Every security tool your business has deployed generates alerts. Your EDR platform detects suspicious process behaviour. Your email security flags a potential credential phishing attempt. Your network firewall logs an unusual outbound connection. Your Microsoft Entra ID reports a login from an unfamiliar IP address.

In a business without a managed SOC, these alerts sit in queues. Some are reviewed the next morning. Most are never reviewed at all – not because your team is negligent, but because reviewing, triaging, and investigating security alerts is a full-time specialisation that requires both technical depth and continuous availability. Your IT manager, your helpdesk, and your internal IT staff have a business to run. They cannot simultaneously monitor a security alert queue 24 hours a day.

The attacker on day 1 of a breach is not deploying ransomware. They are moving quietly – establishing persistence, mapping your network, identifying your data, and creating the conditions for maximum impact when they eventually execute. The businesses that survive breaches intact are the ones where something caught the attacker on day 3 – before they had time to complete their preparation. That something is a managed SOC.

For a detailed understanding of how staged cyber attacks unfold across the dwell period, read: How Staged Cyber Attacks Work.

Building an internal Security Operations Centre is theoretically possible for any organisation. For most Sydney businesses, it is not practically achievable – and the numbers make this clear.

A genuine 24/7 internal SOC requires:

• Minimum 5–6 full-time SOC analysts to cover shifts continuously without burnout – at current Australian market rates of $100,000–$140,000 per analyst, annual staffing cost starts at $500,000–$840,000 before you count superannuation, leave, and training
• A SOC manager to oversee operations, handle escalations, and manage the analyst team – add $150,000–$200,000
• SIEM licensing – Microsoft Sentinel scales with data volume, but for a typical SMB environment expect $30,000–$80,000 per year; larger enterprise SIEM platforms (Splunk, IBM QRadar) run $100,000–$300,000 annually
• Threat intelligence feeds – commercial threat intelligence subscriptions for the feeds that matter to your specific industry: $20,000–$50,000 per year
• Security orchestration tooling (SOAR) – $20,000–$80,000 per year
• Recruitment timeline – finding 5–6 experienced SOC analysts in Australia's documented cybersecurity talent shortage takes 6–12 months, assuming you can attract them away from larger firms and government agencies
• Retention challenge – experienced analysts are in constant demand. Keeping them requires ongoing investment in career development, tooling, and compensation above market

Total minimum annual cost: $1.5M–$2M+ for a genuine internal SOC capability.

A managed SOC gives your business equivalent monitoring, detection, and response capability because the analyst team, tooling investment, and threat intelligence costs are shared across multiple clients – making enterprise-grade security operations economically viable for businesses that could never justify the internal cost. For a broader discussion of what proactive security costs versus what breaches cost, read our guide on cyber risk management.

Code Hyper One's managed SOC monitors the full breadth of your environment – not just the endpoints that are easiest to instrument. Every component below is within scope based on what your business runs:

Endpoint Telemetry (EDR Integration)

Continuous monitoring of workstation, laptop, and server activity through our managed endpoint security service – process behaviour, file system changes, registry modifications, network connections, and authentication events. Our SOC correlates endpoint telemetry with identity and network signals to identify lateral movement, persistence mechanisms, and attack chains that endpoint tools in isolation miss.

Identity and Access Events

Privileged account activity, failed authentication patterns, impossible travel alerts, new MFA registration, legacy authentication protocol usage, conditional access policy bypass attempts, and anomalous access behaviours across Microsoft Entra ID and Active Directory. Identity compromise is the most common initial access technique in Australian business breaches – and identity signals are often where the earliest indicators of compromise appear.

Email Security Events

Phishing attempts, business email compromise indicators, malicious attachment detections, suspicious forwarding rule creation, mass email deletion patterns (a common indicator of account compromise covering tracks), and anomalous OAuth application consent grants. Our SOC monitors email security signals from our managed email security service and Microsoft Defender for Office 365 simultaneously.

Cloud and Microsoft 365 Environment

Native monitoring across your Microsoft 365 tenant and Azure environment: resource configuration changes, privilege escalation events, data exfiltration indicators (large-volume SharePoint/OneDrive downloads, unusual external sharing), Teams external access anomalies, Azure resource creation, and Defender for Cloud Apps alerts. For businesses on Microsoft 365, the cloud environment is where the most sensitive data lives – and where attackers target after gaining initial access.

Network Traffic and Perimeter

Network flow analysis, DNS query monitoring (identifying command-and-control beaconing, DNS tunnelling, and data exfiltration attempts via DNS), firewall policy violations, VPN access anomalies, and perimeter device event logs. DNS-layer monitoring identifies malicious activity before connections complete – one of the earliest possible detection points in an attack chain.

Vulnerability and Configuration Intelligence

Integration with our vulnerability scanning service means SOC alerts are automatically correlated with known vulnerability data – so when an attacker targets a specific vulnerability on a specific host, our analysts immediately know whether that host is patched and what the actual risk exposure is.

Dark Web Intelligence

Integration with our dark web monitoring service adds external threat context – alerting our SOC when your organisation's credentials, email addresses, or data appear on dark web markets or breach databases, providing early warning of account compromise before an attacker has a chance to use stolen credentials.

Microsoft Sentinel – Our Primary SIEM

Code Hyper One operates Microsoft Sentinel as our primary Security Information and Event Management (SIEM) platform – a cloud-native SIEM that integrates natively across the entire Microsoft security stack.

For Code Hyper One's clients who already run Microsoft 365, this is not an add-on – it is an extension of the security data they are already generating. Microsoft Defender for Endpoint (EDR), Microsoft Defender for Office 365 (email), Microsoft Defender for Identity (Active Directory), Microsoft Defender for Cloud Apps (SaaS), and Azure Defender all feed directly into Sentinel – creating a unified detection and investigation environment that correlates signals from every layer simultaneously.

What Microsoft Sentinel provides in our managed SOC:

• Centralised log ingestion from all monitored sources – endpoints, identity, email, cloud, network
• AI-powered anomaly detection that learns your environment's normal behaviour and flags deviations
• Custom detection rules built on the MITRE ATT&CK framework for your industry's specific threat actors
• Automated response playbooks (SOAR) that initiate containment actions within seconds of alert confirmation – isolating endpoints, suspending accounts, and blocking network traffic automatically
• Investigation graph visualisation – connecting related alerts into a single attack narrative that our analysts use to understand the full scope of an incident, not just individual detachment events
• Case management for tracking incidents from initial alert through to closure and post-incident review

See our Microsoft Defender services for the full Microsoft security platform management context.

MITRE ATT&CK Framework – How We Engineer Detection Rules

Our detection rules are not generic vendor defaults. They are mapped to the MITRE ATT&CK framework – the industry-standard knowledge base of attacker tactics, techniques, and procedures (TTPs) documented from real-world attacks. For each industry sector we serve, we maintain a threat actor profile mapping the specific ATT&CK techniques used by the threat groups most likely to target that sector – and our detection rules specifically cover those techniques.

For Australian businesses, this means our detection coverage is informed by the ASD ACSC's annual cyber threat reports, the ACSC's sector-specific threat advisories, and intelligence on threat actors known to target Australian healthcare, professional services, financial services, and manufacturing organisations. For deeper context on how TTPs are used in real attacks, read our guide: Understanding TTPs – Tactics, Techniques and Procedures.

Not every alert is a threat. Not every threat is critical. Our triage process is designed to protect your team from alert fatigue while ensuring genuine threats receive immediate, proportionate response.

Severity Classification and Response SLAs

P1 – Critical Active compromise confirmed. Active data exfiltration in progress, ransomware deployment detected or imminent, confirmed attacker presence with evidence of lateral movement, or account takeover of privileged identity. Response: Immediate phone escalation to your designated contacts regardless of time of day. Automated containment actions (device isolation, account suspension, network block) initiate within minutes. Our analysts remain on the incident until it is contained and your team is engaged.

P2 – High High-confidence threat indicator requiring urgent investigation. Successful phishing with credential capture confirmed, malware execution on a production system, suspicious privileged account activity with high likelihood of compromise, or ransomware behavioural indicators on a single endpoint. Response: Escalation within 30 minutes via your agreed notification channel. Investigation initiated immediately with initial findings provided within the hour.

P3 – Medium Confirmed security event requiring attention but not immediate action. Policy violations, low-confidence indicators requiring context-gathering, reconnaissance activity, or suspicious activity on a non-production system. Response: Escalation within 4 hours during business hours, included in next scheduled brief for events occurring overnight unless escalated.

P4 – Low / Informational Security observations, configuration recommendations, policy deviations, and threat intelligence updates relevant to your environment. Response: Included in monthly reporting cycle with recommendations.

What Happens at 2am on a Saturday

This is the question every buyer should ask any managed SOC provider before signing – and every genuine managed SOC provider should be able to answer specifically.

At Code Hyper One, a P1 alert that fires at 2am on a Saturday is treated identically to one that fires at 10am on a Tuesday:

1. The alert is generated by Microsoft Sentinel and immediately correlated against related events in the investigation queue

2. Our on-duty analyst validates the alert against the investigation graph – confirming whether it represents active compromise or a false positive within minutes

3. If confirmed P1: automated response playbooks initiate – the affected endpoint is isolated from the network, the associated user account is suspended in Entra ID, and suspicious network connections are blocked at the perimeter – all within minutes of confirmation, before the analyst picks up the phone

4. Your designated incident contact receives a direct phone call. Not an automated email. Not a ticket. A call from an engineer who has already reviewed the situation and can brief you clearly on what happened, what has already been done, and what decision you need to make right now

5. We remain engaged through initial containment, provide regular situation updates, and support your team through to stabilisation – at which point a formal incident timeline and post-incident report is prepared

The phone call at 2am is the product. Everything before it is infrastructure.

For the mechanics of how incident response works from detection through to eradication, read: Mastering Incident Response.

Continuous monitoring catches threats that match known patterns and detection rules. Proactive threat hunting finds threats that have learned to avoid the detection rules.

Threat hunting is hypothesis-driven investigation – our analysts proactively search through your environment's telemetry looking for evidence of attacker activity that has not triggered any alert. This is not the same as waiting for alarms. It requires experienced analysts who understand how advanced threat actors operate, what their behavioural signatures look like in raw log data, and how to distinguish attacker behaviour from unusual but legitimate business activity.

How our threat hunting operates:

• Intelligence-driven hypotheses – every hunt starts with a hypothesis derived from current threat intelligence: given the threat actors known to target your industry, what techniques would they use, and what artefacts would those techniques leave in your specific environment?
• MITRE ATT&CK coverage analysis – we regularly audit our detection rule coverage against the full ATT&CK matrix to identify techniques not covered by existing automated detection, and prioritise manual hunting in those gaps
• Historical telemetry analysis – hunting looks backward through stored telemetry for artefacts of past activity that may have occurred before the managed SOC was deployed or before a specific detection rule was written
• Anomaly investigation – behavioural baselines for your environment allow us to identify anomalies that fall below alerting thresholds – the subtle indicators that an experienced analyst recognises as meaningful but that automated systems score as normal

Threat hunting outputs feed back into detection rule development – when a hunt finds evidence of a technique not covered by existing rules, a new detection rule is written so the next instance is caught automatically. This continuous improvement cycle is how a mature managed SOC improves its detection coverage over time rather than maintaining the same static rule set indefinitely.

For an understanding of how attackers' behaviours appear in monitoring data, read: Indicators of Compromise vs Indicators of Attack.

This is the section that no pure-play SOC provider – including Cliffside – can replicate.

Most managed SOC providers operate as a monitoring overlay. They ingest logs from the tools you already have and watch for alerts. When they detect something, they notify you, and you (or your IT provider) arrange the response. The SOC and the response capability are separate – which means time is lost in the handoff.

Code Hyper One manages every security layer in your environment simultaneously:

Security Layer

Code Hyper One Service

SOC Integration

Endpoint Detection & Response

Managed EDR (Microsoft Defender for Endpoint)

SOC alert triggers automated RMM-based endpoint isolation

Patch Management

Datto RMM

SOC vulnerability alert triggers accelerated patch deployment

Email Security

Microsoft Defender for Office 365

SOC correlates email compromise with endpoint and identity signals

Identity Security

Microsoft Entra ID / Conditional Access

SOC alert triggers account suspension via Entra ID automation

Vulnerability Intelligence

Vulnerability Scanning Service

SOC correlates active exploits against known vulnerability data

Dark Web Intelligence

Dark Web Monitoring

SOC receives credential exposure alerts as threat context

Backup & Recovery

BCDR Platform

SOC ransomware alert triggers immediate backup verification

Incident Recovery

Disaster Recovery

SOC escalation includes recovery initiation, not just containment

What this means in practice: when our SOC detects ransomware behaviour on an endpoint at 2am, the response in the first four minutes looks like this: the endpoint is isolated from the network via our Datto RMM agent, the associated user account is suspended in Entra ID, backup integrity is verified through our BCDR platform, and the phone is already ringing. No handoff. No "call your IT provider in the morning." No gap between detection and action.

A SOC that only monitors is a smoke detector. A SOC integrated with your entire managed security stack is a monitored sprinkler system with a direct line to the fire brigade.

Not every business needs to fully outsource security operations. Some organisations have an internal IT manager, a small IT team, or an existing IT support provider who handles day-to-day technology management – but lack the specialist security expertise and 24/7 availability that genuine threat monitoring requires.

Code Hyper One's co-managed SOC model works alongside your existing IT capability:

• Your internal IT team handles day-to-day helpdesk, infrastructure management, and business technology
• Code Hyper One's SOC handles 24/7 security monitoring, threat detection, alert triage, and escalation
• Shared incident response – when our SOC detects a genuine threat, we brief your IT team and support them through containment rather than bypassing them

This model is particularly suited for Sydney businesses with 50–250 staff who have invested in internal IT capability but recognise that security operations require a different, always-on specialisation. For context on how an IT consulting partnership complements a managed security model, see our IT consulting services.

Security monitoring without reporting is surveillance with no governance benefit. Code Hyper One's managed SOC provides reporting at three levels:

Monthly Security Operations Reports

Alert volumes, confirmed incidents, false positive rates, mean time to detect (MTTD), mean time to respond (MTTR), notable threat intelligence relevant to your industry, and a summary of detection rule changes during the month. Written for IT managers and security-aware business leaders who need operational visibility without needing to understand every technical detail.

Quarterly Security Reviews

Trend analysis across three months of monitoring data – are threats increasing, decreasing, or shifting in character? Threat landscape update relevant to your specific industry and geography. Recommendations for detection coverage improvements and scope changes. Review of your environment against any relevant framework changes (Essential Eight maturity assessment updates, insurer requirement changes). Delivered via video conference, not as a PDF in an inbox.

Board-Ready Executive Summaries

One-page risk posture summaries designed for board reporting: current threat environment, key metrics in plain language, active risk items requiring board-level awareness, and strategic security recommendations. Non-technical directors can read and act on these in five minutes.

Real-Time Portal Access

Live access to your Sentinel dashboard – current alert status, open investigations, historical metrics, and detection coverage overview. Available on demand at any time, not just at reporting intervals.

Where your security data is processed and stored matters – particularly for businesses in regulated industries and those subject to Australian Government data residency requirements.

Code Hyper One's managed SOC operates Microsoft Sentinel with Australian data residency – logs ingested into the monitoring platform are stored within Microsoft Azure Australia regions (Australia East – Sydney, Australia Southeast – Melbourne). Security event data, investigation notes, and incident records do not leave Australian jurisdiction.

For businesses subject to APRA CPS 234, our managed SOC service is structured to satisfy the third-party information security requirements – including material incident notification timelines and the requirement that security capability is commensurate with the size and extent of threats to information assets.

For organisations under the Privacy Act 1988, security telemetry processing is conducted under a data processing arrangement that addresses the relevant Australian Privacy Principles. For government suppliers and critical infrastructure operators, we provide detailed documentation of our data handling controls and personnel background verification upon request.

ASD Essential Eight – Maturity Level 3 Requirement

The ASD Essential Eight at Maturity Level 3 requires an organisation to have "comprehensive audit logging" of privileged access, user activity, and security events – with logs centralised and monitored for suspicious activity. A managed SOC directly satisfies this requirement by centralising log collection in Microsoft Sentinel and providing continuous monitoring of those logs. At ML3, the Essential Eight also requires detection capabilities commensurate with a sophisticated adversary – which requires human-led threat hunting, not just automated detection. See our Essential Eight Checklist 2026 for the full maturity requirements. For the ASD Essential Eight framework context, see: ASD Essential Eight Guide.

Privacy Act 1988 – Notifiable Data Breaches Scheme

Under the Notifiable Data Breaches (NDB) scheme, Australian businesses with annual turnover above $3 million must notify the OAIC and affected individuals if a data breach involving personal information is "likely to result in serious harm." Timely detection – which a managed SOC provides – is critical for NDB compliance, because the notification obligation timeline begins from when you "become aware" of the breach. Organisations with managed SOC services that detect breaches on day 3 rather than day 197 are in a materially better position to meet their NDB notification obligations. For the broader cyber risk management framework, see: Cyber Risk Management Framework.

APRA CPS 234

CPS 234 requires APRA-regulated entities to maintain information security capabilities commensurate with the size and extent of threats to their information assets, implement controls to protect against information security incidents, and notify APRA of material information security incidents within 72 hours of becoming aware. A managed SOC directly satisfies the monitoring and detection requirements and produces the incident timeline documentation required for APRA notification.

Cyber Insurance

Australian cyber insurers now require documented 24/7 security monitoring capabilities as a condition of policy issuance and renewal for policies above specific coverage thresholds. Our managed SOC service satisfies monitoring requirements and produces the incident response logs, MTTD/MTTR metrics, and audit documentation that insurers request during application and claims processes. For the full picture of 2026 Australian cyber insurer requirements, read our cyber insurance requirements guide.

Code Hyper One earns business by giving honest answers to hard questions – including the ones that reveal whether a SOC provider is genuinely capable or just commercially aggressive. Ask any provider you evaluate:

Where are your analysts based? Some managed SOC providers outsource tier 1 triage to offshore teams. For Australian businesses with data sovereignty requirements or sensitivity about where security data is processed, this matters. Code Hyper One's security operations are delivered from Australia with Australian-resident engineers.

What is your analyst-to-client ratio? A SOC stretched too thin misses things. Ask for specifics.

Do you include SIEM management or just consume the logs? Some providers assume you manage the SIEM and they only watch the alerts. Code Hyper One manages Sentinel – including log source onboarding, detection rule development, and platform maintenance – as part of the managed SOC service.

What automated response capability do you have? Ask whether containment actions (device isolation, account suspension) are automated, manual, or a combination. Code Hyper One's SOAR playbooks initiate automated containment within minutes of confirmed P1 detections.

Can you show me a sample monthly report? If the report is generic, the monitoring will be too.

What happens to our security data if we terminate the service? Understand data retention and offboarding procedures before you sign.

For a broader guide to what separates good SOC providers from average ones in the Australian market, read our guide on building a security operations centre.