Alerts outside business hours
An alert on Friday evening lands in a mailbox that nobody reads over the weekend – by Monday, the attacker has moved further through the network.
Security Services
Managed SOC & MDR for Businesses
Detect attacks early. Respond the right way.
Attackers don’t keep business hours. With managed SOC & MDR, the security operations center of a specialized partner monitors your IT around the clock, assesses alerts, and contains incidents. We advise on the right scope, support rollout and operations, and, on request, test whether detection catches real attacks.
- Round-the-clock monitoring
- Rollout & integration
- Individual quote
Definition
What is a managed SOC – and what does MDR do?
A security operations center (SOC) is a company’s security control room: a team continuously monitors the IT environment, assesses alerts, and responds as soon as an attack is detected – based on data from tools such as SIEM and EDR/XDR. A managed SOC is a SOC delivered as a service: instead of building your own team to cover nights and weekends, you obtain this function from a specialized provider.
Managed detection & response (MDR) describes this kind of service with a focus on response: the SOC of a specialized partner monitors your environment around the clock. Analysts assess alerts across endpoints, identities, cloud services, email, and network, investigate incidents, and contain them. The SOC is operated by our MDR partner – Rootsektor advises you, prepares the quote together with the provider, and supports rollout and operations.
Why it matters: No protection is airtight. The earlier an attack is noticed, the less damage there usually is – for example, before perpetrators exfiltrate data or encrypt systems. Regulations also assume that detection works: the EU NIS2 Directive and the GDPR tie reporting obligations to short deadlines, and Section 31(2) of the BSI Act (BSIG) – the law governing Germany’s Federal Office for Information Security – requires operators of critical facilities to use attack detection systems.
Our role: As penetration testers, we know which vulnerabilities can actually be exploited and what traces an attack leaves behind. That’s why we help you align detection with the attack paths that are realistic in your environment. Our penetration tests remain vendor-independent: on request, we test whether detection and coverage hold up against a realistic attack, and we name any gaps openly.
How we work together
How the SOC and Rootsektor work together
With a managed SOC, two partners share the work: our MDR partner’s SOC monitors your environment around the clock, assesses alerts, investigates incidents, and contains them. We make sure the service fits your organization and clarify with you which systems are covered, which tools are in use, and who handles alerts.
During rollout, we support the technical integration and connect alerts to your patch, ticketing, and incident processes. In operations, we work with your team to reduce false positives and fine-tune detection.
What makes the difference is a penetration tester’s perspective: together with your team, we check whether the individual steps of an attack would have been visible in your threat detection. If an incident does occur, our Incident Response & Forensics team supports you remotely and on site.
Typical risks
Why attacks go unnoticed without continuous monitoring
Living-off-the-land attacks
Attackers often use administration tools that are already present. Traditional antivirus scanners often miss this – only the behavior stands out.
Blind spots
A SOC only sees what is reported to it. Printers, network devices, VPN gateways, or machine controllers without an agent remain invisible unless they are connected deliberately.
Alert floods and false positives
Too many unimportant alerts wear out any team, and real alarms get buried. That’s why detection rules need regular fine-tuning.
Stolen credentials
With stolen passwords, attackers sign in like regular users – for example, via VPN at night. This often only looks suspicious in combination with other events.
Lateral movement
After gaining initial access, attackers work their way from system to system – all the way to servers, backups, or control networks.
Unclear permissions
May the SOC isolate a computer or lock an account at night – and who on your side decides? Open questions cost valuable time in an emergency.
Tight reporting deadlines
NIS2 requires an early warning within 24 hours of a significant security incident, and the GDPR requires notifiable personal data breaches to be reported within 72 hours where feasible. You can only report an incident you have detected.
Operating models
Which model fits your team
Around the clock
Managed Detection & Response
The SOC of a specialized partner monitors your environment around the clock and takes the load off your team – without your own SOC and shift operations.
- Round-the-clock alert assessment
- Investigation and containment of incidents
- Rollout and operations supported by Rootsektor
In-house
Detection in your own team
You run threat detection yourself and handle alerts within your team. In an emergency, our incident response & forensics team supports you – remotely or on site.
- Centralized analysis of logs and telemetry
- Automation of recurring responses
- Rollout and fine-tuning with Rootsektor
Real-world test
Test and sharpen detection
Whether managed SOC or in-house – only a real-world test shows whether detection notices a real attack.
- Detection check in a penetration test
- Red Teaming & APT Simulation under real-world conditions
- Purple teaming as a variant of or addition to red teaming
Process
Your managed SOC in five steps
From the first needs assessment to ongoing operations – clearly structured like all our security services and with a dedicated point of contact at Rootsektor.
-
01
Consulting & requirements
We clarify goals, environments, existing tools, and who handles alerts on your side – as well as requirements, for example from ISO/IEC 27001 or NIS2. On request, we sign a non-disclosure agreement in advance.
-
02
Individual quote
Together with our MDR partner, we prepare a specific quote. The main factors are the type and number of assets and the desired use cases.
-
03
Demo & trial
Before you decide, you’ll see the service in a product demo. On request, a trial or proof of concept follows, if offered by the provider – with success criteria defined in advance.
-
04
Rollout & integration
We support the deployment of agents, the connection of log sources, and the setup of dashboards and reports, and we integrate alerts into your processes.
-
05
Operations & optimization
We review the first results with your team, reduce false positives, and fine-tune detection – tested, on request, through regular penetration tests or a red teaming engagement.
Transparency
Transparency in operations – and evidence from real-world testing
During rollout, we set up dashboards and reports with you. We review the first results together with your team; regular reviews during ongoing operations are agreed individually. If we check detection in a penetration test, you see whether your SIEM, EDR, or SOC noticed our activities; after a red teaming engagement, the report shows you which attack steps were detected, reported, and stopped – and which went unnoticed.
- Dashboards and reports set up during rollout
- Joint review of the first results
- Fewer false positives through fine-tuned detection rules
- Regular reviews, agreed individually
- Pentest or red teaming report with detected and unnoticed attack steps
- Concrete recommendations to close detection gaps
Detect attacks before they turn into a crisis
Tell us about your environment and your goals – together with our MDR partner, we’ll prepare an individual quote for you. The initial consultation is non-binding.
FAQ
Frequently asked questions about managed SOC & MDR
Didn’t find your question? Call us at +49 2932 465265-0 or email info@rootsektor.de.
What is the difference between a managed SOC and MDR?
A managed SOC is generally a security operations center delivered as a service: an external team monitors your IT, assesses alerts, and responds to incidents. MDR emphasizes the response – in addition to detection, incidents are investigated and contained. The two terms are often used similarly; what matters is which services and permissions are agreed.
Who monitors our IT – Rootsektor or a partner?
A partner – and we say so openly. Round-the-clock monitoring is handled by the SOC of our specialized MDR partner, and the provider delivers technical vendor support under your contract. We advise you, prepare the quote together with the provider, and support rollout and operations. Any additional support during ongoing operations, such as regular reviews, is agreed individually.
Which systems are connected?
That depends on your environment and your goals – typical sources are endpoints and servers, directory and identity services, cloud services, email, and firewalls and VPN access points. During the consultation, we clarify which data sources are needed and where blind spots remain.
What happens in the event of a security incident?
If the SOC detects an attack, its analysts assess the alert, investigate the incident, and contain it. Which measures the SOC may take on its own – such as isolating devices or locking accounts – should be defined in writing beforehand. If needed, our IT Emergency Response team supports you remotely and on site; in an acute incident, use Report an Emergency or, outside business hours, our 24/7 emergency hotline.
Does a managed SOC replace a penetration test?
No. A managed SOC detects suspicious behavior continuously during ongoing operations. A penetration test goes deep manually, chains vulnerabilities into attack paths, and shows what an attacker can actually achieve. Whether detection notices a real attack only becomes clear in a real-world test – the two complement each other. You can describe the scope directly via our Pentest Quote page.
How is the quote put together – and can we test beforehand?
After a non-binding initial consultation, we prepare an individual quote together with our MDR partner, based mainly on the type and number of assets and the desired use cases. Beforehand, you’ll see the service in a product demo; a trial or proof of concept is possible on request, provided the provider offers one – with success criteria we define together in advance.
Where is our data processed?
How data is processed in the managed service is something we clarify with the provider before the quote. Because logs can contain personal data, data protection and – if you have one – the works council should be involved early, and the retention period should be defined.
We already have a SIEM, EDR, or SOC provider – can you help?
Yes. Regardless of your solution, we can check in a penetration test, on request, whether your SIEM, EDR, or SOC notices our activities. Red Teaming & APT Simulation shows under real-world conditions how detection and response work together; in purple teaming – a variant of or addition to red teaming – we fine-tune detection rules together with your blue team or SOC provider.
Related pages
Let’s talk about your threat detection
Briefly describe your environment, which systems should be monitored, and who currently handles alerts. We’ll get back to you for a non-binding initial consultation and prepare an individual quote together with our MDR partner.