Hybrid SOC monitoring services: AI agents watch, analysts decide
Continuous security monitoring where AI agents qualify every event and human analysts make the calls that carry consequences. Delivered as part of the IT Packs, not as a separate product.
What is monitored
Four sources, one pipeline. Monitoring is only as good as what is instrumented, which is why an engagement starts with an audit of what is already logged.
System and application logs
Logs from servers, workstations and business applications stream in continuously, whether hosted on your premises or on a managed instance.
Network traffic
Inbound and outbound flows are analysed for anything out of the ordinary: an unusual volume, an unexpected destination, access at an improbable hour.
Sensor feeds, software and physical
Through Trustigateway, connected devices deployed by IoTiatis log every exchange. A sensor that suddenly starts emitting an abnormal volume is a signal, not noise.
AI agent activity
Agents deployed in your environment are monitored too: what they trigger is traced, and anything beyond their scope escalates to an analyst.
How the work splits between agent and analyst
The AI agent
- Analyses logs, traffic and sensor feeds continuously
- Qualifies each event and discards known noise
- Escalates what deserves a decision: an unusual anomaly, an action to approve, a confirmed incident
The human analyst
- Decides whether to cut an access
- Decides whether to notify a client
- Decides whether to trigger a recovery procedure
Why this boundary exists, and what it changes for an infrastructure already in production, is covered in our announcement of the hybrid SOC.
How the service is delivered
Monitoring is not sold on its own. It is part of the IT Packs, which group the recurring services that keep an information system reliable over time: user support, monitoring, updates, operational follow-up, preventive maintenance and technical support.
That packaging is deliberate: an agent or a server deployed without monitoring is not a complete deliverable, so monitoring is not an option to tick.
How an engagement starts
With a free audit of the existing system: what is already logged, what is not, and what has to be instrumented before monitoring becomes useful. The audit says what is missing before anything is sold.
If you would rather assess your own situation first, the onboarding path runs the diagnostic inside your own AI assistant, with nothing collected on our side.
Frequently asked questions
What is a hybrid SOC?
A hybrid SOC is a security operations centre where AI agents analyse events continuously and human analysts make the calls. The AI absorbs the volume — what a human team cannot review alert by alert — and humans keep the decisions that carry consequences.
What does the AI watch, and what does a human decide?
The agent analyses logs, network traffic and sensor feeds, qualifies each event and discards known noise. It escalates only what deserves a decision. An analyst then decides whether to cut an access, notify a client or trigger a recovery procedure.
Why not let the AI decide on its own?
This is not a technical limitation, it is a deliberate choice: an action with legal or commercial consequences should remain an owned human decision. An agent can detect a signal at three in the morning; an analyst is the one who acts on it.
Does monitoring cover nights and weekends?
Yes. That is precisely what the hybrid model makes possible: genuinely continuous monitoring rather than business hours only, without the cost of a human team sized to watch noise twenty-four hours a day.
Is the hybrid SOC sold separately?
No. Monitoring is part of the IT Packs, which group the recurring services that keep a system running: user support, monitoring, updates, operational follow-up, preventive maintenance and technical support. The hybrid SOC is what “24/7 monitoring” means with us, not a separate line on a quote.
How does this differ from a traditional SOC?
A traditional SOC runs into alert volume: it pushes organisations either to under-staff monitoring or to drown analysts in noise. Moving qualification to agents shifts that balance — analysts only see what needs judgement.
How does monitoring get started?
With a free audit of the existing system: what is already logged, what is not, and what needs instrumenting before monitoring becomes useful. Monitoring is then activated as part of the IT Packs.
Review your monitoring
A free audit to establish what is actually monitored today.