24/7 monitoring
The iTDC never sleeps, and a Security Analyst is always reachable when a call needs a person.
Detection & Response
Managed Detection and Response. Every alert investigated, around the clock.
Your team cannot watch everything at 3am. The iTDC can. AI investigates every alert, Security Analysts decide what matters, and a Human-In-Loop gate stands in front of every consequential action.
What MDR really means
Monitoring tells you something happened. Detection and response does something about it. We are measured by threats contained, not alerts forwarded to your inbox.
The Intelligent Threat Defense Centre is the operating core of our Autonomous SOC. AI reads and investigates every alert at Machine speed, Security Analysts make the calls that carry weight, and a person approves anything that touches your environment. You get the speed of automation with the accountability of a named human on the decision.
A triage run
From alert to contained, with a person at the gate
This is the path every alert takes through the iTDC. AI does the heavy lifting, a Security Analyst owns the decision, and the consequential action waits for human approval.
1
Alert lands
MachineA signal arrives from endpoint, identity, cloud, network, or email telemetry and enters the queue immediately.
2
AI investigates
MachineThe iTDC enriches the alert, correlates it across every other signal, and drafts a verdict with the evidence behind it.
3
Analyst decides
HumanA Security Analyst reviews the AI's work and makes the call: dismiss, watch, or respond. Judgment stays human.
4
Human-In-Loop gate
HumanAny consequential action, isolating a host or revoking a session, is approved by a named person before it runs.
5
Contained and recorded
EvidenceThe threat is contained and the full timeline is sealed for review, audit, and the next cycle of tuning.
What we watch
One SOC across your whole estate
The iTDC ingests telemetry from everywhere your risk lives, so a threat that crosses domains is still seen as one story.
Endpoint
Servers, laptops, and workloads under continuous watch.
Identity
Human, Machine, and Agent access and privilege.
Cloud
Control plane, workloads, and runtime activity.
Email & network
The doors attackers knock on first.
What you get
Detection and response, run as a service
Investigated, not forwarded
Every alert gets a verdict with evidence, so you receive findings rather than a longer queue.
Human-In-Loop response
A named Analyst approves consequential actions. We never claim autonomous containment.
Threat hunting
Proactive hunts for what the alerts miss, feeding new detections back into the loop.
Sealed evidence
Every detection and action carries a timeline, ready for audit and post-incident review.
Works with your stack
We build on the SIEM, EDR, and cloud logs you already run, adding the operating layer on top.
Part of the loop
Where MDR sits in VIGILE
Run and learn
Implement the watch, Learn from every case
ImplementManaged Detection and ResponseLearn
MDR is the Implement and Learn motions of VIGILE in continuous operation. The iTDC runs the watch, and every case sharpens the detections for the next one.
See the Autonomous SOC ›FAQ
Top 10 questions, frequently asked
A SIEM collects and alerts. MDR investigates and responds. We run the iTDC and the Security Analysts on top of your telemetry, so you receive contained threats and clear findings rather than a dashboard of alerts to triage yourself.
No. AI investigates and prepares the response, but a named Security Analyst approves any consequential action through a Human-In-Loop gate. We never claim autonomous containment. Speed is the Machine's job, the decision is a person's.
No. We build on the SIEM, EDR, and cloud logging you already have, adding the iTDC and Analysts as the operating layer. The aim is to make your existing investment work harder, not to start over.
The iTDC contains it through the Human-In-Loop gate and, where the situation calls for it, our Incident Response team steps in for full containment, eradication, and recovery. The handoff is clean because it is the same operating core.
Telemetry connections and detection tuning typically run a few weeks, with the iTDC taking first watch on the highest-value sources early rather than waiting for full coverage.
Threats contained, cases investigated, detections tuned, and the MTTD and MTTR trend against your targets, written for leadership with the evidence behind each number.
Security Analysts own decisions and Human-In-Loop approvals; Principal Engineers tune detections and lead complex investigations. The work is judgment, supported by AI doing the volume.
The whole estate: endpoint, identity, cloud control plane, email, network, and SaaS audit logs all feed the same iTDC, so attacks that cross domains are seen as one story.
Hunts run on a regular cadence alongside the alert queue, looking for what has not tripped a rule yet. Every confirmed finding becomes a new detection.
By telemetry volume, integrations, and coverage hours. Most engagements begin with a SOC assessment to baseline the current state, then move to a managed retainer.
Related work
Solution
Autonomous SOC
The full operating model behind the iTDC and Human-In-Loop response.
Learn more ›ServiceIncident Response
When a detection becomes a real incident, the team that takes it from here.
Learn more ›ServiceCloud Detection and Response
The live cloud layer that feeds the same SOC.
Learn more ›Put the iTDC on watch
Book a session with a Principal Engineer. We connect to your telemetry, tune the detections, and start investigating every alert.