Managed XDR & 24/7 SOCSecurity tools raise alerts. Somebody has to read them.
Managed XDR (extended detection and response) means a security team watches the signals from your devices, email, user accounts and cloud apps, works out which alerts are real, and acts on them. Most small businesses already pay for Microsoft Defender and never switch half of it on. We configure it properly, and then we watch it: in office hours through our own Defender Monitoring service, or around the clock through the 24/7 SOC powered by Barracuda XDR. Out of hours, Barracuda can phone you about high-criticality incidents if you want it to.
Part of Black Sheep Cyber: see all our security services
Who this is for
Businesses with remote or hybrid staff, sensitive client data, or an insurer, customer or auditor asking about monitoring and detection. If you have Defender or similar switched on and nobody is watching it outside office hours, you have alarms but no one listening. Our helpdesk works office hours only, so out-of-hours security monitoring is the job of the Barracuda SOC. A five-person office with no remote access may not need the 24/7 tier, and we will say so.
What is included
What happens when an alert fires
- 1
Alert raised
Microsoft Defender or Microsoft 365 flags something in your tenant.
- 2
Triaged by an engineer
We look at it in office hours and drop the noise.
- 3
We call you
If it is real, you hear from a person, not a ticket.
- 4
Fixed
Account secured, device cleaned, settings corrected.
- 1
Alert raised
Barracuda XDR sees it across email, identity, endpoints and network.
- 2
Analyst investigates
A Barracuda SOC analyst checks it, day or night.
- 3
Contained
Pre-authorised action, such as isolating a device or disabling an account.
- 4
High criticality: you are called
Barracuda phones your contact out of hours, if you have chosen that.
- 5
Recovery
Our helpdesk picks up the clean-up in office hours.
Defender configured, not just licensed
Defender for Business or the Defender Suite set up the way Microsoft's own baselines recommend: attack surface rules, safe links and attachments, device onboarding, and alerts routed somewhere a human sees them.
Defender Monitoring as a Service
Our engineers monitor the alerts and logs from Microsoft Defender and Microsoft 365 for your tenant, triage the noise, investigate the real ones and escalate to your nominated contacts under a procedure agreed at onboarding. Cover is office hours, Monday to Thursday 08:45 to 17:00 and Friday 08:45 to 16:00.
24/7 SOC, powered by Barracuda XDR
For businesses that need cover overnight and at weekends, monitoring and investigation are delivered by Barracuda's security operations centre, which we resell and coordinate. You choose whether Barracuda phones your contacts out of hours about high-criticality incidents. Everything else is ticketed to our helpdesk and picked up in office hours.
Pre-authorised response
Some actions are agreed in advance so they happen immediately, such as isolating a device or disabling a compromised account. Anything else waits for your instruction. Nothing happens to your systems that you did not sign off.
The basics, done
Multi-factor authentication everywhere, conditional access, email filtering, SPF, DKIM and DMARC, device encryption, and patching. These come with managed IT support and are the settings Cyber Essentials asks for.
Phishing simulation and training
Staff get realistic test emails and short training when they click. The click rate is reported to you, because people are the layer most attacks actually go through.
What is not included, and why
- Prevention guarantees. Monitoring detects and escalates; it does not stop every attack and no service can promise that every threat will be caught in time. What it does is shorten the time between something going wrong and someone acting on it.
- Forensic investigation and full incident recovery. Escalation and the pre-authorised response actions are included. A full investigation, rebuild or breach notification exercise is quoted as a project at the time, and you will know that before it starts.
- The Microsoft licences. Monitoring depends on Microsoft 365 Business Premium or the Defender Suite for every user and device in scope, shown as a separate line so you can see what the software costs.
What it costs
Defender Monitoring as a Service is quoted per user per month after a discovery call. The 24/7 SOC powered by Barracuda XDR is priced per user per month and available on request: get in touch or book a call. The base security controls (MFA, Defender configuration, email security, patching) are included in managed IT support at no extra charge. The initial term is stated on the quotation.
How it starts
- 1Free IT Health CheckA short online check that benchmarks your security and business risk and tells you where you stand.
- 2Discovery callAn engineer, not a salesperson. What you have, what is broken, what it would cost to fix, in writing.
- 3OnboardingEverything moves across on a plan, with no gap in cover and nothing lost.
Free, no sales call needed
Two free checks. Know where you stand.
Domain email check
Can someone send email pretending to be you? Is your real email landing in junk? Type your domain and find out in under a minute.
IT Health Check
A short set of questions that scores your security and business risk, and tells you what to fix first. 15 to 20 minutes on your own.
Questions people ask before signing
What is managed XDR, and is it the same as MDR?
XDR, extended detection and response, is software that collects security signals from devices, email, user accounts, cloud apps and the network in one place, so a single attack showing up in several places is seen as one incident. Managed XDR adds the people: analysts who watch it, decide what is real and respond. MDR, managed detection and response, is the broader name for the same kind of service, and some providers use it for endpoint-only monitoring. Our 24/7 tier is powered by Barracuda XDR and delivered by Barracuda's security operations centre, which we resell and coordinate.
What is the difference between Defender Monitoring and the Barracuda SOC?
Defender Monitoring is our own engineers watching your Microsoft Defender and Microsoft 365 alerts in office hours, Monday to Thursday 08:45 to 17:00 and Friday 08:45 to 16:00. The Barracuda SOC is a 24/7 security operations centre run by Barracuda Networks, which we resell and coordinate, for businesses that need someone watching overnight and at weekends. Out of hours, Barracuda contacts you directly about high-criticality incidents if you have chosen that; our helpdesk picks up everything else in office hours.
Do we need this if we already have antivirus?
Antivirus stops known malware on a device. It does nothing about a stolen password used to log in from abroad, an inbox rule quietly forwarding invoices, or a device that has been turned off protection. Those show up as alerts in Defender, and an alert nobody reads is the same as no alert.
What licence do we need?
Microsoft 365 Business Premium for every user in scope, or the Microsoft Defender Suite added to another plan. If a licence lapses, the alerts we rely on stop being generated, so keeping licences current is part of the deal.
What happens at 2am on a Wednesday?
With the SOC tier, a Barracuda analyst picks up the alert, checks whether it is real, and if it is, takes any pre-authorised action (such as disabling the account). If it is high-criticality and you have asked to be told, Barracuda phones your nominated contact. Our helpdesk picks up recovery when it opens at 08:45. Without the SOC tier, the alert waits for office hours. Our 24/7 SOC guide walks through an illustrative overnight incident.
Does this get us Cyber Essentials?
The controls it depends on are the ones Cyber Essentials asks for, so businesses on this service are most of the way there. Certification itself is a separate, fixed-price piece of work; see the Cyber Essentials page.
Do you do incident response?
Escalation and pre-authorised containment are included. A full investigation, rebuild or regulatory notification is scoped and quoted as a project when it happens, and we tell you that before starting. If you have cyber insurance, we work with the insurer's response team where the policy requires it.