Blue is a monthly retainer. We keep an eye on your systems, help when something goes wrong, and get you ready for audits, supplier questionnaires and insurance renewals. Your named analyst, the Blue Lead, knows your set-up.
Monitoring with a person behind it
Your logs go into a SIEM, a system that collects security events from your laptops, servers and cloud services in one place. We work with Wazuh and Elastic SIEM, and can help you set one up if you don't have one yet.
Our own tooling sorts through the alerts quickly, but people make the decisions. When something needs attention, your Blue Lead looks at it and gets in touch.
Your Blue Lead
One analyst who knows your systems and your people. They review anything significant, keep the monitoring tuned to how you actually work, and are the person you hear from when there's a decision to make.
Escalation: agreed in your retainer.
What happens in an incident
From the first alert to the response. People make the decisions; the tooling does the legwork.
Alert
Something unusual shows up in Wazuh or Elastic SIEM: a sign-in from an odd place, a program that shouldn't be running, a lot of data moving.
Triage
We work out quickly whether it's real, how serious it is and what it touches.
Investigation
The affected accounts, devices and network traffic, and what Hound knows about the indicators.
Your Blue Lead calls
A clear account of what's happening and what we recommend doing.
Response
Containment and forensics, only on systems you've authorised in writing.
Authorisations are agreed in advance. We never touch a system without your signed approval, even mid-incident. The retainer sets out up front what we're allowed to do, so nobody waits on paperwork when it matters.
If something has already happened
You don't need a retainer for this. Tell us now.
Forensics and incident response
What happened, how far it got and how to close it off: evidence collection, a timeline, containment advice and help to recover. You get a written account for your board, insurer or regulator.
Threat intelligence
Who is likely to be behind it, what they usually do next, and whether your data or passwords are circulating. Hound records it in STIX 2.1 so it can be shared with other tools and partners.
Evidence that holds up
Everything we collect is hashed and logged under chain of custody, so your insurer, your lawyers and, if it comes to it, a court can rely on it.
Reporting it
With your agreement we pass evidence to your local police, Report Fraud (which replaced Action Fraud) or the National Crime Agency, and help you decide whether the ICO needs to know.
Compliance
It usually starts with someone else's question: a supplier questionnaire, a public sector tender, an insurance renewal. We help you answer it honestly, fix the gaps and keep the evidence ready for next time.
- Cyber Essentials and Cyber Essentials Plus preparation
- Supplier and customer security questionnaires
- Cyber insurance questionnaires
- Audits against the frameworks your customers ask for
- Security policies that match how you actually work
What is Cyber Essentials?
A UK government-backed scheme that checks five basic controls: firewalls, secure configuration, user access, malware protection and keeping software up to date. Some central government contracts require it, and insurers and larger customers ask about it more and more. Cyber Essentials Plus adds a hands-on technical check.
We prepare you for the assessment. The certificate itself comes from an IASME-licensed Certification Body.
How the retainer works
One monthly fee covers monitoring, your Blue Lead and incident support. Scope, escalation and authorisations are agreed in writing first, and we quote after a short call.
A first call
How your organisation works, what you already run, and what's prompting the conversation.
The agreement
Scope, data processing agreement, escalation and the authorisations we'll need in an incident.
Getting set up
Connecting your SIEM, tuning the alerts and meeting your Blue Lead.
Regular reviews
What we've seen, what we've done and what we'd change next.
Not ready for a retainer? Start with a security review
Talk to us about a retainer
Tell us a bit about your organisation and what's prompted the question.