24/7 managed SOC · Israel · Mexico · Europe
Someone is watching your network at 3am. Make sure it's us.
24/7 managed SOC for mid-market companies in Israel, Mexico and Europe. A human analyst triages every alert in under 15 minutes, not in a queue for business hours.
How the SOC works
From raw events to a phone call
Detection runs on proven EDR and SIEM platforms. Cybool analysts in Tel Aviv do the triage, the containment and every conversation with your team.
- events / day
- 8.6M
- events / day
- alerts
- 312
- alerts
- incidents
- 26
- incidents
- escalations
- 2
- escalations
Collect
Endpoints, cloud accounts, identities and mailboxes stream telemetry to the SOC around the clock.
Detect
Correlation rules and threat intel turn millions of events into a short list of alerts worth a human look.
Triage
An analyst reviews every alert, target under 15 minutes, and separates noise from a real intrusion.
Respond
We take the containment steps you approved, then your named analyst calls you and follows up in writing.
SOC in numbers
What you get, stated plainly
- Alert triage target, day and night
- < 15 min
- Monitoring, weekends and holidays included
- 24/7/365
- Named analyst who knows your environment
- 1 analyst
- Default location for your security data
- EU
Response times are operating targets, not contractual SLAs. Contractual terms are set in your service agreement.
"We already have Defender."
Good. Keep it. Here is what it does not do.
Microsoft Defender, like any EDR, raises alerts. Someone still has to read them at 3 a.m., decide which one is an attacker and act.
| Cybool SOC | Defender alone | Typical MSSP | |
|---|---|---|---|
| Human triage of every alert | IncludedUnder 15 min, 24/7 | Not included | PartlyOften queued |
| Calls you at 3 a.m. | Included | Not included | PartlyUsually a ticket |
| Containment | IncludedSteps agreed in advance | PartlyAutomated rules only | PartlyVaries by contract |
| Named analyst | Included | Not included | Not included |
| Full data export at exit | Included | Not included | PartlyVaries by contract |
Case timeline
12 minutes from signal to containment
A mid-market company, a stolen VPN login and a ransomware crew preparing to encrypt.
02:31VPN login outside the user's normal pattern raises an alert
02:35 – 02:46Attacker enumerates Active Directory and backups; SOC correlates the chain
02:47PowerShell disables Defender: host isolated, VPN cut, account disabled
02:47 – 02:59Named contact called; CISO on the phone with the analyst
02:59Containment verified. No files encrypted
Method: times from the SOC case log. Elapsed time runs from the first containment-eligible signal (02:47) to verified containment (02:59). Client details anonymized.
Read the full timelinePrograms
Choose your protection level
All programs include onboarding, a dedicated analyst, and quarterly reviews.
Email & GRC
No SOC monitoring
Email protection and ISO 27001 readiness, without 24/7 monitoring. Add the SOC when you are ready.
Quoted per user
after a short call
- Email security & anti-phishing
- Phishing simulation & user training
- ISO 27001 gap analysis
- GRC platform access
- Monthly compliance report
Business
Most popularMost requested plan
Complete managed security: detection, response, cloud, and compliance in one program.
Quoted per endpoint
after a short call
- Everything in Email & GRC
- 24/7 SOC / SIEM / MDR
- Identity Threat Detection (ITDR)
- Cloud security review (AWS, GCP, Azure)
- Annual ethical hacking
- Monthly executive security reporting
- Incident containment & response
Enterprise
Custom enterprise pricing
Maximum coverage for complex, multi-regional, or regulated organizations.
Custom pricing
scoped to your environment
- Everything in Business
- Corporate OSINT & vendor risk intelligence
- Red team exercises
- Digital forensics retainer
- Dedicated vCISO advisory (hourly)
- Multi-region compliance (NIS2, GDPR, HIPAA)
12-month minimum term, billed monthly. Leave with 60 days' notice and get a full export of your data, with no exit fee.
What we do
The SOC first. The rest from the same team.
- 24/7 SOC and MDRManaged detection and response across endpoints, identities and cloud, with a human on every alert.
- GRC and ISO 27001Your SOC evidence organized for ISO 27001, NIS2 and SOC 2 audits. One fintech client certified in 54 days.
- Email securityAI-driven protection against BEC, spear-phishing and impersonation, run by our analysts.
- Pentest and red teamNetwork, web, cloud and red team exercises by offensive security specialists.
- Cloud and SaaS securityConfiguration review and hardening for Microsoft 365, AWS and Google Workspace.
- Risk assessmentA clear picture of your cyber risk and a prioritized roadmap your board can read.
- Incident responseRetainer-based response for when something has already gone wrong.
Corporate OSINT
We find your exposure before attackers do.
- Credential breach detection
- Dark web and breach sources checked for employee credentials tied to your domain.
- Infrastructure misconfiguration
- Exposed ports, expired certificates, open cloud storage and misconfigured services, found passively.
- Regulatory risk mapping
- Your exposure mapped against ISO 27001, NIS2 and GDPR requirements.
> passive OSINT scan: target.com> enumerating subdomains...[CRITICAL] 3 admin credentials found in breach data[CRITICAL] RDP 3389 exposed on 185.x.x.x, no MFA[HIGH] expired TLS certificate on mail.target.com[HIGH] public repo leaking .env with DB credentials[MEDIUM] SPF misconfigured: domain can be spoofed> mapping regulatory exposure (ISO 27001 / NIS2)[HIGH] 4 NIS2 Article 21 controls unaddressed> report ready in 2 business days
FAQ
The questions buyers actually ask
We already have Microsoft Defender. Why do we need you?
Defender raises alerts. Someone still has to read them at 3am, decide which one is an attacker and act. That is the service: a human analyst triages every alert within 15 minutes, takes the containment steps you approved in advance, and calls you.
Are we too small to be a target?
Ransomware groups do not filter by company size. Our live ransomware map shows hundreds of new victims every month across every sector. Size mostly decides how long an attacker goes unnoticed.
What does it cost?
Business is quoted per endpoint and Email & GRC per user, after a short call. Enterprise is priced to scope.
How long is the contract, and can we leave?
The minimum term is 12 months, billed monthly. You can leave with 60 days' notice, and we hand over a full export of your data with no exit fee.
Who actually watches our alerts?
Detection runs 24/7 on proven EDR and SIEM platforms. Cybool analysts handle triage, escalation and every conversation with your team, and you get a named analyst who knows your environment.
Where is our data stored?
In the EU by default.
How fast do you respond?
Our target is human triage of every alert within 15 minutes, 24/7/365. It is an operating target, not a contractual SLA. Contractual terms are set in your service agreement.
Is Cybool ISO 27001 certified?
No, Cybool is not ISO 27001 certified today. Our team holds ISO 27001 Lead Auditor certification and runs ISO 27001 programs for clients.
Are you local to us?
Our analysts are based in Tel Aviv, Israel, and we work with companies in Israel, Mexico and Europe, in English, Spanish and Hebrew.
Start with what is exposed
Your exposure report takes 2 business days. A breach takes minutes.
Find out what an attacker can already see about your company, then decide what to fix first.
Free · Passive checks only · Report in 2 business days