Threat Detection & Response
Threat detection and response, with SOC monitoring around the clock.
A break-in doesn't always look like one. A stolen password gets used at night, or a laptop starts acting strangely on a Saturday. SOC (security operations center) monitoring is available 24/7/365, and when the SOC finds a real threat on a computer or server, it's pre-approved to cut that device off the network and start cleanup.
Threat detection and response means software that spots signs of an attack, a security operations center (SOC) that reviews what it finds, and action when a threat is real. Cyber Shift Technologies, based in North Canton, provides managed EDR/MDR with 24/7/365 SOC monitoring. When the SOC finds a threat on a device, it's pre-approved to isolate it and begin cleanup.
Where It Breaks Down
The gap is often between the alert and the action.
Three gaps to close before a real alert shows up at midnight.
An alert fires and nobody sees it.
An alert only helps if someone sees it, including nights, weekends and holidays.
Nobody knows who's allowed to act.
If a laptop looks infected at midnight, someone has to decide whether to cut it off. That decision should be made before it's needed.
You can't tell what you're paying for.
'Monitoring' can mean a person reviewing alerts or software sending an email. You should know which one you have.
Threat Detection & Response
EDR, MDR, SOC and SIEM, explained by the problem each one solves.
Each one does a different job, and none of them does everything.
EDR (endpoint detection and response)
Software on each computer and server records what programs and connections are doing and flags behavior that looks like an attack, even when no known bad file is involved. It sees only the devices it's installed on. It doesn't see firewalls, switches or Wi-Fi. An alert means nothing until someone acts on it. It doesn't recover lost data. Managed EDR runs on the computers and servers in every managed plan.
MDR (managed detection and response)
A provider's security team reviews what EDR flags, investigates and takes the response actions it's authorized to take. Scope varies widely: some MDR services act, some only notify. It isn't a backup, and it isn't the forensics and recovery work a bigger incident needs. Our SOC partner reviews alerts and is pre-approved to isolate a device and begin partial or full remediation, then works with Cyber Shift to finish.
SOC (security operations center)
A team that watches security alerts and sorts real threats from noise. A SOC sees only the systems connected to it, and "24/7 SOC monitoring" can mean watch-and-notify only. SOC monitoring is available 24/7/365. It covers computers, servers and, depending on your plan, Microsoft 365 or Google Workspace accounts. Network equipment isn't part of it.
SIEM (security information and event management)
Collects security records from many systems into one place, connects related events and keeps a history to investigate. It stops nothing by itself, and it needs someone watching it. Central log collection is available as an add-on, or included in our most complete plan. Without it, records stay in each system's own tools.
Threat Detection & Response
What happens when the SOC finds something.
Where your plan includes Microsoft 365 or Google Workspace account monitoring, those alerts go through the same SOC review, and the SOC brings Cyber Shift in to work the fix.
Something gets flagged.
EDR on a computer or server, or monitoring on a Microsoft 365 or Google Workspace account, flags activity that looks like an attack.
The SOC reviews it.
Our SOC partner reviews the alert to sort a real threat from noise. SOC monitoring is available 24/7/365.
The SOC can isolate the device.
If the threat is real and on a computer or server, the SOC is pre-approved to cut that device off the network and begin partial or full cleanup. It doesn't have to wait for anyone's approval to do that.
Cyber Shift reviews.
The SOC contacts Cyber Shift. The device stays isolated until our team has reviewed what happened.
We finish it together.
Cyber Shift and the SOC finish the remediation together.
If it's bigger than one device.
Incident response is scoped and billed separately from monitoring. Cyber Shift works with your insurance agency to gather forensic data, begins restoring your systems and follows the incident response plan outline you approved, where one is in place.
Plans and Add-ons
What's included, and what's an add-on.
What every managed plan includes, what depends on your plan, what's separate and what's excluded.
In every managed plan
Managed EDR/MDR on computers and servers; 24/7/365 SOC monitoring, with pre-approved device isolation and cleanup; managed antivirus; patching, third-party application updates and device-health monitoring by Cyber Shift; device encryption, which is standard.
Depending on your plan
Microsoft 365 or Google Workspace account monitoring and hardening; DNS filtering that blocks known malicious sites; spam and phishing filtering; security awareness training by email with monthly phishing simulations; backups, with restores tested daily by automation and monthly by our team.
Add-on, or part of our most complete plan
Central log collection and correlation (SIEM).
Separate response work
Incident response is scoped and billed separately from monitoring.
Not covered
Network equipment like firewalls, switches and Wi-Fi isn't part of SOC monitoring, and devices or accounts outside your agreement aren't monitored.
Your proposal lists exactly what's covered for your business. Co-managed agreements set their own security scope.
No security service can promise you'll never be breached. Isolation limits what a compromised device can reach while the problem is worked on. It can't undo what happened before the alert. Monitoring doesn't replace backups, multi-factor sign-in or employee training, and devices and accounts outside your agreement aren't monitored.
Your Local Team
Security guidance from North Canton.
Start with your business, its locations and its priorities.
SOC monitoring is available 24/7/365. It covers computers, servers and, depending on your plan, Microsoft 365 or Google Workspace accounts. Network equipment isn't part of it.
Related Services
Connected services
The planning and recovery work that monitoring doesn't cover.
Incident Response Planning
Prepare for a cybersecurity incident with clear contacts, responsibilities and recovery priorities. Discuss incident response planning with Cyber Shift.
Data Protection & Recovery
Tested backup and disaster recovery from Cyber Shift Technologies. Cloud, local, and hybrid backups for Northeast Ohio businesses.
Cybersecurity Risk Assessment
Understand security gaps and prioritize improvements with a cybersecurity risk assessment from Cyber Shift Technologies in North Canton.
Before You Start
Threat Detection & Response
Straight answers about monitoring, isolation, cost and what isn't covered.
Is SOC monitoring really 24/7?
Yes. Support and SOC monitoring are available 24/7/365, including nights, weekends and holidays. Our North Canton office is staffed Monday through Friday, 7 AM to 5 PM Eastern. Because device isolation is pre-approved, the SOC doesn't have to wait for office hours to cut off a computer or server it finds a real threat on.
Can a computer be cut off the network without asking us first?
Yes. When the SOC finds a real threat on a computer or server, it's pre-approved to isolate that device from the network and begin cleanup without waiting for approval. The device stays isolated until Cyber Shift reviews it. Then Cyber Shift and the SOC finish the remediation together.
What happens if it's a bigger incident?
Incident response is scoped and billed separately from monitoring. Cyber Shift works with your insurance agency to gather forensic data, begins restoring your systems and follows the incident response plan outline you approved, where one is in place. If you don't have a plan yet, incident response planning is the place to start.
Do we need a SIEM?
Not every business does. A SIEM collects security records from many systems into one place and keeps a history to investigate. It stops nothing by itself. It matters most when an insurer, a customer or an auditor asks for log records. With Cyber Shift, central log collection is an add-on or part of a fuller plan.
How is an MSP different from an MSSP?
A managed service provider (MSP) runs your day-to-day IT: devices, accounts, networks and support. A managed security service provider (MSSP) focuses on security operations, like 24/7 monitoring and threat response. Some businesses use one of each; others use one partner who brings both together. What matters is that someone is responsible for every step, from the alert to the cleanup.
Do we need this if we already have antivirus?
Antivirus looks for known bad files on one machine. EDR watches for behavior that looks like an attack, even when no known bad file is involved, and the SOC reviews what it flags. SOC monitoring is available 24/7/365. Every Cyber Shift managed plan includes managed EDR/MDR on computers and servers, alongside managed antivirus.
Does SOC monitoring cover our firewall and Wi-Fi?
No. SOC monitoring covers computers, servers and, depending on your plan, Microsoft 365 or Google Workspace accounts. Firewalls, switches and Wi-Fi equipment aren't part of it, and neither are devices or accounts outside your agreement. Networking & Wi-Fi explains how network equipment is handled.
What does it cost?
It depends on how many computers, servers and accounts are covered and which layers your plan includes. Managed EDR/MDR and SOC monitoring come with every managed plan. SIEM is an add-on or part of a fuller plan, and incident response is scoped and billed separately from monitoring. Book a 30-minute call and we'll put the scope in writing.
Not ready to talk? Take the Business Cybersecurity Checkup.
LET'S MAKE ROOM FOR WHAT'S NEXT
Find out who's watching your systems tonight.
Book a 30-minute call. Bring your current security setup, and we'll walk through what's covered and what isn't. The call is free, with no obligation.
Book a 30-Minute CallStart with the IT checklistA USEFUL FIRST CONVERSATION
Talk with our team
330-353-8420Reviewed by John Wheeler, President / Founder