd today to discuss Managed Security Operations for your business.

Meet the team

Jane Pruden

Finance and HR Director

Heading up our finance team at Soltech, Jane is responsible for ensuring the company's financial functions serve our internal requirements and our clients' needs.

Jane is certified by The Association of Accounting Technicians and has a wealth of experience in the use of financial systems including SIMS, FMS, XERO, PassFINANCE, Sage and QuickBooks to mention a few.