What Happens When We Detect a Threat

"Monitoring and response" can sound vague. This guide walks through what actually happens when something suspicious shows up in your environment, from the first alert to the review afterward.

1. Detect

Your devices, accounts and email are protected and monitored by the tools we run for you. They flag things like:

• Software trying to run that isn't on the approved list
• A sign-in from an unusual place, or many failed sign-in attempts
• A phishing email that slipped past filtering and got reported by a staff member
• Behavior on a device that looks like ransomware or an attacker moving around

On Essentials, alerts are handled during business hours. On Plus and Complete, a 24/7 detection and response team watches around the clock, including nights and weekends.

2. Triage

Not every alert is an attack. We look at what triggered it, which person and device are involved, and whether it matches known attack patterns. Most alerts turn out to be harmless, and we close them without bothering you.

3. Contain

When something is real, the first goal is to stop it from spreading. Depending on what we find, that can mean:

• Isolating a device from the network so it can't reach other systems
• Disabling or resetting a compromised account and ending its active sessions
• Removing a malicious email from every inbox that received it
• Blocking a sender, website or file across the company

Incident triage and containment are included in the monthly fee.

4. Tell you what happened

We contact your named point of contact with a plain-language summary: what happened, who and what was affected, what we did, and anything we need from you, such as confirming whether a sign-in was really an employee traveling.

5. Recover

Once the threat is contained, we help get people working again. That can mean cleaning or rebuilding a device, restoring files, or resetting access. On Plus and Complete, Microsoft 365 backup means email and files can be restored to a point before the problem started.

If an incident is large, such as ransomware across many systems or a breach that needs forensic investigation, recovery and forensics are scoped as a project so the work can be planned and resourced properly.

6. Review and harden

After any real incident, we look at how it got in and what would stop it next time. That might be tightening a policy, adding a training topic, or closing an access gap. It also shows up in your quarterly security review.

What we need from you

• One or two named contacts we can reach quickly
• A heads-up when someone is traveling or starting new software, so we can tell normal from suspicious
• Quick answers when we ask "was this you?"

Next step

Want to see where your biggest gaps are before anything happens? Take the free security scorecard or read what Managed Security includes.