Français
Nederlands
DeutschSOC as a Service: 24/7 monitoring and response
An alert at 3 a.m. must be read, triaged and handled before the attack spreads. Our security operations centre (SOC) does this for you, day and night. It is designed for SMEs, mid-sized companies, public services, municipalities, public social welfare centres and other organisations without a round-the-clock security team. It is operated in France, by analysts based in France, and incident response is included.
Who it is for
- SMEs and mid-sized companies without a security team available day and night.
- Municipalities, public social welfare centres (CPAS/OCMW), intermunicipal bodies and other public organisations protecting sensitive data with limited resources.
- Entities subject to NIS2, which must detect a significant incident and alert the CCB within 24 hours.
- Organisations whose IT provider does not monitor alerts at night and at weekends.
What the service includes
24/7 monitoring
Analysts based in France triage and qualify every alert, day and night, and call you when a decision is yours to make.
Workstations, servers and email
Detection on workstations, servers, email and user accounts, with Microsoft Defender or SentinelOne. If you have no EDR, licences are provided.
Centralised logs
System, firewall and online service logs are cross-checked to spot what a single tool misses: a suspicious forwarding rule, a VPN sign-in from an unusual country, a new administrator account.
Incident response included
If an attack is confirmed, the response team steps in, with no quote to sign in the middle of a crisis and no per-incident billing.
Monthly report
Alerts handled, incidents qualified and remediation actions, which we review with you.
Sovereign operation
A SOC operated in France by French teams, with no offshore subcontracting. The operator is certified to ISO/IEC 27001 and is a member of InterCERT France.
How it is set up
The service builds on your tools and your IT provider. Cyber Praxis scopes the project, follows up the service and remains your point of contact.
Scoping
Inventory of your workstations, servers, online services and security tools, and of your obligations: NIS2, insurance, customer requirements.
Deployment
Reuse or installation of the EDR, log onboarding and escalation paths agreed with your IT provider.
Monitoring
The SOC handles alerts continuously; actions on your systems are passed to your provider or your teams.
Follow-up
Monthly report, regular review with Cyber Praxis and adjustments as your systems change.
Frequently asked questions
How does it differ from an antivirus or an EDR on its own?
An EDR detects and blocks, but someone has to read its alerts, at night and at weekends too, and decide what to do. The SOC provides that human monitoring, cross-checks events from several sources and triggers the response.
Do we need to change our tools?
Not necessarily. If you already use Microsoft Defender or SentinelOne, the SOC builds on them; otherwise, licences are provided. For another EDR, a migration is considered during scoping.
What happens during an attack?
The SOC contains the threat where possible, for example by isolating a workstation, alerts you and brings in the incident response team included in the contract. If the incident must be reported, we help you prepare the early warning to the CCB and, where applicable, the notification to the data protection authority.
Where is the data processed?
The SOC is operated in France, by analysts based in France. Where the logs are hosted and the list of sub-processors are set out in the contract and in the data processing agreement required by the GDPR.
How does it differ from VEEZO?
VEEZO monitors the network without agents and continuously checks that your defences work. The SOC monitors workstations, servers, email and accounts, with analysts on duty day and night. The two complement each other; we help you choose according to your risks and budget.
How much does the service cost?
The price depends in particular on the number of workstations and servers and on the sources to be monitored. It is set in a written proposal after scoping, with incident response included.