Managed security service providers

Armis Managed Threat Services investigates Centrix findings, hunts for threats and tunes detection policies.

You still own Containment, remediation, connected controls and the broader SOC workflow

CGI Protective Monitoring correlates logs, validates suspicious events and sends incident tickets with containment or eradication advice.

You still own Containment and recovery, Incident-response staffing

National Telecom Thailand's Cyber Security Monitoring service analyzes suspicious events and provides prioritized warnings and advice.

You still own Containment and remediation, An available incident contact

NuSummit's NSE Market-SOC monitors security events and manages incidents with remediation guidance for SEBI-regulated entities.

You still own Remediation execution, Regulatory decisions

Huntress analysts investigate endpoint, identity and SIEM alerts, then perform supported containment within enabled modules and permissions.

You still own Deployment, permissions, manual remediation, recovery and client communication

T-Systems investigates endpoint threats and executes host, process and file containment through its SOC.

You still own Action permissions, business decisions and wider recovery

BT operates Sentinel detections, implements requested content changes and investigates incidents while your team retains response.

You still own Content decisions, Microsoft prerequisites, log sources, containment and recovery

Clearnetwork manages AlienVault USM, investigates detected threats and emails response guidance.

You still own Containment and recovery, Reseller handoffs if applicable

Deepwatch co-manages monitoring, investigations, detection tuning and approved response workflows across your existing SIEM and security tools.

You still own Connected telemetry, response permissions, IT remediation and recovery

Fujitsu operates customer-tenant Sentinel, investigates alerts and coordinates the handoff to resolver teams.

You still own Azure ownership and remediation beyond the agreed handoff

LRQA's managed-SIEM SOC service operates detections and investigates incidents in the agreed logging environment.

You still own Estate changes, Response authority and recovery

Novacoast operates the buyer's SIEM, maintains detections and investigates alerts before escalation.

You still own Tenant and source systems, Agreed response duties, An available support contact

Optiv manages Google Security Operations health, log configuration and detection rules, then investigates alerts and recommends mitigation.

You still own Source systems and access, Containment and recovery

Telefónica Tech operates the SIEM, maintains detections and investigates alerts before the agreed response handoff.

You still own Monitoring priorities and response beyond the agreed procedures

Verizon investigates SIEM incidents and implements agreed detection-content changes. Your team owns platform hosting, source health and containment.

You still own SIEM hosting, source health, change approval, containment and recovery

SecurityHQ runs contracted SOC operations, investigating threats and coordinating containment through agreed playbooks and supported security controls.

You still own Source coverage, response approvals, internal remediation and recovery