Security monitoring and alerting that someone actually reads
Security tools produce plenty of warnings, and an unread alert protects nobody. We switch on the right alerts for Microsoft 365, your computers and your firewall, review them during business hours and escalate the critical ones straight away.
Security monitoring & alerting for small and medium businesses
Microsoft 365, endpoint protection and firewalls can all raise alerts about suspicious activity: a sign-in from another country, a new rule forwarding mail to an outside address, malware blocked on a laptop, a user suddenly downloading thousands of files. In many small offices these alerts are switched off, or they go to a mailbox belonging to someone who left two years ago. The signals that could have stopped an attack early were there; nobody saw them.
We route alerts to our team and tune them so the important ones are not buried in noise. That means setting sensible sign-in rules, blocking legacy sign-in methods, flagging risky behaviour such as mass deletions or new forwarding rules, and adjusting thresholds as we learn what is normal for your office. A staff member working from a bach in the Coromandel should not trigger an alarm each weekend; a sign-in from a data centre overseas at 3am should.
Our monitoring is honest about hours. Alerts are reviewed through the business day, with checks at the start of each morning for anything raised overnight. Critical alerts, such as a confirmed account compromise, are escalated as soon as they are seen. Automated protections, like blocking risky sign-ins or isolating an infected laptop, work around the clock without waiting for a person. You get a monthly summary of what was raised and what we did about it.
What's included
Microsoft 365 sign-in alerts
Unusual locations, impossible travel, repeated failed sign-ins and risky sign-ins flagged to our team rather than lost in an unread mailbox.
Mailbox rule checks
Alerts on new forwarding and inbox rules, a common sign that an attacker has taken over an account to watch for invoices.
Endpoint alerts
Warnings from the protection software on each computer reviewed, with infected devices isolated automatically where the tool supports it.
Firewall and network events
Blocked intrusion attempts, VPN sign-ins and configuration changes on your firewall logged and reviewed for anything unusual.
Business-hours review
Alerts checked through each working day, with a morning sweep of overnight activity so nothing waits until someone happens to look.
Critical escalation
Confirmed compromises and high-severity alerts escalated straight away to your nominated contact, with containment started as soon as they are seen.
Alert tuning
Thresholds and rules adjusted to your office's normal patterns, so genuine problems stand out from routine activity.
Monthly summary
A short report of what was raised, what was a false alarm and what action was taken, written for business owners.
Who is security monitoring and alerting for?
Monitoring is worth having if:
- You use Microsoft 365 and nobody reviews its security alerts
- A staff mailbox has been taken over before and you want earlier warning
- You handle payments or invoices that attackers might try to redirect
- Your insurer asks whether security alerts are monitored
- Staff work from home, client sites or overseas and sign in from many places
Not sure where to start?
Our free IT health check looks at your devices, accounts, backups, security and network. You get a short written report with what is working, what is at risk and a price to fix it. No obligation.
Book the health checkSecurity monitoring & alerting questions
Do you monitor around the clock?
No, and we won't pretend to. People review alerts during business hours, with a morning check of anything raised overnight, and critical alerts are escalated as soon as they are seen. Automated protections such as blocking risky sign-ins run continuously without waiting for us.
What happens out of hours?
Automated rules block or challenge the most obvious threats, such as sign-ins from high-risk sources. Anything needing human judgement is picked up in the morning review. If you need staffed overnight monitoring, we can discuss options for your situation.
Which Microsoft 365 licences do we need?
Basic sign-in and mailbox alerting works on most business plans. Features like risk-based sign-in policies and richer device alerts need Business Premium or equivalent add-ons. We check your licences and tell you what each level would add.
Will staff be locked out by mistake?
Occasionally a legitimate sign-in looks suspicious, such as someone travelling. We tune rules to keep that rare and can unblock genuine users quickly during business hours. A simple travel notice to us helps too.
Is monitoring included in your plans?
Antivirus and threat detection alerts are reviewed on every plan, and network and firewall monitoring is part of Managed and Complete. Microsoft 365 sign-in and mailbox alerting is scoped to your licences and quoted in writing first where it is not already in place.
Do we get to see the alerts?
Yes. You get the monthly summary, and we can copy critical alerts to a nominated person in your business. We avoid flooding you with every routine warning; that is our job to sort through.
How is this different from antivirus?
Antivirus protects one computer from known malware. Monitoring looks across accounts, devices and the network for patterns, such as a stolen password being used, that antivirus would never see.
Other ways we help
Managed IT
One monthly price per person for support, security, updates and backups. Your outsourced IT team.
Managed IT
IT support
Remote and onsite help when you need it, billed by the hour. No plan, no contract.
IT support
Cyber security
Practical protection against scams, ransomware and account takeover, set up and kept current.
Cyber security