Central security monitoring and incident management for IT and OT infrastructures — around the clock. Our analysts detect, validate and respond to threats in your environment so your team can focus on the business. Vendor-independent, ISO 27001-aligned, with data residency you control.
Central security monitoring and incident management for IT and OT infrastructures — around the clock. Our analysts detect, validate and respond to threats in your environment so your team can focus on the business. Vendor-independent, ISO 27001-aligned, with data residency you control.
Real-time detection and correlation of security events
Alert validation and prioritisation by experienced SOC analysts
Incident analysis, escalation and SLA-based response
Modern SIEM and threat-intelligence technologies
Regular reporting and continuous security improvement
Six managed capabilities plugging directly into your SOC environment — each vendor-validated, MITRE-mapped, and operated by our analysts around the clock.
24/7 endpoint monitoring with automated detection and isolation of compromised systems, plus threat hunting mapped to MITRE ATT&CK.
Microsoft Defender · SentinelOne · CrowdStrike
AI-driven analysis of network traffic that surfaces lateral movement, zero-day activity and command-and-control — including OT/ICS protocols.
Passive · OT/ICS: Modbus, S7, OPC-UA
Continuous, risk-based scanning correlated by SOC analysts so you fix what actually matters, in the right order.
Qualys · Tenable · CVSS / EPSS
Detection of stolen credentials, leaked data and exposed domains across the dark web, with actionable alerts and optional executive monitoring.
Cyble Threat Intelligence Platform
Centralised control of access to critical systems, with session recording, just-in-time access and MFA — closing the door on insider threats and privilege misuse.
Session recording · JIT · MFA
AI-based detection and blocking before encryption occurs, with automated file rollback and self-healing for affected systems.
Halcyon-powered · NIS2 / DORA / TISAX
When an incident lands, speed is everything. Our response capabilities are designed to contain, analyse and recover — measured in minutes, not hours.
Aligned with NIST & ISO 27035
24/7 access to experienced IR specialists for rapid assessment, containment, forensic analysis and recovery — with documented lessons learned.
Containment in minutes, not hours
Playbook-driven immediate actions for P1/P2 incidents — endpoint isolation, account lockout and firewall activation — seamlessly integrated into the Managed SOC.
No single vendor owns your security. Choose the stack that fits your budget, your existing estate and your data-residency requirements — we operate them all.
All models run on infrastructure managed by Ciberseg, with full EU data residency and zero dependency on a single technology vendor.
Three tiers designed for the scale you are today and the ambition you have tomorrow. All tiers include 24×7 shift operations and a dedicated Security Delivery Manager.
Entry
Popular
Recommended
Scale
Enterprise
All prices are net and exclude VAT. The AEGYS Pulse NDR sensor is supplied as a loan unit and returned at the end of the contract. Add-on prices scale with the agreed user and asset counts. Quotations are subject to a setup fee based on effort.
Full pricing, add-ons and SLAOur SLAs are contractually binding. Every priority class has a defined response window and an escalation path — no ambiguity, no excuses.
| SLA criterion | Starter | Business | Professional | Professional+ | Enterprise |
|---|---|---|---|---|---|
| AvailabilityMeasured per calendar month | 99.0 % | 99.5 % | 99.9 % | 99.9 % | 99.99 % |
| First response P1Standard per package. The First Response add-on brings this to under 30 minutes from Professional+ | 6 h | 4 h | 4 h | 2 h | 2 h |
| Escalation to customer P1Until reseller notification | Next business day | 8 h | 4 h | 2 h | 2 h |
| Reporting cadencePDF by e-mail | Monthly | Monthly | Weekly | Weekly | Weekly |
| SOC operating hoursMon–Fri 08:00–17:00, or around the clock | 8×5 | 8×5 | 8×5 | 24×5 | 24×7 |
| Data storageGDPR-compliant, no third country | Germany | Germany | Germany | Germany | Germany |
| GDPR data processing agreementArticle 28 GDPR | Included | Included | Included | Included | Included |
| NIS2 documentationEvidence-ready for authorities and audits | Baseline | Checklist | Full | Full | Full |
| SLA penalty (max.)On a demonstrated SLA breach, capped at 30 % of the monthly charge | 5 %/h, max. 30 % | 5 %/h, max. 30 % | 5 %/h, max. 30 % | 5 %/h, max. 30 % | 5 %/h, max. 30 % |
| Contract termTerminable quarterly; renews automatically by a further year unless cancelled one month before expiry | 12 months | 12 months | 12 months | 12 months | 12 months |
Above 2,000 end users the SLA is negotiated individually. All prices are net and exclude VAT.
From initial scoping to continuous operations, every engagement follows a clear, repeatable lifecycle — so you know exactly where you are at every stage.
Define assets, threat model and rules of engagement together with your team.
Automated scanning and manual reconnaissance to map the real attack surface.
Controlled attack simulation to confirm which vulnerabilities are genuinely exploitable.
Prioritised findings with CVSS scores, business impact and clear remediation steps.
Guided fix support and re-testing to confirm every issue is closed for good.
Our onboarding team can have you live in the SOC within days. No long procurement cycles, no complex setup. Book a consultation and we will scope your environment the same day.
Always watching. Always protecting. Always ahead.