Home/Case studies/Managed Security Response

Managed security that ends in a fix

We run managed security for VLI across its endpoints, Microsoft 365 and identity, with the engineering capability to investigate what the monitoring finds and make the change in VLI’s environment. Each alert is assessed against the systems and users involved, and a confirmed issue is followed through to the fix.

See how the service worksManaged Cyber Security

The brief

Good controls still need someone watching them, and someone who can act

VLI supplies heavy equipment to mining and industrial customers. Its staff, devices and Microsoft 365 accounts had sound security controls around them, and the job was to keep those controls under review as the business and its systems changed.

The investigations draw on what we know of VLI’s environment, including how the affected systems are configured and what depends on them. Where a finding needs a change, the work is done and tracked inside the managed service, not left as a recommendation for someone else to pick up.

How the service works

How an alert gets dealt with

Unusual activity comes in with the device and user attached. We assess what it means for VLI, make the change in the system if one is needed, and record what we found and what we did for management.

  1. SignalEndpoint protection, sign-in activity and Microsoft 365 settings are under review, and an alert arrives with its context
  2. AssessWe weigh the severity, who and what is affected and the effect on operations, then contain, escalate or keep watching
  3. ActA confirmed finding becomes a change to protection policies, access, authentication or Microsoft 365 configuration
  4. ReportManagement sees what was monitored, what was reviewed, what was escalated and what changed
  5. ReviewThe review keeps going as the business and its systems change

What we delivered

What the service covers

  • Endpoint and sign-in activity reviewed together

    We manage endpoint protection and review suspicious activity alongside the relevant account’s sign-in history. If a device alert and an unusual sign-in concern the same user, we examine the activity together to establish whether the events are connected.

  • Accounts and access under review

    Administrator privileges, MFA coverage and security configuration stay under review across Microsoft 365 and Entra ID, and we read sign-in patterns, identity risk signals and mailbox behaviour in the same pass, so account activity and access controls are judged together.

  • Findings that become changes

    When a finding is confirmed, we change the MFA or authentication settings, the access or the Microsoft 365 configuration, and remediate the mailbox or account where that is needed. Each change is tracked through to completion and recorded.

  • Reporting management can use

    VLI’s management receives regular reporting on what is monitored, the alerts reviewed, the escalations raised and the improvements made. The service is judged on what it found and what changed as a result.

Who fixes what we find

Monitoring, investigation, remediation and the reporting to management run as one service across VLI’s endpoints, Microsoft 365 and identity.

Under review as things change

Endpoints, Microsoft 365 and identity stay under review, with an engineer’s attention as the environment changes.

A known path for each alert

A confirmed alert is assessed, escalated if it needs to be, communicated and followed through, and VLI knows that path in advance.

Security improvements on record

Findings become policy, access and configuration changes, and the reporting keeps those improvements visible to management.

Endpoint protectionMicrosoft 365Microsoft Entra IDAdministrator privilegesMFA and authenticationSign-in and identity riskMailbox behaviourAlert triageEscalationAccount and configuration remediationSecurity reporting
Next step

Who acts on your security alerts today?

Describe what is in place and what happens when an alert fires, and we will show you how we would run it.

Discuss managed security