351 million. That’s how many security events our SOC analysed across our clients this quarter.
(SOC = security operations centre. The people watching your systems while you’re asleep.)
Here’s what happened to those 351 million:
- 5,647 tripped a signal.
- 105 were worth a human investigating.
- 30 became real incidents.
- All 30 were resolved.
That’s the whole job, in four numbers.
The noise and the signal
The 351 million is noise. Someone logging in from a new laptop. A dodgy-looking attachment that turned out to be a supplier’s invoice. A script running at 2am that was just an update doing its job.
The 30 is the reason you pay for it.
And here’s what makes this hard to sell — when it works, you see nothing. No outage. No ransom note. No Monday morning phone call. Just an invoice for something that appears to have done nothing at all.
That’s the trap in our industry. The better we are, the less you notice.
Four numbers to ask your provider for
If you’re already paying for managed security, ask your provider for these four numbers for your business:
- Events analysed
- Signals detected
- Signals investigated
- Incidents reported
If they can’t give them to you, you’re not buying security. You’re buying hope.
Happy to show you what ours look like — 15 minutes, no obligation. Get in touch.