Most monitoring raises the alarm. We step in.
A hijacked account is blocked within seconds, an infected laptop isolated: automatically, at night too. Our specialist then fixes what is needed, with up to one hour per incident included. Independent, alongside your current IT provider, in your own Microsoft environment.
Sound familiar?
You want something to happen when things go wrong, on a Friday evening too. Without your own control room, and without replacing your IT provider.
Situations in which clients end up with us
- Defender is switched on, but nobody looks at the alerts.
- A hacked mailbox was only discovered after three days.
- Your insurer or a major client asks for detection, and you do not know whether you have it.
- You want security alongside your current IT provider, without replacing them.
A phishing email on a Tuesday morning. Five minutes later it is contained.
- 1Signal08:02
An employee signs in on a fake sign-in page.
- 2Detection08:03
Defender sees a sign-in from an unknown country, on an unknown device.
- 3Investigation08:05
Our specialist confirms it: a real incident, not a false alarm.
- 4Response08:07
Sessions revoked, password reset, suspicious mail rule removed.
- 5ReportSame day
You hear what happened. Your IT provider gets the advice that prevents a repeat.
If this happens on a Friday evening, the alert sits there until Monday. The attacker has the whole weekend.
Contained automatically, at night and at weekends too. On the next working day our specialist fixes what is needed.
What is the difference between SOC, SIEM and MDR? Read it in plain language
What's included
- Detection and automatic intervention, day and night
- Remediation by our specialist, up to one hour per incident included
- Critical incidents reviewed on working days by a dedicated specialist
- An incident report for significant incidents, in language for the board
- Investigation of questions and suspicions you report to us
- Independent, alongside your current IT provider
- Everything in your own Microsoft environment, so you can always stop
"We earn nothing from an incident. So we would rather it never happened, and otherwise that it was over by three in the morning."Martijn Mol, Remarx
The difference is what we can see.
Both levels intervene automatically, day and night, and are reviewed by a specialist on working days. What differs is how far our view reaches.
| Managed Detection & ResponseMicrosoft Defender XDR | Managed Extended Detection & ResponseDefender XDR plus Microsoft Sentinel | |
|---|---|---|
| What we see | Accounts, devices, email and cloud apps inside Microsoft | Also firewall, VPN, network and systems outside Microsoft |
| Looking back | 30 days in detail, 180 days for incidents | 90 days as standard, up to years in a low-cost archive |
| Evidence for NIS2 and insurers | Limited | Yes, with a demonstrable retention period |
| Requires | Microsoft 365 Business Premium with the Defender Suite, or E5 | The same, plus your own Azure subscription for Sentinel |
| Price | € 14.30 per employee, € 150 per environment and € 15 per server, per month | Quoted separately, depending on the number of sources and the complexity |
| Suits | An organisation that works almost entirely in Microsoft 365 | Own servers or network equipment, or strict logging requirements |
With MXDR, Microsoft Sentinel runs in your own Azure environment. Data usage appears on your invoice and not on ours; we keep it low and review it every quarter.
Frequently asked questions
Which Microsoft licences are required?
Microsoft 365 Business Premium with the Defender Suite, an add-on of € 8.70 per user per month (Microsoft list price, annual subscription, excluding VAT). Business Premium on its own is not enough: protection for identities and cloud apps and the extended detection on devices and email are in the Defender Suite. If you have Microsoft 365 E5, it is already included. Licences run at regular Microsoft rates through our partnership, on one invoice, or through you directly.
Do we need a SIEM?
Usually not. Defender XDR itself links the alerts from accounts, devices, email and cloud apps into one attack story. A SIEM with Microsoft Sentinel only adds value when there are many sources outside Microsoft, such as a firewall or your own servers, or when you need to look back further. That is our MXDR level.
Do you monitor 24 hours a day?
The technology runs day and night and intervenes automatically outside office hours. We do not staff a night shift: critical incidents are reviewed by a specialist on working days, and you get the full account the next working day. That is why our automatic measures are set more strictly than usual. Does someone need to be able to decide at three in the morning? Then you need a provider with shift cover, and we would rather say that now.
What if we want to stop?
Everything runs in your own Microsoft environment, without software or tooling of ours. You stay the owner of your data and can always stop or switch.
Your next step.
CISO as a Service
Security leadership at board level. A full-time CISO easily costs € 10,000 to € 15,000 a month, if you can find one.
Read moreSecurity Assessment & pentest
Where does an attacker get in?. A security assessment shows where you are vulnerable: technically and organisationally.
Read moreManaged Modern Workplace
Workplace, support and Intune. Open the laptop, sign in, work.
Read moreGet acquainted in twenty minutes.
You speak directly with a specialist who knows the trade. You tell us what's going on; we tell you honestly whether and how we can help. Even if the answer is 'you don't need us'.
Pick a time
On working days, via Teams or phone. Choose a slot in our calendar and get an instant confirmation.
Open the calendar Prefer to call? 085 060 9448 · Or send a message