Who does what
Provider
- Run contracted SOC monitoring and investigation 24/7
- Operate agreed SIEM and SOAR response workflows
- Hunt threats, report and coordinate incidents
Your team
- Maintain sources, context and customer-owned licenses
- Set containment permissions and approval boundaries
- Handle internal remediation, recovery and business decisions
Coverage
- Endpoints
- Network
- Cloud Workloads
- Identity & Access
- SaaS Applications
Details
Service scope
Best for Teams outsourcing daily SOC operations across supported SIEM and security controls
Managed SOC bundle
Run-the-SOC ownership requires the contracted managed SOC bundle. Risk, protection, DFIR, advisory and managed administration may be separate.
Containment permissions
Playbooks can block IPs, suspend users and isolate machines. Agree pre-approved actions, sensitive-system approvals and restoration responsibilities.
Price scope
G-Cloud prices are guidance by daily event volume. Final pricing depends on technical and commercial scope, including licenses and retention.
Full service analysis
SecurityHQ runs the contracted managed SOC, maintaining SIEM detections and investigating and containing threats through agreed playbooks. Your team retains source coverage, response approvals, internal remediation and recovery.
- Your team owns
- Keeping the agreed log sources, cloud accounts, endpoint agents and business context current
- Defining which containment actions can run automatically and which need approval
- Owning internal IT remediation, recovery, user communication and business-owner decisions
- Maintaining any customer-owned SIEM, EDR, cloud or identity licenses outside the quoted service
- Separating base SOC scope from risk, protection, DFIR, advisory and managed administration add-ons
Why run the SOC
The managed SIEM and SOC service includes ongoing platform administration, connector management, rule improvement, monitoring, investigation and agreed containment. That daily operational scope supports Run the SOC. Separate risk, protection and DFIR products are not assumed to be included.
Scope boundary
SecurityHQ sells multiple service families. The public profile covers managed SOC and managed security services, not every risk, protection, advisory, offensive security or DFIR service unless it is included in the buyer's quote.
Response boundary
Public material supports containment playbooks, automated blocking, user suspension and machine isolation. Buyers still need rules of engagement because sensitive actions, restoration and business decisions can require internal approval.
Pricing boundary
The AWS Marketplace listing is private-offer only. The G-Cloud 14 pricing document gives useful annual examples for Managed SIEM and SOC, but it says those prices are guidance and final pricing depends on technical and commercial scope.
Pricing & contract
£30,664.70 / year
5 GB/day The May 2024 G-Cloud example covers a 12-month, bring-your-own-license Sentinel service at 5 GB/day, with three connector types and containment automation. These are guidance prices subject to technical and commercial scoping. Confirm current licensing, ingestion, retention and onboarding costs.
May 2024 G-Cloud guidance: £30,664.70/year for 5 GB/day
- Billing
- Tiered, Custom
Tradeoffs & buying questions
Strengths
-
Managed SIEM administration and detection maintenance accompany incident investigation
-
Agreed containment playbooks, SOAR workflows and regional SOC coverage
-
Works with buyer tooling or SecurityHQ-managed technology, which helps buyers avoiding a full stack replacement
-
Available through AWS Marketplace private offers and G-Cloud procurement
Considerations
-
Buyers need a detailed scope because SecurityHQ's portfolio includes many separately scoped services
-
Pricing is quote-based outside public G-Cloud guidance examples
-
Review volume is small compared with larger managed security providers
-
Response permissions, source coverage and buyer remediation duties need a written scope
Ask before buying
- Which daily SOC tasks does SecurityHQ own versus notify or assign back to our team?
- Which containment playbooks can block IPs, suspend users or isolate machines without waiting for approval?
- Does the quote include SIEM management, SOAR playbooks, endpoint response, firewall or email administration, DFIR and log retention?
Customer feedback
Customers value
-
An August 2025 reviewer describes a smooth onboarding process and flexible communication
-
Another review excerpt values triage, custom rules and after-hours notification
Reported concerns
-
One reviewer reports slow document access and missed on-call notifications when procedures were not followed
-
Another wants more services for the price
Integrations
Platform / SIEM
- Microsoft Sentinel
- IBM QRadar
Cloud
- AWS
- Microsoft Azure
- Microsoft 365
1 more integrations
- Oracle Cloud
Other integrations
- SHQ Response
- IBM Resilient
- ITSM integration
Common questions
Does SecurityHQ run the SOC or just provide MDR?
This profile covers the managed SIEM and SOC service: daily platform administration, detection maintenance, monitoring, investigation and agreed containment. Additional risk, protection and DFIR services need separate scope.
Can SecurityHQ contain threats?
Yes, within agreed scope. Public service material describes containment playbooks and automated actions such as blocking malicious IPs, suspending rogue users and isolating infected machines. Buyers should confirm which actions are pre-approved.
Is SecurityHQ pricing public?
The provider published G-Cloud guidance in May 2024 for bring-your-own-license Sentinel packages. The 5 GB/day example is £30,664.70 per year for 12 months. Current pricing requires a scoped quote, and AWS Marketplace uses private offers.
Company details
- Headquarters
- London, United Kingdom
- Founded
- 2003
- SOC regions
- Europe / UK, APAC, Middle East, North America