Skip to content
Book a risk assessment

Always On.

Every alert decided. Every incident explained. Day and night.

Our 24/7 SOC watches your identities, devices, email and cloud apps. Threat intel, incident analysis and escalation are all included. When something is serious, Rapid Response is one call away.

Price
$8 per user, $30 per server, monthly
Included
Threat intel, incident analysis, escalation
Proof
Response times and Verdict accuracy, monthly
Start with Groundwork Price it
The last 24 hours · Northbank AdvisoryExample
00:00 06:00 12:00 18:00 02:15 escalated alerts decided 143 in 24 hours
140 closed quietly 2 asked and reviewed 1 escalated After hours
What's included

Five things, and how you'll know each one is working.

Outcomes, not tool names. They run on the security platform you already own, or one we recommend.

Included What you get How you'll see it
WatchYour identities, devices, email and cloud apps watched around the clock, every day of the year.Live coverage in your portal, and a warning if anything goes dark
Threat intelNew threats matched to the software and suppliers you actually use, not a generic feed.A "does this affect us?" answer for each one that matters
Incident analysisEvery alert decided by Verdict against your Known Normal, with its reasons written down.Three plain answers per incident, and Verdict's accuracy each month
EscalationThe right person told within agreed times, by phone when it's serious, with backups if they don't answer.Time to acknowledge, reported monthly
ContainmentSessions ended, devices isolated or accounts paused, within limits you set in advance.Every action in your activity log, and time to contain each month
Threat intel

A daily brief about your business, not the internet.

Every new advisory is checked against what Known Normal says you run, who you rely on and what sector you're in. Most don't affect you, and we say so. The ones that do arrive with an owner and a next step.

Threat brief · TuesdayExample
  • Critical flaw in a VPN appliance, exploited in the wild
    Your firewall runs an affected version. Patch window booked for tonight.
    Affects you
  • Phishing campaign impersonating a payroll provider
    You use this provider. Staff warned in the Demysti5 app, with an example.
    Relevant
  • Ransomware group targeting accounting firms in your region
    Your sector. Its known techniques checked against your detection coverage: all covered.
    Relevant
  • Browser zero-day patched
    44 of 45 laptops updated. One is chasing its owner.
    Handled
  • Flaw in a database engine
    You don't run it anywhere.
    Not affected
Escalation and containment

You decide in advance what we do at 2am.

Set it once during onboarding. Change it any time in your portal. Every action is logged where you can see it.

Containment limits · your portalExample
  • End a user's sessionsAct, then tell youAsk firstNever
  • Isolate a device from the networkAct, then tell youAsk firstNever
  • Pause an account
    Directors: ask first    Act, then tell youAsk firstNever
  • Reset a passwordAct, then tell youAsk firstNever
  • Wipe a deviceAct, then tell youAsk firstNever
Who we tell, and how fastOur targets
  • CriticalPhone call within 15 minutes, any hour. Backup contact after 10 minutes without an answer.
  • HighPhone or SMS within 30 minutes, any hour.
  • MediumEmail and portal within 4 business hours.
  • LowIn your portal and the monthly report.
Price

Priced per person and per server. Nothing per alert.

A busy month doesn't cost you more. Platform licences and log storage are paid to the vendor and estimated up front in your quote.

Works well with Rapid Response Device Shield Hardened
Always On, ex taxMonthly
Per user
$8
a month
Per server
$30
a month
Example: 40 users and 2 servers$380 a month
The same 24/7 cover, in-house5 analysts
Work out your price

Always On starts with knowing what normal looks like.

Groundwork maps your business in five days. Monitoring goes live in days after that, proven by a Fire Drill.

Book Groundwork