Managed SOC.
All-round protection that thinks ahead.
Effective protection against cyber attacks now takes more than individual security solutions. Our Managed Security Operations Center combines modern technology with continuous monitoring and clearly defined processes: a security strategy that actively thinks ahead and keeps evolving.
Firewall and antivirus see the door. Not what happens behind it.
Many attacks today begin with a valid login: a stolen password, a phishing email, an unpatched vulnerability. From that moment on, everything looks normal to your firewall and antivirus. A SOC detects the traces left behind.
Like a healthy body: from the immune system to the specialist.
Your body does not wait for the doctor when a pathogen enters. The immune system strikes immediately. Prevention and diagnostics find what develops unnoticed. And when things get serious, specialists decide. Our SOC is built in exactly the same way.
Machine and AI around the clock. People, when it counts.
Which layers are active depends on the package.
7 layers in 4 steps
Defend, detect, assess, act.
Defend
The firewall is the skin of your company: it keeps out whatever comes from outside. We integrate your existing firewall or supply a suitable one. On every device, our endpoint protection (EPDR) works like an immune system. Following the zero-trust principle, it only allows programs classed as trustworthy to run, detects suspicious behaviour and stops it immediately, without waiting for a human.
- Blocks external attacks at the firewall
- Automatically stops suspicious processes and isolates affected devices
- Reports every event to our SOC
An AI analyst that doesn’t send your data abroad.
Many AI functions in the security market run in the data centres of large US providers. Our AI analyst runs on a locally operated open-weight model in our own infrastructure in Lucerne. It works around the clock, assesses every critical alert within 1 to 5 minutes and presents our SOC team with a complete case. This lets us respond faster, and your log data stays in Switzerland.
Included in SOC Pro and SOC Enterprise.
Machine and AI around the clock. People, when it counts.
Attacks don’t keep office hours. Neither does our defence: the endpoint protection blocks anything unknown and stops suspicious processes immediately, around the clock. In SOC Pro and Enterprise, our AI analyst correlates all sources, assesses critical alerts within 1 to 5 minutes and produces a case report with a recommendation. During the service hours agreed in the SLA, our certified SOC analysts in Switzerland review every case, make the decision and get in touch with you. Critical cases outside service hours are handled by our on-call service, at weekends too.
Why isn’t an analyst sitting in front of a screen all night? Because a post staffed around the clock requires at least four full-time positions. We save you those costs without compromising on protection.
The SLA is booked in addition to the package. Critical cases outside service hours are handled by the on-call service, at weekends too.
Your log data stays in Switzerland.
Log and analysis data, all analysis layers and the AI analyst run in our own cloud and data centre infrastructure in Lucerne, including backups and long-term storage. No hyperscaler, no US provider.
The only exception: the endpoint protection telemetry is processed by the manufacturer in the EU.
That’s why our SOC costs less.
Because we operate this infrastructure anyway, the SOC costs us less than it costs a provider who has to buy it in. We pass this advantage on in our pricing.
On top of that, you pay a fixed price per user or device, rather than being billed by the volume of data ingested. Every additional log source costs you nothing extra.
Not every SOC is a SOC.
Many offerings consist of a single system that forwards alerts. That is a start. Our SOC combines automated defence on every device, several specialised analysis systems, an AI analyst and analysts who know your environment.
Does your service stop an attack on the device itself, or does it only raise an alert?
Which log sources are included in the price, and what does each additional one cost?
Who is watching at 3 a.m., and what is that person allowed to do?
Where is my log data stored, and where does the AI that analyses it run?
Who is my point of contact, and do they know my environment?
Ask every provider these five questions. Including us.
Three packages. Each with certified analysts in Switzerland.
The packages are graded by depth of protection: from the secured workstation to the full 7-layer model from nguard.swiss. The size ranges are guidelines, and what matters is your protection requirement. Even a company with 30 workstations can choose Enterprise. We adapt individual components to your environment. Services on an annual subscription.
SOC Basic
SOC Pro
SOC Enterprise
Click on a package to see all included services in detail. The info icon explains each service.
* Estimated price. Cloud systems such as Microsoft 365, SharePoint Online, Exchange Online or AWS instances can be integrated seamlessly.
Your path to a Managed SOC in 6 steps.
From the first conversation to ongoing operation, transparent and at your pace. Click through the individual steps.
Needs assessment
Together with you, we analyse where your company stands today and plan the next steps at a fixed price. For an in-depth analysis, we recommend our IT Security Check beforehand, which also uncovers vulnerabilities that often go unnoticed internally.
- Fixed-price audit
- Clarifying your needs and objectives
- A clear approach for the next steps
Managed SOC, briefly explained.
Around the clock, machine and AI do the work: endpoint protection blocks anything unknown and stops suspicious processes immediately. In SOC Pro and Enterprise, our AI analyst correlates all sources and assesses critical alerts within 1 to 5 minutes. Our certified SOC analysts review every case during the service hours of your SLA (Monday to Friday, bookable as an add-on to the package). Critical cases outside these hours are handled by our on-call service, including at weekends. On request, we can agree a 16/7 SLA.
That depends on the layer. Endpoint protection responds immediately and automatically. The AI analyst delivers its case report within 1 to 5 minutes (SOC Pro and Enterprise). For the response time of our analysts, you add an SLA, in each case Monday to Friday: Gold within 1 hour (07:00 to 22:00), Silver within 2 hours (08:00 to 18:00), Bronze on a best-effort basis (09:00 to 12:00 and 13:00 to 17:00). Critical cases outside service hours are handled by the on-call service, including at weekends.
Many attacks begin with a valid login or a phishing email. From that point on, everything looks normal to the firewall and antivirus. A SOC detects the traces behind it: unusual logins, suspicious processes, modified system files.
- Ransomware and malware (endpoint protection, Security MRI)
- Phishing and compromised accounts (Microsoft 365 monitoring, dark web monitoring)
- Unauthorised access and insider activity (vital signs monitoring, file integrity)
- Attacks via the network (Network ECG)
- Fake domains (protection against cybersquatting)
Which layers are active depends on the package.
The AI analyst correlates events from all sources, assesses critical alerts, summarises what has happened and proposes measures. Its case report is ready within 1 to 5 minutes. It runs on a locally operated open-weight model in our own infrastructure in Lucerne, so your data is never sent to an external AI provider. A human always decides on the proposed measures. Included in SOC Pro and Enterprise; in Enterprise, our certified SOC analysts also carry out their own correlation.
Log and event data from endpoints, servers, network devices and cloud services such as Microsoft 365 and AWS. Storage and analysis take place in our own infrastructure in Lucerne, in accordance with the Swiss Federal Act on Data Protection (FADP). This also applies to the AI analyst, backups and long-term storage. The only exception: the telemetry from endpoint protection is processed by the vendor in the EU. Retention period: 180 days for log and event data, 1 year for endpoint protection telemetry.
The size guidelines are indicative; what matters is your protection requirement. Small teams without their own servers start with Basic. If you have servers, Microsoft 365 or AWS, Pro is the SME standard, including the AI analyst with correlation across all sources. Enterprise offers the complete 7-layer model, and our certified SOC analysts carry out their own correlation as well, even for a company with 30 workstations. We clarify this together in the SOC audit.
The procedure is defined in the SLA. You receive an assessment and concrete recommendations; your IT team or we handle the implementation. A dedicated contact person knows your environment. For critical cases outside service hours, our on-call team will contact you, including at weekends.
These components are not included in the package price, but they can be integrated seamlessly. We integrate your existing firewall or supply a suitable one; from SOC Pro onwards, the Network ECG monitors its logs. You will find an overview of the individual components on our home page.
How many layers protect you today?
In the SOC audit, we review your environment and show you which layers are missing and which package fits. At a fixed price, with personal support.
Dario Corsini
Chief Technology Officer & CISO, n'cloud.swiss AGI personally oversee every SOC audit and make sure the solution genuinely fits your infrastructure.