24/7 monitoring and incident response: what it actually means

What does "24/7 monitoring" actually mean?

That signals flow in continuously and an escalation chain is permanently armed, not that a team stares at a screen all night. Events are collected and correlated without interruption; those crossing a threshold agreed with you raise an alert, then a phone call if the threshold is critical.

The distinction matters, because the phrase is used for very different arrangements. Some amount to collection nobody looks at before the next morning; others involve an on-call rota that is genuinely reachable.

The question to ask any provider is therefore simple: what exactly happens at three in the morning, who gets called, and within what delay. The answer belongs in the contract.

We prefer to state it ourselves rather than let the phrase do the work. What we operate is an armed on-call arrangement with agreed escalation criteria, not continuous human presence, and there is no reason to present it otherwise.

What is monitored?

The perimeter is agreed with you and recorded: endpoints and servers, remote access, email, backups, security appliances. What is not on the list is not monitored, and that is precisely the point that must be explicit, because it is where misunderstandings arise after an incident.

• Endpoints and servers. Detection of abnormal behaviour, not only of known signatures.
• Access. Sign-ins from unusual places or at unusual hours, repeated failures, privilege escalation.
• Email. Creation of automatic forwarding rules, bulk sending, suspicious sign-ins, often the first sign of a compromised account.
• Backups. Silent failure, changes to retention policy, deletion of restore points. An attacker goes after backups before encrypting.
• What is not covered. Line-of-business applications hosted by a third party, a vendor's equipment, undeclared industrial environments. That list is written down too.

How does incident response unfold?

In five stages, in this order: qualification, containment, internal communication, regulatory notification where required, then post-incident analysis. Order matters: acting before qualifying frequently destroys the evidence needed later.

• Qualification. Is this a real incident, what is its scope, which systems and which data are involved. The step is short but it is not optional.
• Containment. Limit spread without destroying evidence: isolate rather than rebuild, preserve logs before they roll over.
• Internal communication. Who is informed, in what order, and who speaks externally. Decided in calm conditions, not during.
• Regulatory notification. If personal information is affected and a risk of serious injury exists, the Commission d'accès à l'information and the affected individuals must be notified with diligence.
• Post-incident analysis. What allowed entry, what worked, what was missing. Without this step, the same incident recurs.

What do you receive between incidents?

A periodic report stating what was detected, what was handled, and what changed in your exposure. It is written for a management team: it names business consequences, not vulnerability identifiers.

The report serves two distinct purposes. The first is operational: deciding what deserves fixing. The second is evidential: it is the record insurers, enterprise customers and, where applicable, an investigator will ask for.

It also contains what was not done, and why. A report showing only successes does not help anyone decide.

It is also the moment the perimeter gets revisited. An organization changes (new tools, new sites, departures)and a perimeter defined once and for all goes stale within months.

Frequently asked questions