Solutions · Managed SOC

Managed SOC services, run on the security tools you already own.

With WedgeX managed SOC services, every alert is investigated by our AI agent and reviewed by an analyst in Australia, around the clock. There's nothing to install or migrate, so most customers are live within days. You decide what we're allowed to act on, and serious incidents go to Gridware's DFIR team.

Talk to us

Audit logLive

09:42:11agentTRIAGE_COMPLETEDsplunk-55320 · phishing · low risk
09:42:08wedgex.socALERT_CLOSEDsplunk-55320
09:42:05agentTRIAGE_COMPLETEDsentinel-30184 · sign-in anomaly
09:42:02wedgex.socVERDICT_RECORDEDescalated · sentinel-30184
09:41:59agentTRIAGE_COMPLETEDcrowdstrike-12044 · vpn brute force

What our analysts see while they work.

A day of alerts, handled by our team.

A typical 24 hours, combined from the kind of alerts we see every week.

09:14 Day 1

Quiet morning

A phishing lure hits the email gateway. The AI agent works through it, finds nothing malicious and marks it low risk. A WedgeX analyst checks the evidence and closes the case. Nobody on your side has to look at it.

14:22 Day 1

Unusual sign-in

A finance account signs in from an unfamiliar country. The agent investigates: the token is fresh, the MFA prompt was accepted, the device is unknown. It returns a verdict with the full evidence. The WedgeX analyst reviews and escalates to your IT lead with what it found and a recommended action.

02:47 Day 2

Brute force against the VPN

A burst against the VPN gateway. The agent investigates, correlates with related activity, and recommends containing the source IP. The WedgeX on-call analyst is paged, approves the containment, and posts a summary to your incident channel. By the time your team logs on, it's contained and written up.

09:00 Day 2

Handover brief

The WedgeX daily handover lands in your inbox. Three cases reviewed and closed, one escalation pending your review, one suppression rule proposed for sign-off. It takes about five minutes to read.

What's included in our managed SOC services.

Here's what our analysts do every day, and what stays with you. Whether we run the whole thing or work alongside your team as a co-managed SOC, we agree the split before we start.

We handle

24/7 monitoring
Someone is watching the alert queue at all hours, including weekends and public holidays.
Recommendation review
The AI agent's verdict gets a WedgeX analyst before your team sees it.
In-scope approvals
Response actions within the scope you have pre-set, approved on your behalf.
Out-of-scope escalation
Anything beyond scope goes to your team with the evidence and our recommendation.
Environment tuning
Suppression rules and verdict thresholds, tuned to what your environment treats as normal.
Reporting and review
Weekly and monthly briefs with patterns, trends and recommended changes.

You decide

The scope of actions we are allowed to take
Verdict thresholds and severity definitions
When to declare an incident
Strategic security direction
Vendor and platform choices

SOC as a service on the tools you already pay for.

A lot of outsourced SOC providers want you on their own stack. We connect to the SIEM and EDR you already run through their APIs, so your detection rules and logs stay where they are, and there's nothing to undo if you leave.

Your tools

CrowdStrike Falcon EDR
Microsoft Defender XDR
Microsoft Sentinel SIEM
Splunk SIEM
SentinelOne EDR
IBM QRadar SIEM

Connects through the API. Nothing to install, nothing to migrate.

Our analysts

On call 24/7

Review every verdict, inside your tools.

A 24/7 SOC with incident responders behind it.

WedgeX AI agent

Picks up each alert as it arrives and pulls the evidence from your SIEM, EDR and threat intel feeds.
WedgeX analyst

Reviews what the agent found, approves actions within the agreed scope, and is paged for anything critical.
Gridware DFIR team

Takes over real incidents, with everything the agent and our analysts have already done in front of them.

Covering every shift in-house means hiring for nights, weekends, leave and resignations. Because the AI agent does the first pass on every alert, a small team of our analysts can cover the whole clock. If you want guaranteed response times from the DFIR team, add an incident response retainer.

Managed SOC vs in-house SOC vs a traditional MSSP.

If you're deciding between building a SOC, outsourcing it, or getting help alongside your existing team, here's how the options compare.

Time to stand up

In-house SOC: Months of hiring before every shift is covered
Traditional MSSP: Weeks, often with a tooling migration
WedgeX managed SOC: Days, on the tools you already own

24/7 coverage

In-house SOC: Needs a full rotation of analysts, plus cover for leave
Traditional MSSP: Yes, shared across many customers
WedgeX managed SOC: Yes, AI agent plus Australian analysts on call

Your security tools

In-house SOC: Yours
Traditional MSSP: Often replaced with the provider's stack
WedgeX managed SOC: Yours. No rip and replace, nothing new to install

Investigation depth

In-house SOC: Depends on who is on shift
Traditional MSSP: Often a forwarded alert and a ticket
WedgeX managed SOC: Every alert investigated, with the evidence attached

Knowledge of your business

In-house SOC: Best. They work there
Traditional MSSP: Limited
WedgeX managed SOC: Builds up during tuning; your team stays in the loop

When it becomes an incident

In-house SOC: Call in a third party
Traditional MSSP: Separate contract, separate team
WedgeX managed SOC: Escalation straight to Gridware's DFIR team

Criteria	In-house SOC	Traditional MSSP	WedgeX managed SOC
Time to stand up	Months of hiring before every shift is covered	Weeks, often with a tooling migration	Days, on the tools you already own
24/7 coverage	Needs a full rotation of analysts, plus cover for leave	Yes, shared across many customers	Yes, AI agent plus Australian analysts on call
Your security tools	Yours	Often replaced with the provider's stack	Yours. No rip and replace, nothing new to install
Investigation depth	Depends on who is on shift	Often a forwarded alert and a ticket	Every alert investigated, with the evidence attached
Knowledge of your business	Best. They work there	Limited	Builds up during tuning; your team stays in the loop
When it becomes an incident	Call in a third party	Separate contract, separate team	Escalation straight to Gridware's DFIR team

From first call to a running managed SOC.

Scope

We agree the actions our analysts may take on your behalf, your verdict thresholds, severity definitions and escalation contacts. It is written down before anything is switched on.

Connect

WedgeX connects to your SIEM and EDR through their APIs. Nothing to install on your endpoints, no data lake to build, no migration. Most environments are connected in days.

Tune

For the first weeks our analysts review every verdict closely, learn what normal looks like in your environment, and propose suppression rules for your sign-off.

Run

Continuous monitoring, a daily handover brief, and a monthly review of patterns, trends and recommended changes to your detections.

Managed SOC pricing is scoped to your environment: the tools you run, your alert volume and the response scope you hand to our team. There is no new platform licence to absorb. See managed SOC pricing for how it is structured.

Managed SOC services FAQ

What are managed SOC services?

A managed SOC (security operations centre) is a service where an external team monitors, investigates and responds to security alerts on your behalf, 24 hours a day. You get the outcome of a SOC without hiring, training and retaining a 24/7 analyst team yourself. Managed SOC is also called SOC as a service or an outsourced SOC.

How is a managed SOC different from MDR?

The terms overlap. Managed detection and response (MDR) usually means a provider monitoring its own endpoint tooling. A managed SOC covers your wider environment, SIEM and EDR together. WedgeX works like MDR on your existing stack: we monitor and respond using the CrowdStrike, Microsoft, Splunk, SentinelOne or QRadar tools you already own.

How much do managed SOC services cost?

Managed SOC pricing depends on the size of your environment, your alert volume, which tools you run, and how much response scope you want our team to hold. Because WedgeX runs on your existing tools, there is no new platform licence to absorb. See the pricing page, or talk to us for a quote scoped to your environment.

Can you run a co-managed SOC alongside our team?

Yes. Many customers run a co-managed or hybrid SOC: your team keeps business hours and the decisions that matter to you, and we cover nights, weekends and the triage volume. The handoff boundary is agreed up front and written down.

Which security tools do you support?

WedgeX supports every major SIEM and EDR platform, including CrowdStrike Falcon, Microsoft Defender, Microsoft Sentinel, Splunk, SentinelOne and IBM QRadar. If you run something else, we can build a custom connector for it.

Is the SOC team based in Australia?

Yes. WedgeX is an Australian managed SOC. Our analysts are onshore and backed by Gridware Cybersecurity's digital forensics and incident response team.

How long does onboarding take?

Connecting your tools usually takes a few days. There's nothing to migrate and nothing to install on your endpoints. After that, our analysts spend the first few weeks learning your environment.

Hand it to our SOC team.

Managed SOC services suit teams that need a SOC but don't want to staff one. If you would rather operate the platform yourself, see the AI SOC Platform. If you mainly want help on hand for a serious incident, look at the Incident Response Retainer.