- Home
- Managed Detection & Response
- Managed SOC
The same SOC.
You decide how much runs on its own.
MSOC, delivered as a managed service. Run it fully autonomous, or human-in-the-loop, where our senior analysts review and sign off before anything irreversible happens. Detection stays under two minutes either way, because the machines never queue.
One SOC, with a setting for how much it decides alone.
There is one managed SOC at Mjolnir: MSOC. A workforce of 36 AI employees detects, triages, investigates, hunts, responds and reports around the clock, against 1,700+ detection rules across 17 MITRE categories. This page is about how you buy it: as a managed service, with our people accountable for the outcome.
Operating mode is a setting, not a tier. In autonomous mode, MSOC contains threats inside boundaries you agree with us in advance. In human-in-the-loop mode, MSOC still detects, enriches, investigates and prepares the response, then a senior analyst reviews it and signs off before anything irreversible happens: isolating a host, disabling an account, blocking at the firewall.
Human-in-the-loop does not slow detection down. The machines never queue, so you still get sub-2-minute detection; the only thing that waits is the decision. When you are comfortable, switch to autonomous. It is a setting, not a migration.
- 24/7 detection, triage, investigation and response by MSOC, across 500+ supported data sources
- Response boundaries agreed in writing: what may run on its own, and what waits for sign-off
- Senior analyst review and sign-off on every irreversible action, in human-in-the-loop mode
- A full log of every alert, decision, action and approval, ready for auditors and insurers
- Continuous threat hunting and breached-credential monitoring as part of the service
- Regular operational and executive reporting, with a named point of contact
From scoping call to live in 21 days.
Choose the model
Complete if you own no security stack, Overlay if you do. We scope the data sources and the environment on one call.
Set the boundaries
We agree which actions may run on their own and which need a senior analyst's sign-off. Most clients start human-in-the-loop.
Connect and tune
Data sources are connected and detection is tuned to your environment, so the alerts that reach a decision are the ones that matter.
Operate, 24/7
MSOC detects and investigates continuously. Containment runs inside your boundaries, or waits for sign-off, depending on the mode you set.
Review and adjust
We review what ran, what waited and what it found. Widen the autonomy when the record earns it.
Three starting points,one SOC.
You own no security stack
Everything from us: the platform, the detection, the response and the people. Nothing for you to buy, run or integrate first.
You already own a stack
We run MSOC on the tools you already pay for. Your SIEM and EDR stay; what changes is that someone is driving them around the clock.
You want humans by default
Either model, with a senior analyst signing off before anything irreversible happens. Detection speed is unchanged; switch to autonomous when you are ready.
What changes, and what does not.
| Autonomous | Human-in-the-loop | |
|---|---|---|
| Detection | Under 2 minutes | Under 2 minutes |
| Triage and investigation | MSOC, continuously | MSOC, continuously |
| Containment | Runs inside the boundaries you set | Prepared by MSOC, executed after senior sign-off |
| Audit trail | Every action logged | Every action and every approval logged |
| Changing mode | A setting | A setting |
Residency built in.
We deploy to meet each client's data-residency requirements, including in-country where regulation requires it. Aligned with the UAE PDPL, Saudi PDPL and Singapore PDPA.
Who it is for
Organizations with no SIEM of their own, or one they pay for and do not use, who want a SOC running tonight without hiring one. And anyone who wants that SOC with a senior human signing off on every irreversible action until they are comfortable letting it run.
- MSOC, the platform and its 36 AI employees
- MDR, if all you need is your EDR run for you
- IR retainer, the response team on contract, at agreed terms
- Threat hunting, analysts looking for what no alarm flagged
From real engagements.
A suspected BEC, correctly cleared
A suspected business email compromise was investigated and correctly cleared.
Guardrails that held
Response guardrails stopped noisy triggers from auto-isolating a domain controller and a firewall.
Credentials caught early
Breached credentials surfaced by continuous monitoring were flagged and reset.
Client identities withheld pending permission. Named references and logos available on request.
What buyers ask.
We don't trust AI on our network.
Then start human-in-the-loop. MSOC acts inside boundaries you set, everything is logged, and nothing irreversible happens without a senior analyst's sign-off. Move to autonomous when the record has earned it, or never.
Doesn't human review make it slow?
Not detection. The machines never queue, so detection stays under two minutes. What waits is the irreversible decision, and it arrives at our senior analyst already investigated, with the evidence and the proposed action attached.
How is this different from MSOC?
It is MSOC. This is the managed service around it: our people own the boundaries, the sign-offs, the reporting and the outcome. There are two deployment models, Overlay and Complete, and the operating mode is a setting on either.
We already have a SIEM and an EDR.
Good. MSOC Overlay runs on the tools you already own. Most are bought and never tuned; we drive them around the clock.
Where does our data go?
We deploy to meet each client's data-residency requirements, including in-country where regulation requires it.
Same SOC. Your setting.
Talk to sales about the model and mode that fit your environment. Scoping is with an engineer, no charge.