Attackers do not work office hours. A compromise at 02:40 on a Saturday that is triaged Monday morning is not a monitored environment — it is a logged one. The gap between those two words is where most incidents become expensive.
Four questions worth asking
- Who looks at an alert at 03:00 — a person, or a rule that files a ticket?
- Can you isolate a host without waiting for my approval, and under what conditions?
- What is your median time from detection to containment, not to notification?
- Do you hunt for persistence after the alert closes, or only respond to what fired?
Detection is the easy half
Modern endpoint tooling detects plenty. The hard part is deciding, quickly, which of the day's alerts is the one that matters, and then acting on it before an attacker establishes footholds you will be finding for weeks. That decision needs analysts, not licences.
What we do
CyberFence runs managed detection and response on a Huntress backbone with human triage around the clock, containment authority agreed in advance, and a written account of what happened after every incident. If a provider cannot give you the last item, ask why.