Managed SOC Operations
You sell the SOC; we staff it. Our analysts work inside your zcrSIEM tenant around the clock from Bangkok, closing the noise and escalating what is real with the investigation already written down. Your customer keeps calling your service desk, because as far as they can tell your service desk is where the analysts sit.
$4.43USDper endpoint / month
List $5.90 — what your customer pays. You keep the difference. · 25% off list
- Priced by
- per endpoint / month
- Delivered as
- Your brand, your template
- Client access
- Scoped, granted by your customer
- Runs on
- zcrSIEM
Scoped before you quote, not after you have sold it
Monitoring runs 24/7 from Bangkok on UTC+7, so the quiet hours in your market are working hours in ours.
Analysts work inside your own zcrSIEM tenant under accounts you issue — the case history and the audit trail stay in your platform, not in a portal we own.
Escalations arrive written: what fired, what we confirmed, what we already contained, and the one thing we need your engineer to do.
False positives are tuned at source rather than forwarded twice — noise reduction is part of the monthly unit, not a change request.
Shift handover notes are written at every rotation, so the analyst who picks up your case at 3am knows what the previous one saw.
Severity definitions and response targets are agreed in writing per partner before go-live, not interpreted during an incident.
You quote it, we operate it, you deliver it
Your price is the published list price minus 25%, on every line in the catalogue. You decide what your customer pays and keep the difference, so your margin is settled before the quotation leaves your office.
Our engineers work it from Bangkok on UTC+7, against a methodology that is written down rather than improvised per customer. A senior engineer reads every finding before it leaves the building, because you are the one who has to defend it.
Findings, reports and escalations reach you in your template with your logo on them. Your customer talks to you, and our name is not on the ticket.
What a partner checks before putting this on their price list
Can my customer tell you are involved?
No — every ticket, report and escalation carries your brand, and we never contact your customer directly. Cyber Defense has no direct sales team, so there is no route by which we could approach them even by accident.
Which SIEM do you support?
SOC monitoring is delivered on zcrSIEM, the platform we build ourselves under the zcr.ai brand. That is deliberate: because we operate on a platform we own, one detection runs a single query across every tenant and your twentieth customer costs us almost nothing extra, which is what keeps the monthly unit where it is.
Do we have to buy the platform from zcr.ai as well?
Yes — the tenant runs on zcrSIEM, licensed from zcr.ai. You can buy the platform there and the operators here, or take both together. We do not run on tooling rented per customer, because that would put somebody else's licence cost inside your price.
Who talks to the customer when something is confirmed?
You do — we escalate to your named contacts with the case written up and a recommended action, and the conversation with the end customer is yours and stays yours. If your team wants us to keep working the case in the background while you talk, that is the normal pattern.
Can we run our own analysts alongside yours?
Yes, and the split is usually by shift or by tier. Either your team covers local business hours and we cover nights and weekends, or your team owns the customer relationship and escalation while we own triage.
What happens when we add customers?
Each end customer is a separate tenant, billed per endpoint per month with a monthly minimum per end customer — both numbers are on the price list — and there is no re-scoping exercise. Onboarding the twentieth customer is the same process as the first, which is the whole point of us running on our own platform.
Pick one customer. We will run it for 60 days.
Choose a customer you already serve. We deliver Managed Exposure on their domain for two months, in your template, at no cost — so you can see exactly what your customer would receive before you sign anything.
Apply as a partner