24/7 detection and response, with an engineer on call at 3am.
We watch your Macs, sign-ins and email around the clock. When an account is confirmed compromised, it is suspended within 5 minutes, and a Stabilise engineer picks up every escalated case within 30 minutes, whatever the hour. It runs on the tools you already have: Jamf, Okta, Google Workspace or Microsoft 365, and your endpoint protection. Included in Premium, and available as an add-on to Professional.
Why This Lands On Your Desk
Sooner or later, someone asks who responds overnight
Attacks rarely keep office hours, and the people checking your security know it.
Cyber insurance forms
Applications ask whether you have round-the-clock monitoring and response, often as a straight yes or no. A no can mean a higher premium or questions you cannot answer well.
Client security reviews
Enterprise clients, studios and broadcasters ask what happens if an account is taken over on a Friday night. "Our IT provider picks it up on Monday" is the answer that stalls a contract.
Audits and due diligence
SOC 2 and ISO 27001 auditors, and investors doing their checks, look for continuous monitoring with a named response. Every alert, verdict and action here is logged, so the evidence is already there.
How It Works
What happens when an alarm goes off at 3am
Machines handle the first minutes, because that is when an attacker moves fastest. People handle everything that needs judgement.
Something trips an alarm
Your endpoint protection, Okta or Google flags it: a sign-in from a new country, a malicious file on a Mac, a mailbox rule quietly forwarding email outside the company.
A verdict in seconds
The platform checks the alert against your setup and decides whether it is real. If it needs the user, it asks them in Slack or Teams, with a code by text so an attacker holding their account cannot answer for them.
Contained within 5 minutes
Once an account is confirmed compromised, it is suspended and its sessions are ended. An infected Mac is cut off from the network or locked. None of this waits for office hours.
An engineer within 30 minutes
Every escalated case pages the Stabilise engineer on call. They check what happened, finish the clean-up and make the calls automation should not. The case summary is waiting for your team in the morning.
Who Is Awake
Ask any 24/7 provider who is awake. Here, it is one of us.
Most round-the-clock services pass the alert back to you, or to a call centre that has never seen your setup. Ours pages a Stabilise engineer on an on-call rota. They already manage your Macs, Okta and Google, so they can finish the fix instead of writing you a ticket about it.
The rota is for security cases. Everyday requests stay Monday to Friday, 09:00 to 18:00, with the response targets set by your plan.
5 min
to suspend an account once it is confirmed compromised
30 min
for an engineer to pick up an escalated case, any hour
24/7
monitoring of Macs, sign-ins and email
90 days
of searchable alerts, verdicts and actions
What It Covers
What it watches, and what it does about it
It watches
- Macs and PCs, through Jamf Protect, Microsoft Defender, CrowdStrike or SentinelOne
- Sign-ins and accounts, through Okta, Google Workspace or Microsoft Entra
- Email threats from Microsoft 365, Google or your email filter
- GitHub, 1Password, AWS and the Claude and OpenAI admin consoles
When a threat is confirmed, it
- Suspends the account, ends its sessions and forces a new password
- Isolates an infected Mac from the network, or locks it through Jamf Pro or Iru
- Quarantines the malicious file
- Asks the user to confirm odd activity in Slack or Teams
- Logs every alert, verdict and action, searchable for 90 days
Named people get a human decision. Founders, finance and anyone else you name are never suspended automatically. Alerts on their accounts go straight to the engineer on call.
What it is for. It is built to catch attackers and compromised accounts, not to police what trusted staff do with access they already have. For the rest of your security, see our Enterprise Security service and how the plans compare on the Stabilise Platform.
Detection and response questions, answered
Is this the same as MDR?
Close, with one difference in who does the first pass. Managed detection and response usually means analysts reviewing alerts by hand, often in another time zone, before anyone acts. Here the first pass is automated, so a confirmed threat is contained in minutes, and the people behind it are our engineers, who already run your Macs and accounts.
Who answers at 3am?
A Stabilise engineer on our on-call rota. Every escalated case pages them, and they are on it within 30 minutes. The rota is for security cases only, so a forgotten password or a broken printer at night still waits for 09:00.
Will it lock our founder out in the middle of a pitch?
No. You name the people who must never be suspended automatically, usually founders, finance and anyone who travels a lot. Alerts on those accounts skip the automation and go straight to the engineer on call, who decides what happens next.
Where is our data held?
In the United States. The detection platform we use runs on Amazon Web Services in the US and does not offer UK hosting yet. The transfer is covered by the UK Addendum to the EU standard contractual clauses in the provider's data processing agreement, and the provider goes on our sub-processor register before it connects to anything of yours.
Do we need new software?
Usually not. It connects by API to what you already run: Jamf, your identity provider, your endpoint protection and Slack or Teams. To cut an infected Mac off the network you need Microsoft Defender, CrowdStrike or SentinelOne. With Jamf Protect alone, the Mac is locked instead.
Can we try it before committing?
Yes. We connect it to your tools for 30 days. It reads back through your recent alert history as well as watching live, so you see what it would already have caught before you decide.
Find out what overnight cover would involve for you
Start with the free audit. We look at your Macs, sign-ins and endpoint protection, tell you what needs connecting, and quote it alongside your plan.