24/7 Managed Detection and Response, With Incident Response Included

What's included: MDR, SOC, SIEM and incident response in one managed service

Managed detection and response (MDR) pairs security tools with people who watch them around the clock. With BTI, the pieces come as one managed service:

• 24/7 NOC/SOC monitoring. Analysts triage, investigate and escalate alerts day and night.
• SentinelOne endpoint detection and response, monitored 24/7. MDR requires the SentinelOne tier of Endpoint Protection on the covered workstations and servers.
• Managed SIEM. Logs from endpoints, Microsoft 365 and identity, and the network devices BTI manages are centralized and correlated, with optional 1-year log retention.
• Incident response, included for managed security clients. Containment, remediation and recovery support, remote and on site, as defined in your service agreement.
• A written incident response plan and WISP for every managed security client, so everyone knows their role before something happens.

Because the same company runs your IT, network and security, the people investigating an alert already know your environment. That's what managed cybersecurity services built into your IT strategy looks like in practice.

How our 24/7 NOC/SOC works (detect, investigate, contain, report)

1. Detect. Telemetry from your endpoints, Microsoft 365, identity and network flows to our 24/7 NOC/SOC.
2. Investigate. Analysts confirm whether an alert is real, how far it reaches and what's at risk.
3. Contain. Pre-approved actions, as listed in your IR plan, such as isolating a compromised device, disabling an account or blocking traffic at your Meraki MX firewalls, following the playbook in your IR plan.
4. Report and improve. You get a documented timeline of what happened and what changed. The lessons feed into patch and vulnerability management, policies and your WISP.

Endpoint protection tiers: Bitdefender baseline, SentinelOne recommended

Endpoint Protection comes in two tiers. Baseline: Bitdefender, managed by BTI, without SOC coverage. Recommended: SentinelOne, monitored by BTI's 24/7 NOC/SOC. MDR requires the SentinelOne tier.

• Baseline: Bitdefender. Business-grade endpoint protection managed by BTI, without SOC coverage. Not eligible for MDR.
• Recommended, and required for MDR: SentinelOne with our 24/7 NOC/SOC. Endpoint detection and response watched around the clock, with network isolation that cuts a compromised endpoint off from the network while keeping a secure management channel to the console open for remediation, and 1-click rollback on Windows endpoints that uses Windows Volume Shadow Copies to restore encrypted, deleted or altered files. Rollback is fast remediation for a compromised endpoint, not a replacement for immutable backup and disaster recovery.

Either tier is priced per endpoint as part of itemized managed IT pricing. See also Cisco XDR for organizations standardizing on Cisco.

Managed SIEM with optional 1-year log retention

A SIEM collects and correlates security logs so patterns surface that no single tool would show. BTI's managed SIEM brings in events from endpoints, Microsoft 365 and Entra ID sign-ins, and network devices, and our 24/7 NOC/SOC works the alerts. Optional 1-year log retention supports investigations, audits and insurer requests for evidence.

Incident response, included for managed security clients

For managed security clients, incident response is included in BTI managed security, as defined in your service agreement. You don't need to buy a separate retainer or wait for a new contract when something goes wrong.

• Remote response, wherever BTI supports you: containment, account resets, malicious email cleanup, device isolation and recovery support.
• On site, by BTI staff, in Los Angeles and Southern California, Chicagoland and Phoenix: isolating systems, preserving evidence, rebuilding devices and supporting recovery alongside the on-site IT support team that already knows your sites.
• Elsewhere in the U.S.: BTI coordinates on-site help through partners.
• Recovery support: restores from the backup and disaster recovery systems we manage, including Datto, checked before systems reconnect.
• Documentation: incidents are documented with a timeline and report for leadership, your carrier and your auditors.

Every managed security client gets a written IR plan and a WISP

Every BTI managed security client gets a written WISP and incident response plan, built from BTI's standardized framework based on ISO 27001 and tailored to your organization, as defined in your service agreement. Tailoring covers:

• your industry and size
• your cyber insurance requirements
• your contractual requirements, such as customer and vendor security terms
• your liability exposure
• best practices aligned with ISO 27001

The IR plan spells out who does what, how decisions get made and who calls whom. The WISP documents your safeguards, risk assessments, vendor oversight and training. BTI reviews and updates both on the schedule in your service agreement and when your systems, staff or obligations change. Learn more about WISPs, IR plans and governance and compliance management.

Cyber insurance: we work with your carrier, we don't sell insurance

BTI doesn't sell insurance. We do work with your cyber insurance carrier proactively, so your coverage and your security program say the same thing:

• We review your carrier's requirements and questionnaires with you.
• We build those requirements into your WISP, IR plan, compliance policies and evidence controls.
• We keep the evidence your carrier may ask for: policies, training records, monitoring reports and test results.
• During an incident we coordinate with your carrier and the response team it designates, and we provide the technical documentation they request.

We can't promise coverage, pricing or claim outcomes. Our job is to make what you tell your carrier true and provable. More on cyber insurance readiness.

Forensics and coordination

Cyber carriers often appoint the forensics firm. BTI assists during incident response by preserving log evidence, isolating affected systems and working alongside carrier-appointed digital forensics and incident response (DFIR) specialists. When your carrier does not appoint a firm, BTI can perform the forensic investigation. Forensic scope follows your service agreement. BTI keeps restoration moving within the forensics team's guidance.

Tabletop exercises with your vCISO

A plan only works if people have practiced it. Your vCISO runs tabletop exercises with your leadership and IT team: we walk through a realistic scenario, test decisions and contact paths, and update the IR plan with what we learn.

What the SOC monitors, and where physical security fits (converged correlation)

Our 24/7 NOC/SOC monitors managed endpoints and servers, Microsoft 365 and identity, and the network and security devices we manage. VoIP phones, cameras, door controllers and sensors don't run NOC/SOC agents. They're protected through network segmentation, firewall policy and device management. Where integrated, selected device events (such as syslog, telemetry and authentication events) can be forwarded to the SIEM and correlated with network and identity activity.

Physical security works alongside it as a separate converged layer. Where integrated, selected events from access control and video systems, such as a forced door, a tampered camera or an offline recorder, can be forwarded to the SIEM and correlated with cyber activity, which helps surface a combined physical and digital incident. See converged cyber and physical security and IoT and OT security.

Itemized, pay for what you need

There's no bundle you're forced into. Choose the endpoint tier, SIEM retention and governance services you need, priced line by line. See itemized managed IT pricing, or compare co-managed and fully managed models. Internal IT teams can keep control with co-managed IT support while BTI supplies the 24/7 NOC/SOC.

Related services by outcome

• Know where you stand: free cybersecurity assessment and pen test · independent testing and evidence with Cyber Liability Essentials and Cyber Watch
• Prevent: patch and vulnerability management under a Protection Level Agreement (PLA guide) · network security · Microsoft 365, Entra and Intune
• Govern and prove: vCISO and cybersecurity consulting · WISP, IR plans and GRC · compliance management
• Recover: backup and disaster recovery
• Converged: converged security
• Governed AI: AI security, governance and risk
• Industries: government · education · financial services · logistics · construction · critical infrastructure · nonprofits · parking and venues · healthcare
• Location: Los Angeles cybersecurity

Talk to BTI about 24/7 MDR, or get help with a suspected incident