Remote plan

Your SOC, run from ours.

Nobody sits in your office. Our SOC hub watches your security logs 24 hours a day, triages every alert, contains what you've approved, calls you about the rest, and sends you locked PDF reports you can hand straight to an auditor.

Open the sample dashboard See the reports

Remote · monthly fee

RM 19,000 / month

Excluding SST. Fixed for the first 12 months.

Coverage: 24x7x365
Included: 1 site · 30 log sources · 150 endpoints
Log retention: 90 days searchable · 12 months archived
Extra log sources: RM 900 / 10
Extra endpoints: RM 600 / 50
Onboarding (one-off): RM 19,000
Minimum term: 12 months

Price my setup

What you get

Included in every month.

24x7 monitoring

Our hub analysts watch your security logs around the clock, including weekends and public holidays, when most attacks are launched.

Triage of every alert

Each alert is checked: real or false alarm, how serious, which users and systems. P1 triage starts within 15 minutes.

Approved containment

Isolate a laptop, disable an account, block an IP. Only the actions you signed off, only on the assets you allowed, at 3 am if needed.

AI does the legwork

AI enriches every alert: who the user is, what the host has been doing, whether the IP is known-bad. An analyst makes every call.

Escalation and notification facts

We phone your on-call contact for anything confirmed, and give you a fact sheet within 3 hours of a P1 for any NACSA or PDPA notification.

Read-only dashboard

Named staff get a view-only login: open cases, log source health, containment actions. Nobody can change or delete history.

Locked PDF reports

Monthly, incident and quarterly reports, sent as softcopy PDFs with editing disabled. Details below.

Quarterly review and yearly tabletop

Your service delivery manager visits each quarter, and once a year we run a ransomware tabletop exercise with your team.

Reports

What lands in your inbox, and when.

All reports are emailed to the recipients you name in the escalation matrix. Formal reports are PDF only. We don't send Word or Excel versions.

Report	When	Format	What's in it
Monthly Security Report	By working day 5	Locked PDF	SLA scorecard, alert funnel, incidents by severity, containment actions, top threats, log source health, ATT&CK coverage, risk observations, recommendations.
Security Incident Report	Within 3 working days of a P1 closing	Locked PDF	Timeline from first alert to containment, scope, actions taken and who approved them, likely entry point, follow-up actions.
Notification fact sheet	Within 3 hrs of a qualifying P1	Locked PDF	What happened, when it was detected, systems and data affected, actions taken. Laid out so your officer can file the notification. You submit it.
Quarterly Service Review pack	Quarterly, before the meeting	Locked PDF	Three-month trends, SLA history, recurring threats, detection coverage changes, signed minutes afterwards.
Log Source Coverage Register	Monthly, as an appendix	Locked PDF	Every connected log source, its owner, criticality, method and whether it reported all month.
Annual Security Summary	Every 12 months	Locked PDF	The year's incidents, containment actions, SLA attainment and tabletop results. Written for management, auditors and regulators.
Daily security email	Every working day, 9:00 am	Email	Overnight alerts, open cases, silent log sources. For your IT team; not a formal record.
Incident updates	P1 every 30 min, P2 every 4 hrs	EmailPhone	Status, next action and next update time while a case is open.

Why locked PDFs

Editing, page changes and form filling are disabled, so what your auditor reads is exactly what we issued. Printing and copying text stay allowed.

Traceable

Each report carries a document number, version, reporting period, issue date and the name of the analyst who prepared it.

Re-issued on request

We keep every issued report for the length of the contract, so you can get any month again for an audit.

AI-assisted operations

AI gathers the evidence, analysts make the call.

Most of an analyst's time goes into looking things up: who is this user, what else did this laptop do, is this IP known to be bad. The AI does that the moment an alert fires, so the analyst starts with a picture instead of a blank screen.

Correlate
Detection rules and the AI watch every event. Related alerts across firewall, identity and endpoint become one case, so one phishing attack shows up as one problem, not 30.
AI · seconds
Enrich
User role and recent sign-ins, host history, IP and domain reputation from threat intel, whether the file has been seen before.
AI · read-only
Score and explain
A suggested severity and verdict, the ATT&CK technique it matches, and the evidence behind it.
AI suggests
Decide
The analyst reviews, confirms or rejects, and decides on severity. Only analysts declare incidents.
Analyst decides
Contain
If the action is on your approved list, the analyst triggers it. If it needs your approval, we call you first.
Analyst acts
Draft the report
AI drafts the timeline and incident report from the case. The SOC Lead edits and signs off before it's issued.
Lead signs off

Guardrails

AI can't take action

The AI only reads: logs, EDR telemetry, directory lookups and threat intel. Every containment action is triggered by a named analyst and logged against their name.

Containment is your list

The actions we may take, the assets they may touch and who must approve are written into your contract. Crown-jewel systems always need a phone call first.

Every action reversible and logged

Each containment action is recorded with time, analyst, approval reference and when it was lifted, and listed in the monthly report.

Your data stays yours

Logs stay in your environment or our Malaysian-hosted tenant. Your data is not used to train AI models, and the AI providers we use are named in your contract, in line with PDPA 2010.

Logs, not content

We see who logged in where and what ran, not the contents of your emails, files or chats, unless a log source itself contains them and you've approved it.

Clearly marked

Reports show which sections were AI-assisted and who reviewed them, so your auditor knows how each conclusion was reached.

Samples

See them before you sign.

All samples use a fictional company, Syarikat Contoh Sdn Bhd, and mock data. Your reports follow the same layout with your own numbers.

LIVE DASHBOARD · SAMPLE

SOC dashboard

The read-only view your staff get: open cases, alert funnel, log source health and containment actions.

Open dashboard

PDF · OCTOBER 2026 · SAMPLE

Monthly Security Report

Four pages: summary, SLA scorecard, alert funnel, incidents, containment, threats and the log source register.

Download PDF View in browser

PDF · P1 · SAMPLE

Security Incident Report

A phishing email that led to a compromised account and a fraudulent payment request, stopped at 2 am.

Download PDF View in browser

Log sources, vendors and containment

What we can watch.

Supported log sources and vendors, what we detect on each, what we can contain, and what you need to install. The same for every plan.

See what we support

Limitations

What a remote SOC can't do.

We'd rather you know these now than find out during an incident.

We see only what's logged

If a system isn't sending logs to us, we can't see an attack on it. A server without logging, a SaaS app without an audit log, or a source that quietly stops sending is a blind spot. We flag silent sources within 24 hours.

No guarantee of prevention

We shorten the time between an attack starting and someone acting on it. We can't promise every attack will be caught, and a skilled attacker who leaves no trace in your logs can go unseen.

Containment needs the right tools

Isolating a laptop needs an EDR with isolation in your licence tier. Disabling accounts needs an API role. Without them, we call you and your team acts.

Not forensics

We find out what happened from logs, enough to contain and report. Disk and memory forensics, malware analysis and court-grade evidence need a DFIR firm. We can recommend one and hand over everything we have.

We don't fix it

Removing malware, rebuilding a server, patching and hardening are for your IT team or a project. We tell you what needs doing and check the logs once it's done.

No hands on-site

We can't unplug a cable or pick up a laptop. If you need someone in the room during an incident, see the Essential or Standard plan.

When your site goes dark

If your internet or the log forwarder goes down, we stop seeing that site. The forwarder buffers up to 24 hours and sends when it reconnects, so we review the gap afterwards.

Regulatory filings are yours

We give you the facts, fast. The organisation filing a notification with NACSA, the PDP Commissioner or another regulator must be you.

Not a NOC

We don't watch whether your network and servers are up. That's our NOC service, and you get 10% off the SOC when you take both.

Next step

Send us your systems list and we'll confirm coverage.

We'll tell you which log sources we can take in, which containment actions your tools allow, and what the monthly fee comes to.

[email protected]