SOC status:Duty analyst on shift
Managed SOC · SOC365 · 24/7 · United Kingdom
SOC365 is our managed security operations centre: our own platform, our own analysts, our own detection engineering, run from Duxford under ISO 27001 and ISO 9001 processes for organisations across the UK and Europe.
CREST SOCISO 27001 · ISO 9001Named duty analystPlatform built in-houseFrom £5 a device a month
Any tool can generate ten thousand alerts a day. SOC365 exists to turn telemetry into decisions: which signals are real, what the attacker is trying to do, and what to switch off first. It unifies cloud, endpoint, identity, network, OT and application telemetry with live threat intelligence and deception signals, and every alert you receive has been looked at by an analyst who can explain it.
Core capabilities
Always-on behavioural analytics, correlation and enrichment across endpoint, identity, cloud, network, OT and applications, validated by senior analysts before escalation.
A structured detection lifecycle aligned with MITRE ATT&CK, built around your threat model and regulatory obligations, and reviewed every month.
Correlation against our own holdings: dark-web monitoring, phishing domain feeds, adversary infrastructure tracking, credential leaks and deception telemetry.
Hypothesis-driven and intelligence-led hunts that reveal early intrusion activity and cut attacker dwell time.
Guided containment, evidence collection, forensic analysis and coordinated recovery using CREST-aligned methods, from the analysts who saw the alert first.
Deception-driven alerts, infrastructure poisoning and Pulsar-assisted endpoint control to degrade an adversary's capability while you recover.
02
DeceptionDecoyPulse
SOC365 places decoy hosts, services, file shares and admin portals inside your environment, plants credentials and tokens that only an intruder would ever use, and watches them. Nothing legitimate touches a decoy, so an alert from one is close to certain — and it can trigger Pulsar isolation, blocking or rate limiting before an analyst has finished reading it.
03
EmilyAISOC assistant · since 2018
EmilyAI is the SOC assistant we built in 2018 for periods of high alert volume and complex investigations. She extracts indicators, checks historical context, cross-references our intelligence holdings, drafts structured case notes and flags the low-value alerts worth tuning out. She runs entirely inside our own environment, sees only the metadata an analyst gives her, cannot take containment actions and never operates without an analyst directing her. The analysts stay in charge; they just get more of their day back.
Operations
Stage 01
Behavioural anomalies, threat-intelligence matches, deception triggers or engineered detections fire within SOC365.
Stage 02
Analysts validate the signal, collect context, correlate indicators and suppress false positives.
Stage 03
Root-cause analysis, lateral-movement tracing, evidence gathering and mapping of the attacker's objectives.
Stage 04
Pulsar agent actions, identity locking, network isolation and protective changes, executed with your approval or under pre-agreed authority.
Stage 05
Guided remediation, configuration hardening and validation that the attacker's access is gone.
Stage 06
Clear, executive-ready reporting of cause, actions taken and what to change next.
Behind the scenes
Cloud, endpoint, network, identity, OT and application logs ingested and normalised for consistent analysis.
Detection of anomalous actions, privilege misuse, lateral movement and early-stage intrusion activity.
Continuous correlation against phishing feeds, dark-web datasets, leak indexing and adversary infrastructure tracking.
High-confidence alerts from adversaries touching synthetic assets, credentials and network paths.
Remote quarantine, process termination, file removal, outbound blocking and evidence capture for rapid containment.
Real-time visibility, incident tracking, service metrics and downloadable forensic and compliance reports.
Intelligence holdings feeding SOC365
26m
Malicious IP addresses
620k
Malicious domains
4m+
Indicator hashes
2.6bn
Leaked account records
4.5m
Dark-web sites indexed
547k
Phishing domains
Onboarding
Stage 01
Architecture, risks, regulatory obligations and the operational constraints nobody wrote down.
Stage 02
Telemetry sources connected, Pulsar deployed, ingestion quality validated.
Stage 03
Use cases, MITRE mappings and environment-specific playbooks built for you.
Stage 04
Full shift coverage begins, with immediate monitoring, triage and response.
Stage 05
Monthly service reviews and exposure analysis mature your posture from there.
Regulated sectors
Estimate
SOC365 is priced per device per month, and the rate falls as the number of devices rises. Enter roughly how many devices you would want watched and the estimate builds; a short discovery confirms the count and turns it into a fixed monthly price.
Count the workstations, laptops, servers and virtual machines you want watched. We confirm the number at discovery.
Rate by device count
Add to the estate
Entra ID, Duo, Okta or similar: sign-ins, MFA events, risky-user signals and privilege changes watched alongside the endpoints.
£100 a month
Microsoft 365 or Google Workspace: mailbox rules, sharing, admin activity and the audit log that most intrusions now touch first.
£250 a month
Perimeter and internal firewalls, IPS and IDS appliances, with their logs correlated against the rest of the estate.
£100 each a month
One decoy on your external network and one inside it. Nothing legitimate touches them, so an alert from either is close to certain.
£250 a month
Incident response retainers
SOC365 is priced per device per month — between £5 and £12 + VAT a device, depending on how many we monitor; the estimate above shows how it adds up. If you are not a SOC365 client, an Incident Response Retainer gives you guaranteed response times, pre-agreed terms and a block of hours with our Disrupt team, so the worst day is not also the day you negotiate a contract.
Essentials
£2,500per year
For smaller organisations or those beginning their incident-readiness journey.
Standard
Recommended£7,500per year
The option most organisations choose.
Enhanced
from £15,000per year
For regulated, multi-site or high-risk organisations, including group and MSSP arrangements.
Prices exclude VAT. Retainer hours can be used for triage, containment, investigation, forensics, recovery guidance and post-incident work, including tabletop exercises and readiness reviews. Retainers can be tailored for regulated or multi-entity organisations.
Questions
Between £5 and £12 + VAT per device per month, depending on the number of devices we monitor: the more there are, the lower the rate. A short discovery confirms the device count and the price before anything is signed.
Rarely. SOC365 ingests telemetry from most EDR, identity and cloud platforms. Where a tool is missing, our own endpoint agent, Pulsar, fills the gap.
The same thing that happens at 3 p.m. An analyst validates the alert, contains what you have pre-authorised us to contain, and calls the person on your escalation list for anything else.
Monthly: what we saw, what we did, what changed in your exposure, and what we recommend. Written for people who do not want to read a SIEM dashboard, with the evidence attached for those who do.
Yes. SOC365 produces the monitoring, detection and incident evidence those regimes expect, and our consulting team runs the gap assessments and exercises around it.
Yes, and we will always do our best to help. Response times, priority and commercial terms are far clearer and faster with a retainer agreed in advance.
We keep going at pre-agreed overage rates, then review the retainer level with you afterwards so it matches your actual risk.
Yes. Our reporting is written to be used directly with cyber insurers, regulators, auditors and legal counsel, and we can support notification and disclosure workflows.
Ask everyone the same questions and score the answers. We publish a free checklist of twenty questions to ask a SOC provider, with what a good answer looks like beside each one, and we are happy to be scored against it in the first meeting.
Reading
A managed SOC is a security operations centre you subscribe to rather than build. Here is what you are actually buying, what it costs in the UK compared with building your own, how the market prices it, and how to choose a provider you will not regret a year later.
The NCSC, FBI and AIVD have exposed Iranian spyware — CHOSEN BRICK — used to surveil dissidents, activists and journalists. What the campaign does, who is really at risk, and the practical steps that protect the people targeted and the organisations around them.
Cyber security has moved from the server room to the boardroom. Regulators, insurers, and shareholders now expect boards to demonstrate active oversight of cyber risk — and for most organisations, that means understanding what their Security Operations Centre provider is actually delivering. This article sets out the ten areas every board should scrutinise when evaluating a modern SOC provider, from detection engineering and threat intelligence to transparent reporting, compliance alignment, and measurable outcomes.
Start a conversation
A thirty-minute technical briefing with the SOC lead, using an anonymised incident from last month.