Around the clock, we watch your systems.
Security monitoring from a 24/7 SOC, incident response, penetration tests and red team exercises by our own testers, and a fractional CISO on call for the security and compliance advisory most in-house teams can't staff full-time. Only people in the EU see your logs. For what you run with us, or elsewhere.
Free, 60 minutes
Written diagnosis in a week
An engineer on the call
An alert in the night, and who does what.
One example, step by step: what our SOC does, and what stays with you.
| 01 Detected Saturday, 03:12 | 02 Checked | 03 Contained | 04 Called | 05 Written up | |
|---|---|---|---|---|---|
| Our SOC | We see a login to an admin account on one of your servers, from an address your team has never used, then a change to a system file. | An analyst checks it against past logins and the file’s history, and finds nothing that explains it. | We block the address and disable the account, as far as your contract allows. | We call the contact you named. | A written report: what happened, how far it got and what to change. |
| Your team | Nothing for your team at this step | Nothing for your team at this step | Nothing for your team at this step | You decide the next steps with us. | Whether it must be reported to an authority is your decision, and the filing is yours. Our report is evidence you can use. |
An example incident
01 Detected Saturday, 03:12
- Our SOC
- We see a login to an admin account on one of your servers, from an address your team has never used, then a change to a system file.
02 Checked
- Our SOC
- An analyst checks it against past logins and the file’s history, and finds nothing that explains it.
03 Contained
- Our SOC
- We block the address and disable the account, as far as your contract allows.
04 Called
- Our SOC
- We call the contact you named.
- Your team
- You decide the next steps with us.
05 Written up
- Our SOC
- A written report: what happened, how far it got and what to change.
- Your team
- Whether it must be reported to an authority is your decision, and the filing is yours. Our report is evidence you can use.
If your contract gives us access, we make the changes the report names; if not, we take them to the contacts you set. How quickly we respond is set in your contract, and we do not publish a response time.
What we watch
Security monitoring from a 24/7 SOC, with a SIEM for your logs and XDR on the servers, endpoints, cloud and containers you choose:
- Log analysis and threat detection
- File integrity monitoring
- Vulnerability detection against known CVEs
- Configuration checks against security benchmarks
Not the monitoring in our managed services, which checks that your systems are running.
Where our SOC keeps your logs
In our datacenters. Retention is set with you, typically 90 days, shorter or longer as your sector requires. Only people in the EU see your logs.
Running your own SOC?
We can cover its nights, weekends and holidays, write detections you keep, test them with your analysts, and back your team with an incident-response retainer.
Help for your own SOC
The SOC is an ongoing service, and the response in the example is part of it: your contract sets what we watch and how far we act. It starts with the discovery call. Request it
Help for the SOC you already run.
More hours, better detections, and the work around them. Your SOC stays yours; we add the parts you choose.
Nights, weekends and holidays
Your team covers the working day. Our 24/7 SOC covers the rest, in the tools you already run, and hands back each morning with what came in and what we did.
Detections you keep
We write detections for the SIEM and XDR you already run, test that each one fires, and hand them over with notes on how to triage them. They stay yours when the contract ends.
A health check of your SIEM
We review which rules fire most and why, then tune them with you. The exceptions stay narrow, so the noise goes down without opening blind spots.
Purple teaming
Our testers run attacker techniques one at a time while your analysts watch. Each is marked caught, only logged or missed, and where a detection can close a miss, we write it with your analysts in the same session.
Threat hunting
Our analysts search your data for attacks your rules would miss, starting from a stated hypothesis. Each hunt ends with a report and new detections for what it found.
Playbooks and automation
The playbooks your analysts follow for the incidents you see most, the steps that never change automated in your platform, and a walk-through for your team.
Compromise assessment
If you need to know whether someone is already inside, we search your systems for traces of a past compromise, as far back as the period you choose, and report what we found and exactly what we checked.
An incident-response retainer
For when an incident is bigger than your team, with response times set in your contract.
SOC maturity assessment
How your SOC works today, from staffing and processes to tools and the services it delivers, scored, with a plan for the year ahead. Where we already run part of it, the report says so.
Measures and reporting
What your SOC should measure, agreed with you, and a monthly report your managers can read.
Design, build and handover
Building a SOC? We design it with you, run it from ours while you hire, and hand it over with its detections, playbooks and documentation.
Your SOC platform, hosted with us
Your SIEM and log archive on our Cloud or Bare Metal in Madrid, Munich, Helsinki or Amsterdam, with a provider that has no US parent.
When we work in your platform, your logs stay where your platform keeps them.
Take one, or several. Each is scoped with you after the discovery call. Request it
A test ends in findings you can act on.
This is the shape of the report our own testers write: for each finding, how serious it is, what an attacker could do with it, and the fix.
| Finding | Severity | What an attacker could do | The fix | After the retest |
|---|---|---|---|---|
| A VPN appliance missing a published security patch | Critical | Reach your internal network. We showed it could, inside the agreed scope. | Apply the vendor’s patch, and check the appliance for signs of earlier compromise | Fixed |
| A storage bucket anyone can read | High | Download the files in it, customer exports included | Make it private and replace its shared links | Fixed |
| An admin login on your website with no second factor | High | Guess a password and take over the website | A second factor, and the login open only to your own addresses | Fixed |
| The same local admin password on every laptop | Medium | Move from one compromised laptop to all of them | A unique password per machine | Open: in progress |
| Old TLS versions still accepted by your mail server | Low | Little, today | Turn them off at the next change window | Accepted by you, on record |
Findings from an example test
A VPN appliance missing a published security patch
- Severity
- Critical
- What an attacker could do
- Reach your internal network. We showed it could, inside the agreed scope.
- The fix
- Apply the vendor’s patch, and check the appliance for signs of earlier compromise
- After the retest
- Fixed
A storage bucket anyone can read
- Severity
- High
- What an attacker could do
- Download the files in it, customer exports included
- The fix
- Make it private and replace its shared links
- After the retest
- Fixed
An admin login on your website with no second factor
- Severity
- High
- What an attacker could do
- Guess a password and take over the website
- The fix
- A second factor, and the login open only to your own addresses
- After the retest
- Fixed
The same local admin password on every laptop
- Severity
- Medium
- What an attacker could do
- Move from one compromised laptop to all of them
- The fix
- A unique password per machine
- After the retest
- Open: in progress
Old TLS versions still accepted by your mail server
- Severity
- Low
- What an attacker could do
- Little, today
- The fix
- Turn them off at the next change window
- After the retest
- Accepted by you, on record
What we test
- Penetration testsWe try what an attacker would, inside the agreed scope.
- Red team exercisesToward an objective you choose, the way an attacker would work toward it.
- Known vulnerabilitiesWhether the ones in your systems can be exploited, as far as your contract allows.
- Vulnerability scanningAutomated checks for known weaknesses. A scan is not a penetration test.
- Attack surface mappingWhat of yours can be reached from the internet. Once, or by subscription.
We test what you run, hosted with us or elsewhere, at your request, under a contract in which you say how far we may go.
Each test has its own scope, and a retest can be included. If your contract gives us access, we can make the fixes too. The first step is the discovery call. Request it
A CISO when you need one.
For the security and compliance advisory most in-house teams can't staff full-time.
What the CISO does
- A security roadmap
- The budget case for it
- The security policies you are missing
- Risk assessments and a risk register
- Reports to your management
- The cyber training NIS2 and DORA expect of your directors
- Security awareness training for your staff
- Help answering your customers’ security questionnaires, with the evidence for each answer
- An incident plan, and crisis exercises
- Support for your management during an incident
- Preparation for your audits, and attending them with you
- Security due diligence before an acquisition or investment
We advise and prepare; your management decides, and stays accountable. In an incident the decisions and the notifications stay yours, and your audits are done by someone independent of us.
The time you choose
Remote, or at your premises in Madrid, Munich, Helsinki or Amsterdam. For an assessment at your facilities, we travel to you.
- A block of hours
- A week a month
- An ongoing arrangement
- On call 24/7, as an option
Readiness
- NIS2
- DORA
- ISO 27001
- ENS
- GDPR
Where you stand, what is missing and what to fix first. Readiness is an assessment we make, not a promise that your system conforms, and not a certificate.
Start with a conversation.
Tell us what you run and what you need from us. Existing customers use the same form.
Free, 60 minutes
Written diagnosis in a week
An engineer on the call
Monitoring isn't the difference. Who reads your logs is.
Three ways to have your systems watched around the clock, compared.
Criterion
Building your own SOC
A US vendor’s managed service
DIVERSITY
Watched 24/7
If you staff the shifts
Yes
Yes
Who reads the logs
Your own people
Depends on the vendor
Only people in the EU
Where logs are kept
Where you choose
Usually the vendor’s cloud
In our datacenters
How long
You decide
Depends on the plan
Agreed, typically 90 days
Foreign legal orders
Depends on your host
US law reaches the vendor
None above us, for your logs
Hosted elsewhere
Wherever you run
Yes
Yes, or with us
Watched 24/7
- Building your own SOC
- If you staff the shifts
- A US vendor’s managed service
- Yes
- DIVERSITY
- Yes
Who reads the logs
- Building your own SOC
- Your own people
- A US vendor’s managed service
- Depends on the vendor
- DIVERSITY
- Only people in the EU
Where logs are kept
- Building your own SOC
- Where you choose
- A US vendor’s managed service
- Usually the vendor’s cloud
- DIVERSITY
- In our datacenters
How long
- Building your own SOC
- You decide
- A US vendor’s managed service
- Depends on the plan
- DIVERSITY
- Agreed, typically 90 days
Foreign legal orders
- Building your own SOC
- Depends on your host
- A US vendor’s managed service
- US law reaches the vendor
- DIVERSITY
- None above us, for your logs
Hosted elsewhere
- Building your own SOC
- Wherever you run
- A US vendor’s managed service
- Yes
- DIVERSITY
- Yes, or with us
Procurement questions of your own? Bring them to the discovery call. Request it
What they say about our work
“We needed a CISO’s judgement without a full-time hire. Ours works with us a week a month, remotely, and is on call the rest of the time.”
COO
Asset manager, Luxembourg
1 of 6
Things people ask before signing
What we get asked, with honest answers.
You host infrastructure. Can the same company watch and test us honestly?
What we watch and test is yours, not ours. Our own systems, routers, platform and products are tested and audited internally, regularly, as a separate job, and they are not open to tests by customers, except a test of your providers that your regulator requires, as agreed in your contract's DORA addendum. SecOps works on your infrastructure, services and applications, hosted with us or elsewhere, and only when you ask for it. And if your auditor or regulator requires a tester with no other role in your systems, we are not that tester for the systems we host or watch.
Do you run the SOC for us, or help our own team?
Either. We can watch your systems from our 24/7 SOC, or help a team that runs its own: cover for its nights, weekends and holidays, detections you keep, purple teaming, threat hunting, playbooks, an incident-response retainer and more.
Scan, penetration test or red team: what is the difference?
A vulnerability scan is automated: it checks the systems you point it at for known weaknesses, and it is not a penetration test. In a penetration test our own testers try what an attacker would, inside the agreed scope, and show what could be reached. A red team exercise is not bounded by a list of systems: it works toward one objective you choose, the way an attacker would, as far as your contract allows.
What does a test give us?
A written report of findings, ranked by severity, each with what an attacker could do with it and the fix. A retest can be included, to show which fixes worked. If your contract gives us access, we can make the fixes; if not, they go to the contacts you set.
How far do your testers go?
As far as your contract allows, and no further. It names what we may test and how far we may go, and it can only cover systems you are entitled to authorise. Within it, we also test whether known vulnerabilities in your systems can be exploited.
Can you help with NIS2, DORA or ISO 27001?
With readiness for NIS2, DORA, ISO 27001, ENS (Spain's national security framework) and GDPR: where you stand, what is missing and what to fix first. Readiness is an assessment we make, not a promise that your system conforms, and not a certificate.
What does the fractional CISO do?
Advice and preparation across your security work, without a full-time hire: a roadmap and the budget case for it, the policies you are missing, risk assessments, reports to your management, the training NIS2 and DORA expect of your directors, awareness training for your staff, help answering your customers’ security questionnaires, an incident plan and exercises, preparation for audits, and due diligence before an acquisition. We advise and prepare; your management decides.
What happens when you detect something at night?
The SOC runs 24/7, so the steps are the same. An analyst checks the alert, we act on the servers and endpoints we watch, as far as your contract allows, and we call the contact you named. How quickly each of those happens is set in your contract; we do not publish a response time.
Do we have to host with you?
No. We watch and test what you run with us, with another provider or on your own servers.
Is this the monitoring in our managed services?
No. The monitoring in our managed services checks that your systems are running. Security monitoring watches for someone attacking them, and it is a service of its own.
Who reports an incident to the authorities?
You do. Whether an incident must be reported is your decision, and the filing is yours. Our written report of what happened is evidence you can use.
Who does the work?
Our SecOps team. Our own testers run the tests, and only people in the EU see your logs.
How is it bought?
Per service. The SOC runs under a contract that sets what we watch and how far we act, and responding is part of it. An incident-response retainer can back a SOC of your own, with response times in your contract. Each test has its own scope, and a retest can be included. Attack surface mapping is once, or by subscription. Help for your own SOC is scoped item by item. We do not publish prices.
Can you help if we are under attack and not a customer?
Not as an emergency service: we do not take incident calls from organisations that are not our customers. Our incident response covers the systems our SOC watches, and the teams our retainer backs.
How much of a CISO’s time can we have?
A block of hours, a week a month, or an ongoing arrangement, with a 24/7 on-call option. Day to day they work remotely, or at your premises in Madrid, Munich, Helsinki or Amsterdam. For an assessment at your facilities, we travel to you.
How do we start?
With the discovery call, and it is free: 60 minutes, an engineer rather than a salesperson, and a written diagnosis inside a week. The call is a conversation, not a security assessment, a test, a scan or incident response. Already a customer? Same call, same form.
Does NIS2 or DORA require a European security provider?
No. Neither requires your data, or your logs, to stay in the EU. Both make you manage the risk your suppliers bring, and that includes whoever watches your systems.
Who sees our logs, and where are they kept?
For the SOC we run for you, only people in the EU see them. They are stored in our datacenters, and retention is set with you: typically 90 days, shorter or longer as your sector requires. When we work in your own platform, your logs stay where it keeps them.
Can an order from outside the EU make you hand our logs over?
For the logs we keep: DIVERSITY is a European company with no parent company, US or otherwise, so there is no entity above us for an order from outside the EU to be served on. That is a structural answer rather than a policy one.
You might also want
IT Consulting for architecture reviews and the engineers to act on them; Cloud and Bare Metal to run your workloads.
Shall we talk?
A free 60-minute call, and a written diagnosis inside a week.
Write or call and you'll get an engineer, not a ticket bot.