Attacks happen at 2 a.m. on a Sunday as easily as midday on a Monday. PITOWINGS gives you a security operations centre that is already running — analysts on shift, detections written and maintained, and a response target you can hold us to.
Right now, your time
--:-- Night shift
Three shifts, no gap, no answering machine.
24 / 7 / 365
Staffed, three shifts
15 min
Critical triage target
14
ATT&CK tactics mapped
ISO 27001
Certified organisation
Watch floor
On shiftTelemetry
Ingest
EDR · identity · cloud · firewall
Correlate
matched against 3 other signals
Triage
picked up by the on-shift analyst
Verdict
true positive — credential misuse
Act
session revoked, host isolated, you are called
Alert to action, with the clock running
Telemetry we ingest
Mandiant's M-Trends 2026 puts the global median dwell time at 14 days, and finds that only 52% of intrusions were spotted by the organisation itself. The other 48% heard about it from a customer, a regulator, a researcher or the attacker. Monitoring nobody is watching produces exactly that outcome.
The gap is rarely the technology. Most organisations that get breached already owned a tool that logged the intrusion — nobody was looking at it between Friday evening and Monday morning.
Time an intruder spends inside
Global median dwell time
0 days
Our triage target for a critical alert
15 minutes
Drawn to the same scale. Fifteen minutes is the width of that mark.
Who noticed first
Mandiant M-Trends 2026, covering 2025 investigations. Nearly half of all breached organisations learned about it from a third party.
The same watch floor sits behind all four. What changes is how much authority we hold, whose platform the work runs on, and whether you need someone accountable for the roadmap as well as the alerts.
Monitor & alert
A staffed security operations centre watching your estate around the clock, on our platform, with detections written and maintained by us.
Best when
You have no security team, or one person carrying everything.
MDR
Everything in the managed SOC, plus the authority to act — containment executed by our analysts under rules of engagement you agree in advance.
Best when
Detection without response just means being woken up earlier.
Your platform, our hands
You have already invested in a SIEM or XDR. We run it — content, tuning, health, and the analysts in front of it — instead of you replacing it.
Best when
The tool was never the problem — the staffing was.
Direction
Someone accountable for the security roadmap: risk, policy, regulator conversations and board reporting, without carrying a full-time executive.
Best when
The monitoring is running, but nobody owns what happens next.
Eight classes of telemetry, correlated together rather than watched in eight separate consoles. Coverage gaps are listed in week one and tracked until they close — because an unmonitored source is where the next intrusion will sit.
Endpoint
EDR · XDR · AV · process telemetry
Identity
AD · Entra ID · Okta · MFA · privilege
Cloud
CloudTrail · Azure Activity · GCP audit
Network
firewall · NetFlow · DNS · proxy · VPN
gateway · phishing reports · mailbox rules
SaaS
M365 · Workspace · CRM · file sharing
Applications
WAF · app & API logs · databases
OT / IoT
ICS · SCADA · device telemetry
Detections are written against the MITRE ATT&CK framework, so coverage can be argued in a public vocabulary rather than a vendor's private one — and so you can ask us, specifically, what happens if an attacker reaches any one of these.
Detections written against MITRE ATT&CK, reviewed every quarter
Most managed security contracts promise response without defining it. Four severities, four targets, one escalation path agreed before the first incident rather than improvised during it.
For a P1 we telephone the named contacts. A critical finding is never left in a queue or an inbox waiting for office hours.
Critical
Active compromise, ransomware, confirmed data loss. Triage starts immediately and you are called, not emailed.
Response target
15 minutes
High
Credible attack in progress against a production system, privileged account abuse, confirmed malware on a server.
Response target
30 minutes
Medium
Suspicious behaviour needing investigation, policy violations, malware contained by existing controls.
Response target
4 hours
Low
Informational findings, hygiene issues and tuning recommendations, gathered into the weekly report.
Response target
Next business day
Targets are agreed in your service schedule and reported against monthly — not averages quoted after the fact.
Every organisation does this calculation privately, so here it is in the open. The figure that decides it is not the software licence — it is how many people a genuine round-the-clock rota takes.
8,760
hours in a year that need covering
~1,700
hours one analyst actually covers, after leave and training
5
analysts for bare single cover — one pair of eyes, always
8–10
for two-person shifts, a lead, and holiday resilience
In-house
With PITOWINGS
Managed security quietly fails during onboarding, when telemetry never quite gets connected and tuning never quite gets finished. So it is run as a schedule with dates on it.
Day 1
Scope and connect
Crown jewels identified, log sources agreed, escalation contacts and out-of-hours authority written down.
Week 1
Ingest and baseline
Telemetry flowing, coverage gaps listed, a baseline of what normal looks like in your estate.
Week 2–3
Tune and rehearse
Detections tuned to your environment to kill false positives, and a tabletop run of a P1 before a real one arrives.
Day 30
Steady state
Full monitoring, monthly reporting live, and a quarterly review cycle for new detections and coverage.
A managed service that forwards raw alerts has simply moved your backlog. Everything that reaches you has been triaged, scored and enriched by a person who can say what it is and what to do.
For a P1 we call. Nothing critical is left sitting in a queue or an inbox at 2 a.m. waiting for someone to open it in the morning.
Detection content is written against MITRE ATT&CK and reviewed every quarter as techniques change. A ruleset installed once and never revisited stops being a defence quite quickly.
False positives are treated as a defect in our service, not as noise for you to filter. Alert volume per analyst is a number we report on.
Log retention, residency and access are set out in the service schedule. Data can stay in India, in your own tenant, or on-premise for regulated and air-gapped environments.
The same practice runs red team and forensics engagements. Detections are written by people who have spent the week trying to get past them.
Sectors where an outage, a data loss or a missed reporting deadline costs more than the monitoring does — and where the regulator has an opinion about how quickly you noticed.
SEBI CSCRF, RBI expectations, six-hour reporting
patient data, connected devices, uptime that is clinical
customer assurance, SOC 2, multi-tenant estates
core network, signalling, subscriber data
plant floor, ICS/SCADA, safety-critical uptime
PCI DSS, payment paths, seasonal peaks
citizen data, procurement rules, audit trails
open networks, high turnover, sensitive research
A tool produces alerts; it does not investigate them. The gap that hurts organisations is not detection technology, it is the staffing needed to look at what the technology produces at 3 a.m. on a Sunday. We provide the analysts, the detection content and the response — on our platform, or on the one you already own.
Not unless replacing them is genuinely the right answer. Co-managed SIEM exists precisely so that an organisation that has already invested in a platform can keep it and buy the staffing and content instead.
Under MDR our analysts can isolate a host, revoke a session, disable an account or block an indicator — within rules of engagement you approve in advance, so nobody has to improvise authority during an incident.
Retention and residency are set in your service schedule. Data can be held in India, inside your own cloud tenant, or entirely on-premise for regulated and air-gapped environments. Retention is usually driven by the regulator you answer to rather than by our default.
Monitoring typically begins within the first week and reaches steady state by day 30 — scoping and connection in the first days, baselining in week one, tuning and a tabletop rehearsal in weeks two and three.
A P1 gets triage within 15 minutes and a phone call to the contacts named in your escalation path. Under MDR, containment starts immediately under the agreed rules of engagement; under Managed SOC we hand you a verdict, the evidence and a recommended action.
Already have a SOC and want a second opinion on its coverage? Ask us to review it.
Book a free consultation. We will review what you are monitoring today, show you the gaps, and tell you honestly whether you need all of this or only part of it.
