Managed service plans
Compare plans for monitoring,
NOC, SOC and Enterprise.
Monitoring provides visibility. NOC takes responsibility for outage handling. SOC analyses threats and responds. Enterprise combines both operational scopes with preventive activities.
Four engagement models
The same foundation. Different service scopes.
Every plan is based on agreed telemetry and standard integrations. The difference is who analyses an event and which actions they perform.
Visibility
Observability / Monitoring
Visibility and data for your team.
- Metrics, logs and available application telemetry
- Infrastructure availability and performance monitoring
- Standard dashboards and automated alerts, 24/7
- Integration quality checks and agreed data retention
- Monthly availability and resource utilisation report
Availability
NOC
Engineers looking after your service availability.
- The full agreed Observability / Monitoring scope
- Technical alert handling and fault diagnosis, 24/7
- Approved remediation procedures and incident management
- Patch management for designated systems and backup oversight
- Coordination of escalations to administrators and vendors
Security
SOC
Analyst-led threat detection and response.
- Monitoring extended with security data sources and controls
- Event correlation, detection and alert triage, 24/7
- Incident scoping and authorised containment
- Coordination of remediation through to agreed closure
- Incident reports and continuous improvement of protection rules
NOC + SOC
Enterprise — NOC + SOC
Security and availability in one process.
- The full agreed NOC and SOC scope with unified coordination
- Priorities based on the importance of business services
- Core vulnerability management for known assets
- A core threat hunting cycle and agreed recovery tests
- Combined reporting and management reviews
NOC and SOC are two parallel scopes. Purchasing SOC does not automatically include NOC outage management, and collecting logs in NOC does not constitute security analysis.
Scope comparison
See what is included in the core service.
This comparison applies to agreed assets and integrations. On smaller screens, scroll the table horizontally.
| Scope | Observability / Monitoring | NOC | SOC | Enterprise — NOC + SOC |
|---|---|---|---|---|
| Metrics, logs and core dashboards | Yes | Yes | Yes | Yes |
| Available application telemetry | Standard integrations | Standard integrations | Standard integrations | Integrations and combined analysis |
| Automated alerting, 24/7 | Yes | Yes | Yes | Yes |
| Engineer-led outage handling, 24/7 | No | Yes | No | Yes |
| Diagnosis and standard remediation | No | Yes | Within the security scope | Yes |
| Core patch management | No | Yes | No | Yes |
| Operational backup oversight | Available statuses and alerts only | Yes | In the context of security events | Yes, with agreed tests |
| Security event correlation | No | No | Yes | Yes |
| Security triage, 24/7 | No | No | Yes | Yes |
| Authorised threat containment | No | No | Yes | Yes |
| Security incident analysis and management | No | No | Yes | Yes |
| Core VM for known assets | No | No | Extension | Yes |
| Recurring threat hunting campaigns | No | No | Extension | Core cycle |
| Joint coordination of security and availability | No | No | No | Yes |
| Standard reporting | Yes | Yes | Yes | Yes, integrated |
| Strategic service reviews | No | Operational | Operational | Quarterly, according to the agreed schedule |
| Full GRC, vCISO, vISM and DPO services | Extension | Extension | Extension | Extension |
Routine incident handling within the agreed scope remains part of the plan. An extension depends on the type and volume of additional work, rather than the occurrence of an outage or attack itself.
A shared foundation
Monitoring must detect missing data.
An absence of telemetry does not prove that an environment is functioning correctly. Every plan includes quality checks for connected sources and maintenance of platform components under our administration.
Agreement on the environment and responsibilities
We define the assets, system owners, business service criticality, data sources and escalation contacts. This scope becomes part of the service specification.
Standard deployment and acceptance testing
We connect supported integrations, configure permissions, dashboards and alerts, then verify data flows and notifications. Standard onboarding is part of plan implementation.
Platform and integration maintenance
We maintain collectors, rules, connections and service accounts under our administration. Missing data is detected as a visibility issue and handled within the service’s defined responsibilities.
Access to environment visibility
We provide dashboards, reports and tickets appropriate to the plan. Agreed retention determines how long data remains available for searching and analysis.
Documentation and change control
We document service configuration and completed actions. We update contacts, thresholds, rules and procedures when the agreed scope or operating conditions change.
Service specification
We agree service parameters before operations begin.
A plan should not be chosen by its name alone. Engagement terms must reflect the environment, permissions and expected operating model.
Environment scope
The number and list of assets, locations, services, data sources and supported technologies. These allow responsibility to be assigned unambiguously.
Volume and retention
Data limits, retention periods, archive access and handling of excess usage. Parameters are tailored to operational needs and agreed requirements.
Tools and licences
Platforms, licences and integrations provided by VigilHorizon or the client, together with the dependencies required for service delivery.
Permissions and permitted actions
Actions that may be performed independently, require approval or are excluded from automation. We approve runbooks and the conditions for safely performing and stopping actions.
SLAs and priorities
Priority definitions, measurement start points, acknowledgement times and communication frequency. We distinguish response SLAs from time to containment, service restoration and root cause remediation.
Planned work and dependencies
Maintenance windows, update scope, client team availability and coordination with suppliers. We also agree review, hunting and testing cycles appropriate to the chosen plan.
Service acceptance and offboarding
Go-live criteria, acceptance tests, data export, access revocation and the end of retention. These agreements provide control throughout the engagement.
Extensions
When you need additional expertise.
Dedicated projects, broader technology administration and full GRC services are tailored to specific needs. We first check what your plan already covers.
The next step
Let us define a scope that makes sense for your organisation.
Let us discuss your environment, priorities and team responsibilities. We will use this to define the work, required access and service conditions.