Core
Your team investigatesData ingestion and dashboards support your own analysts. Investigation and incident handling stay with your team.
Managed cybersecurity
Managed detection and response
Decide who owns the next alert.
Bring Vambrace analysts into your detection and response process. Compare MDR tiers by the work your team wants to retain or hand over.
Talk to an MDR specialistIllustrative SOC investigation
What happens after an endpoint alert?
An unusual process starts on an employee’s device. With staffed monitoring in scope, an analyst checks whether the activity is expected and whether another system is involved.
The analyst’s handover
- Signal
- The endpoint records a new process. The analyst checks the account, device timeline and related sign-ins.
- Evidence
- The analyst records the affected assets, what the records show, and any missing evidence that limits confidence.
- Decision
- The named owner receives a recommended action. Device isolation or account suspension follows the authority agreed in the response plan.
What your team receives
A staffed MDR service gives your team an investigation record, the business context and a recommended next action. Your service tier determines when an analyst is on shift and who owns the response.
We agree which endpoint, identity and cloud sources to connect, how to escalate a finding and which steps need your approval.
Compare MDR coverage
Choose the hours of staffed monitoring and the work your internal team will own.
Compare all capabilities and response commitments
| Capability | Core MDR | Advanced MDR | Enterprise MDR |
|---|---|---|---|
| Data ingestion and dashboards | Included | Included | Included |
| Continuous 24/7 ingestion | Included | Included | Included |
| SOC monitoring | Not included | 08:00–18:00 UK time | 24/7/365 |
| Threat hunting | Not included | Included | Included |
| Custom detection rules | Not included | Included | Included |
| Incident response guidance | Not included | Included | Included |
| Forensic support | Not included | Optional add-on | Included |
| Service review meetings | Monthly (data only) | Monthly | Weekly |
| Executive reporting | Not included | Monthly | Weekly |
| Strategic security advisory | Not included | Included | Included |
| Tabletop incident response exercises | Not included | Optional add-on | Included |
| Service level agreement | N/A | P1 alert acknowledgement within 1 hour; containment actions within 4 hours | P1 alert acknowledgement within 1 hour; containment actions within 4 hours |
| Cyber risk reviews | Annually | Quarterly | Monthly |
| Incident response retainer | Not included | Optional add-on | Included |
SOC customer film
Inside the Vambrace SOC
Follow an overnight alert from the first sign-in to the analyst’s decision. Hear from a customer about working with the team.
In Sumo Logic’s Insight Radar, detection rules turn records into signals. Related signals can form an insight for an analyst to investigate.
Read the transcript
Two in the morning. An unfamiliar device signs in. A minute later, the same account downloads a sensitive file. Our managed detection and response service uses Sumo Logic to bring activity from your accounts, devices and cloud services into one place.
This is Sumo Logic’s Insight Radar. The blue ring around the outside shows Records. The bars just inside it show Signals. A Signal fires when activity matches a detection rule. The triangles nearer the centre mark Insights. If distinct Signals for the same account push its activity score above the threshold, Sumo Logic groups them into an Insight. Our analyst opens it to see which Signals fired, and in what order.
With Enterprise MDR, our analysts are on duty around the clock. If the evidence points to a compromised account, we call the people you’ve named and help your team contain the threat. As a Sumo Logic Managed Security Services Partner, we connect your data sources, tune the detection rules to your business, and build response plans with the people who’ll use them.
Here’s how one Vambrace client describes the support. The team are very friendly, knowledgeable and trustworthy. It helps us just to know that we’ve got somebody there that has our back, and we always know that we can trust them to ensure that everything is secure.
Talk to the Vambrace team about managed detection and response.
Play film 1:30Agree the handover before monitoring starts
Continuous ingestion can record events outside staffed hours. Agree with us when an analyst will investigate, who can approve containment and which contact should receive the evidence.
The service agreement sets acknowledgement and containment commitments by severity. Agree how to preserve evidence, authorise changes and review the response with the people responsible for recovery.
Customer film
AM Digital’s SOC experience
AM Digital describes working with Vambrace on managed cloud SIEM.
Read the AM Digital case study ↗
Play film 2:09Evaluate the SOC free for up to 30 days
The free SOC proof of concept runs for up to 30 days, including setup. Choose an investigation you want to observe, connect the agreed sources and review what the analysts could see. Discuss gaps and the decisions your team would retain in a managed service.
Looking for vulnerability investigation and SOC monitoring while you apply fixes? Explore C-Clear, our 30-day investigation and monitoring service.
Book a free proof of conceptManaged detection and response FAQs
What is managed detection and response?
MDR brings telemetry, detection rules and investigation into an agreed operating model. Core provides data and dashboards while your team owns incident handling. Advanced adds staffed monitoring from 08:00 to 18:00 UK time. Enterprise provides staffed monitoring around the clock. The tier comparison sets out reporting, forensic support and retainer options.
How does MDR differ from traditional SIEM or EDR?
SIEM and EDR are cybersecurity tools. MDR is a people, process, and technology driven service that uses data from these tools, plus advanced analytics and human analysts to operate detection, triage, and response to confirmed threats.
Do you need to replace existing tools, or can you integrate with them?
We assess the EDR, identity, cloud and ticketing systems you use. During scoping we check supported connectors, available events, permissions and any licensing needed. A successful connection is tested with a known event before it counts as monitoring coverage.
How do you protect our data and privacy?
We use encrypted data in transit and at rest, follow strict access controls and background checks for SOC staff, maintain role-based access, and adhere to data residency and retention policies aligned with compliance needs.
Do you support clients with incident response services for major breaches?
The MDR tier determines retainer availability: it is included in Enterprise and available as an add-on to Advanced. Agree who can authorise emergency action, whether on-site support is required and what forensic work is included before an incident.
How long does onboarding take?
Onboarding timelines vary by environment. Small-to-mid environments typically onboard in 2 weeks; complex hybrid or heavily regulated environments may take 3-4 weeks. We prioritise time-to-detection so you’ll get monitoring capabilities early while integrations complete.
How do we get started?
Request the free SOC proof of concept or call 0330 460 4633 to discuss your environment and agree the scope.
Learn more about Vambrace’s managed cybersecurity solutions
Terms for the free SOC proof of concept
Introduction
These Terms and Conditions (“Terms”) govern participation in Vambrace Cybersecurity’s free Managed Detection and Response (MDR) proof of concept of up to 30 days through our Security Operations Centre (SOC). By registering for or using the Trial, the client (“Client”) agrees to these Terms
Scope of the Trial
2.1 Vambrace Cybersecurity will provision our MDR services for the Client at no cost for an agreed period of up to 30 days from the date of creation (“Trial Period”).
2.2 During the Trial, Vambrace Cybersecurity will work with the Client to ingest the required data sources into the SOC. Ingestion typically requires up to 1 week, but this is entirely dependent on the Client providing a suitable technical contact with the correct access to deploy collectors and enable ingestion. Timelines may also vary based on the complexity and number of data sources the Client chooses to include.
2.3 Once ingestion is complete, Vambrace Cybersecurity will provide Managed Detection and Response services for the remainder of the Trial Period.
2.4 Vambrace Cybersecurity will also provide the Client with a Proof-of-Concept (POC) Report summarising the Client’s stated success criteria from the onboarding session, alongside an assessment of which data sources are most security-relevant to ingest. This will be provided after the end of the POC free trial period. No promises on delivery timescale will be made for this deliverable as it is dependent on operational capacity.
Client Responsibilities
3.1 The Client must provide timely access, information, permissions, and technical resources necessary for onboarding.
3.2 The Client acknowledges that delays in providing required access or information may reduce the effective monitoring period available within the Trial.
Limits and Performance
4.1 Vambrace Cybersecurity does not impose a fixed technical limit on the Managed Detection and Response service during the Trial; however, higher data volumes and a larger number of sources may increase onboarding time.
4.2 Vambrace Cybersecurity reserves the right to limit or prioritise ingestion sources where necessary to ensure a functional and meaningful evaluation within the agreed Trial Period.
4.3 The Client acknowledges that onboarding timelines are estimates and may vary based on complexity, availability of Client resources, and unforeseen technical issues.
Use of the Trial Environment
5.1 The Trial environment is provided solely for evaluation of Vambrace Cybersecurity’s MSSP Managed Detection and Response service.
5.2 The Client must not use the Trial for:
– Production-critical monitoring requirements;
– Purposes that violate applicable laws or regulations;
– Activities that compromise security, integrity, or proper functioning of the Managed Detection and Response service.
5.3 Vambrace Cybersecurity may suspend or terminate Trial access if misuse or unauthorised activity is detected.
Security and Data Handling
6.1 Vambrace Cybersecurity will treat all Client data ingested during the Trial in accordance with its standard security controls and data protection policies.
6.2 No guarantee is made regarding data retention beyond the Trial Period.
6.3 The Client is responsible for ensuring that only appropriate and lawful data is forwarded to the Trial environment.
Trial Limitations
7.1 The Trial is provided “as-is” without any warranty, guarantee of performance, or service-level commitments.
7.2 Vambrace Cybersecurity does not guarantee full Managed Detection and Response coverage or full ingestion of all potential Client data sources within the Trial Period.
7.3 The Trial does not include long-term incident response, forensics, remediation, or post-Trial support unless separately agreed.
Termination and Expiry
8.1 The Trial will automatically end at the conclusion of the agreed Trial Period.
8.2 At expiry, the Client’s access to our Managed Detection and Response services and associated data may be revoked and data may be deleted.
8.3 The Client may choose to transition to a paid MSSP Managed Detection and Response service; any such transition will be subject to a separate agreement and commercial terms.
Liability
9.1 Vambrace Cybersecurity shall not be liable for any loss, damage, or business impact arising from use of—or inability to use—the Trial environment.
9.2 Nothing in these Terms limits liability for fraud or any liability that cannot be excluded under applicable law.
Confidentiality, governing law, and acceptance
Both parties will treat information exchanged during the Trial as confidential, using it only for the purposes of service evaluation.
- Governing Law
11.1 These Terms shall be governed by and interpreted in accordance with the laws of England and Wales.
- Acceptance
By participating in the Trial, the Client acknowledges that they have read, understood, and agree to be bound by these Terms and Conditions.