Services · four managed-security packages
Four managed-security packages — 24/7 monitoring, AI-assisted detection, incident response, and compliance evidence — mapped 1:1 to the framework list your buyers, prime contractors, and regulators already ask for. Sized for the regulated SMB in healthcare, legal, financial, defense, and SaaS.
stwp.packages / what ships
24/7 Monitoring
Always-on named-analyst coverage
AI-Assisted Detection
AI surfaces the top 1% · a named engineer closes the loop
Incident Response
Plain-language analyst handoffs
Compliance Evidence
Audit-ready artifact library per framework
The four packages · named deliverables + cadence
Every package has a named set of operators on the rotation. The role roster does not change between packages — the SOC Director, the detection engineers, the IR Lead, and the Compliance Lead all stay on shift across the four.
Always-on named-analyst coverage
Pure-always-on coverage across the telemetry you already ship. Named shift analysts, a Monday customer-facing note, and a documented escalation contact — telemetry is ingested across EDR, identity, network, cloud, and email, and handoff discipline stays accountable at the boundary instead of dropping into an auto-only overnight window.
What you get
A named analyst reviews every escalation within fifteen minutes, seven days a week — your on-call team gets one Monday note, not seven Slack pings.
Named deliverables
Role roster on this package
Buyer segments
AI surfaces the top 1% · a named engineer closes the loop
AI triages the top ~1% of signals; a named detection engineer validates, escalates, or closes each one. The Day-14 detection-coverage baseline, weekly hypothesis-driven hunts on Pro and Defense, and a Day-30 + quarterly coverage review keep the detection content tuned to your tenant — not a generic ruleset shipped in box.
What you get
By Day 14 you have a written detection-coverage baseline scored against your tenant; AI surfaces 2–4 daily candidates and a named detection engineer closes the loop.
Named deliverables
Role roster on this package
Buyer segments
Plain-language analyst handoffs
A named Incident Response Lead drives every confirmed Sev-1 or Sev-2. Containment decisions, the detection-to-containment timeline, and the after-action review ship in writing — every step attributable to a named engineer, including the lessons-learned entries the auditor will sample against.
What you get
When containment ends, your named IR Lead writes the after-action review the same business day and timestamps every decision.
Named deliverables
Role roster on this package
Buyer segments
Audit-ready artifact library per framework
Detection logs, incident records, access evidence, and response timelines translated into the artifact format each framework asks for — CMMC, HIPAA, PCI 4.0, US state privacy. Your named engagement lead signs the quarterly evidence pull and stays accountable for the life of the contract.
What you get
Each quarter, your named engagement lead ships a packaged evidence pull in your framework’s format — HIPAA Security Rule for the hospital, PCI 4.0 for the processor.
Named deliverables
Role roster on this package
Buyer segments
Day 1 → Day 14 → Day 30 → ongoing
The same artifact on /pricing and /compliance — the audit-ready baseline at Day 14, the first cadence evidence pull at Day 30, and a named customer-facing note that ships every Monday from then on, across all four packages.
Day 1
A named US-based SOC engineer is on shift from day one across all four packages — monitor, detect, respond, and ship the first evidence pull. We wire the first telemetry sources and stand the customer-facing note format that arrives in your inbox every Monday.
Day 14
The first posture report ships. Detection coverage + log retention + identity baseline — the artifacts an auditor or a buyer security review would sample against, already written, scoped across the packages you bought.
Day 30
First compliance pull at this tier — quarterly cadence on Pro and Defense, on-request posture on Essentials. The named engagement lead signs the package on Defense within the first month, and your IR Lead has tabletop-scope baseline on file.
Ongoing
No auto-only windows. The customer-facing note stays attributable from one shift to the next, with named-analyst handoff at the boundary and a written after-action review per incident — across 24/7 monitoring, AI-assisted detection, IR, and the compliance evidence pull.
Same Day-14 baseline, same Day-30 evidence pull · the package changes, the SOC does not.
Five buyer segments · one anchor per segment
Each segment names the framework set the buyer already answers to, the one package Straitwatch recommends as the default anchor, and the next step so the SOC engineer inherits context on first reply — not a discovery call from a cold form.
Segment
Frameworks they answer to
Anchor
Anchor: Compliance Evidence
Segment
Frameworks they answer to
Anchor
Anchor: Compliance Evidence
Segment
Frameworks they answer to
Anchor
Anchor: 24/7 Monitoring
Segment
Frameworks they answer to
Anchor
Anchor: Compliance Evidence
Segment
Frameworks they answer to
Anchor
Anchor: AI-Assisted Detection
24/7 monitoring, AI-assisted detection, incident response, or compliance evidence — name the package your team is missing. We map Straitwatch against that list and tell you which tier already produces the artifact and which one closes the gap.