A senior-analyst-led SOC for your Microsoft estate. No agent to install, no platform to migrate to, and no alert dumps: threats are contained for you, at the authority level you set.
The same five steps for every detection. Where they end depends on the authority you give us.
Your Microsoft telemetry stays where it is. Our detection rules run inside your Sentinel workspace and Defender suite, tuned to fire on real attacker behaviour rather than noisy defaults.
An analyst takes ownership of every high-severity alert within 15 minutes. That is our operating number, not a contractual minimum we rarely hit.
A senior analyst decides true positive or false positive, then establishes scope, timeline, and blast radius across identity, email, endpoint, and cloud. False positives die here, not in your inbox.
Confirmed threats are contained per the authority level you set: we guide your team, act on your approval, or act immediately under a pre-agreed matrix. Never unilaterally outside it.
Every incident closes with a plain-language report: what happened, what we did, what to fix. Written by the analyst who worked it, readable by your leadership.
The first question to ask any MDR provider: do you recommend, or do you take action? Here is our answer, in writing.
Session / token revocation (Entra ID) · Device isolation (Defender for Endpoint) · Account disable · Process kill & file quarantine · Conditional Access block (risky sign-ins)
We triage, investigate, and escalate confirmed incidents with step-by-step remediation guidance. Your team executes the five actions; we stay on the line.
We stage the containment action and execute all five the moment you approve on the dedicated channel. One message, not a project.
For high-severity incidents we execute first, under an authority matrix agreed per action type at onboarding, then walk you through what happened.
We work inside your tenant, so nothing is hidden behind our portal. And every incident closes with a report like this one, redacted from a real engagement.
Agent-based MDR asks you to install their platform next to the licenses you already pay for. We do the opposite: we operate the Microsoft security stack you own, across every surface an attacker would touch.
Deep on Microsoft rather than shallow on everything. That is the trade we made on purpose.
What is listed is what is included. The only metered item is DFIR beyond the Elite retainer, billed by the hour.
Sized by user count and tenant complexity. You get an exact quote after the free review, and the price you sign is the price at renewal.
Automated detection with business-hours analyst support. We triage and investigate; your team executes containment with our guidance.
Extended coverage with hands-on containment. We detect, investigate, and contain threats; your team stays focused on business.
Full 24/7 human response with a DFIR retainer, named analyst, and network-level protection. Enterprise-grade security operations.
No renewal upcharge and no gated hunting. Month to month after a 90-day initial term.
The category earned its reputation. Here is what changes.
And if the plan is to build instead: continuous in-house coverage takes four to six analysts at roughly €90-120k each, 12 to 18 months to stand up. MDR is live in weeks, at a fraction of one hire.
EU / Nordic operations · Your Sentinel workspace · GDPR · NIS2
Logs, alerts, and incident records never leave your Microsoft tenant. We work through scoped, revocable access, and every action we take is logged where you can audit it.
We tried to deploy Microsoft Sentinel ourselves and spent 9 months drowning in alerts and spiralling costs. Falconer optimised our deployment in 3 weeks. Costs down 64%, false positives down 80%, and we caught a PHI access attempt in the first month that our old setup would have missed.
Detections are written against real attacker behaviour across identity, email, endpoint, and cloud, and tuned to your environment during onboarding. Ask us what we cover and where; you will get a straight answer.
The rules of engagement are agreed before the first alert, so nobody improvises during an incident.
A free 30-minute call about your environment and requirements. We recommend a tier and give you the budgetary picture. No pressure, no obligation.
Technical review of your Microsoft estate sets the detection baseline. Together we agree the authority matrix, per action type, and the escalation channels.
Monitoring deployed, detection rules tuned to your environment, channels tested with a live drill. A dedicated onboarding contact throughout.
Detections tuned, hunting on cadence per your tier, quarterly reviews. Reaction-time actuals reported every month, not just the good ones.
Your named approvers, the authority tier you grant us, and the numbers we call at 03:00, fixed in writing before we go live.
Reviewed at the quarterly service review and again whenever you change tier, so the authority we hold is always the authority you last agreed.
We take action, to the level you authorise. Essential customers get investigated incidents with step-by-step guidance. Professional customers get hands-on containment on their approval. Elite customers get pre-authorised response: we contain first and brief you after. We never act outside the authority matrix you set.
Five actions, in writing: session and token revocation in Entra ID, device isolation via Defender for Endpoint, account disable, process kill and file quarantine, and Conditional Access blocks on risky sign-ins. Anything beyond those is guided remediation with your team.
An analyst takes ownership of high-severity alerts within 15 minutes. That is our operating number, and we report the actuals to you monthly. We do not publish a financially-backed SLA we could only honour on paper.
Sentinel is our detection platform and we deploy it as part of onboarding; if you already run it, we optimise your existing workspace. Essential engagements lean on your Defender and Entra ID signals with a centralised hub, so you are covered while Sentinel is stood up.
Included: weekly from Professional, continuous with Elite. Essential includes monthly detection tuning instead. Nothing is free in year one and charged at renewal.
Inside your own Microsoft tenant, in your Sentinel workspace. We operate with scoped, revocable access from the EU, and every action we take is logged where you can query it.
Elite includes a 10-hour-per-month DFIR retainer, so a major incident starts with responders who already know your environment. Beyond the retainer, and for other tiers, DFIR is billed by the hour at a rate agreed up front.
A Microsoft security specialist reads every message and replies, usually within one business day. Whether you need monitoring, help with a specific tool, or just have a question, start here.
New to this? Ask about a free Microsoft security review as a starting point.
"*" indicates required fields
