24/7 monitoring and response
Managed SOC for SMEs: we monitor computers and servers around the clock, analyse the alerts and, if an attack is real, we contain it and let you know.
- Alerts monitored 24 hours a day, 7 days a week
- Up and running in 10 days
- No minimum term
- Monthly report for management
If you are looking for a managed SOC in Móstoles, this is what we do at Oteo: we monitor your company's computers and servers around the clock, analyse the alerts and, if an attack is real, we contain it and let you know.
SOC stands for security operations centre.
Read more Read less
It is designed for SMEs without their own security team that need someone to monitor and act outside office hours too. No provider can guarantee that a company will never suffer an incident, and neither can we. What we do is look for attacks in their early stages and respond as agreed with you.
Request a quote
To talk about 24/7 monitoring and response, call or write to us and we'll tell you the next steps.
How we help you
- Antivirus alerts that nobody reviews at night or at weekends
- A client or an insurer asking you for continuous monitoring
- An IT provider that does not handle security
- Detecting an attack in its early stages
- Telling false alarms apart from real attacks
- Companies without their own security team
What a managed SOC is
A security operations centre, or SOC, is the service that looks at a company's security alerts, decides which ones matter and acts on them.
When it is managed, that work is done by an external provider rather than an in-house team.
We offer a managed SOC for SMEs. We monitor your computers and servers around the clock and analyse the alerts they generate.
If an attack is real, we contain it and let you know.
Read more Read less
For your company, that changes one specific thing: alerts no longer wait for someone to open them on Monday morning. Your staff carry on with their work and we take care of reviewing them.
Which companies it makes sense for
This service is for SMEs without their own security team that need someone to monitor and act outside office hours too.
Read more Read less
To find out whether it suits your company, there is no need to get technical. It is enough to answer a few simple questions about how security works in your day-to-day today. If the answers are unclear, it is worth talking it through.
- Who looks at security alerts when the office is closed?
- Who decides what to do if a computer appears to be compromised?
- Does your company have someone whose assigned task is security?
- Could you tell a client who monitors your systems?
Common reasons to take it on
Most of these reasons come down to a gap: there are tools, but nobody is on the other end when they raise an alert.
Antivirus can leave an alert on a Saturday night and nobody reads it until days later.
- Your antivirus raises alerts, but nobody reviews them at night or at weekends.
- A client or an insurer asks you for continuous monitoring.
- Your IT provider does not handle security.
- You want to detect an attack in its early stages, before it encrypts your data.
Read more Read less
Detecting earlier does not mean stopping every attack. It means having more room to act on an attack while it is still in its early stages. That is the part that depends on monitoring, and it is what we offer you.
How we work
We start with an inventory of the computers and servers to be monitored. Then we install the agent remotely and in stages.
In the first few weeks we fine-tune the rules to reduce false alarms, because every company has its own normal way of working.
Read more Read less
There is one step worth looking at carefully: the written agreement on what we can do without calling you and what we cannot. For example, isolating a laptop may not need your say-so, whereas with a production server you may prefer something else. You decide this before it is needed, not in the middle of a problem.
From then on, monitoring is continuous and you receive a monthly report. We work alongside your IT provider or in-house IT team, so you do not have to replace anyone.
How we get started
- We take an inventory of the computers and servers to be monitored.
- We install the agent remotely and in stages.
- We fine-tune the rules in the first few weeks to reduce false alarms.
- We agree in writing what we can do without calling you and what we cannot.
- We monitor continuously and send you a monthly report.
- Inventory of computers and servers
- Remote, staged installation of the agent
- Fine-tuning of the rules to reduce false alarms
- Written agreement on what we can do without calling you
- Continuous monitoring and a monthly report
What the service includes
We install a detection and response agent on every covered computer and server.
It is a small program that records what happens on the machine and lets us act on it remotely.
We monitor alerts 24 hours a day, 7 days a week and analyse each one to rule out false alarms.
Read more Read less
If the alert corresponds to a real attack, we contain the compromised computers, for example by isolating them from the network, and notify the contact person you designate. It is worth choosing that person carefully and having someone else lined up as well, because they are the one who will get the call at any hour.
- Detection and response agent on every covered computer and server
- Alert monitoring 24 hours a day, 7 days a week
- Analysis of every alert to rule out false alarms
- Containment of compromised computers
- Notification to the contact person you designate
- Monthly activity report for management
Fee, timescale and terms
The service is paid as a monthly fee, with no minimum term: you can cancel whenever you like. The entry-level fee covers up to 25 computers.
With more computers or servers, the price depends on how many there are, so the first thing we will ask is how many you have.
The price we quote does not include VAT (21%).
Getting up and running takes about 10 days.
That period starts once we have the inventory of computers and the access we need, so the sooner that list is ready, the sooner we can start.
If you are comparing other proposals, always ask everyone the same questions: how many computers the fee covers, what is done outside office hours, who receives the notification and what falls outside the service.
These are the questions that allow a genuine comparison.
Alerts monitored 24 hours a day, 7 days a week
What this service does not include
- Investigation and recovery after a serious incident, which fall under incident response
- Computers beyond the 25 covered by the entry-level price, which are quoted separately
- Day-to-day IT: setting up users, printers or updates
Read more Read less
We prefer to say so from the outset to avoid misunderstandings. Monitoring detects and contains, but some work falls elsewhere.
If an incident is serious, the investigation and recovery fall under the incident response service. And day-to-day IT remains the job of your provider or your in-house team.
Who you will deal with
Aitor handles management and client relations.
Questions about whether this service suits your company, which computers would be included or how the fee works are the kind of conversation that belongs to that role.
Before we talk, it helps to have to hand how many computers and servers your company has, who looks after your IT today and who could be the contact person for notifications.
If you are not clear on all of it, call us anyway and we will tell you how to proceed.
Where we work
We work remotely anywhere in Spain and on site in the Comunidad de Madrid, where Móstoles is located.
Monitoring lends itself well to remote work, because the agent is installed remotely. That is why it makes no difference where in Spain your company is.
If it is in the Comunidad de Madrid, we can also work on site.
Questions before you sign up
The most useful questions before signing up tend to be practical ones: how it differs from antivirus, what happens in the middle of the night, whether you need to change provider or how long it takes to start.
You will find the answers below. If your question is a different one, call us and we will answer it.
Questions about 24/7 monitoring and response
What is the difference between antivirus and a managed SOC?
Antivirus blocks what it recognises and leaves an alert. With a managed SOC, those alerts are reviewed, what the antivirus cannot see is investigated, and action is taken when an attack is under way.
How much does it cost?
You pay a monthly fee. The entry-level fee covers up to 25 computers. With more computers or servers, the price depends on how many there are. Call us, tell us how many you have and we will tell you what it comes to in your case.
What happens if you detect something in the middle of the night?
We analyse the alert and, if the attack is real, we contain the affected computer as agreed and notify your contact person. What happened is then investigated.
Do I have to change IT provider?
No. We work alongside your provider or your in-house team. We take care of security and they take care of day-to-day IT.
Is there a minimum term?
No. The service is paid month by month and you can cancel whenever you like.
How long does it take to get up and running?
About 10 days from when we have the inventory of computers and the access we need.
Do I need to install anything on my computers?
Yes. Every covered computer and server runs a detection and response agent. We install it remotely and in stages.
Does this service mean I will never suffer an attack?
Nobody can promise that. Monitoring is there to spot an attack in its early stages and act on it as agreed, including at night and at weekends.
Incident response
We contain the attack, find out what has happened and help you get your business running again.
Outsourced security lead (vCISO)
A person responsible for your company's security, without hiring them full-time.
Backup and continuity
Immutable backups stored off your premises and recovery tests with the time measured.
Exposure assessment
We review from the outside what an attacker can see of your company and give you a report for management and a prioritised plan.
Tell us how many computers you have
Call us on +34699240879 or email us at hola@oteosecurity.com.
Once we know how many computers and servers you have and who looks after your IT today, we can tell you how to proceed.