What is included
- 24/7 security monitoring: EDR, firewall, M365 & cloud logs watched – including at night
- Managed detection & response (MDR): alerts investigated, classified and handled – with documentation
- Threat hunting: planned hunts for threats that slip through the net
- Security incident handling: escalation path, forensic first assessment, recovery
- Ransomware early warning: anomalies in backup, file and access behaviour detected before it burns
- Security reporting: monthly situation report for management – risks, incidents, measures
Who this service is for
Mid-market whose operations run on IT
20–500 employees whose production, sales and service depend on servers, network and Microsoft 365 – where every outage costs real money.
Teams without a full IT department
IT is a side job for one or two people, the knowledge sits in heads and 24/7 coverage is missing. We take over operation, monitoring and support.
Companies with sites in DACH + internationally
One IT architecture and one security baseline across Berlin, Zurich, London and other sites – measured in a single report, backed by one SLA.
How the delivery runs
- 01
Audit & target picture
We document hardware, network, software, cloud and security – and measure where outages, risks and costs sit today. The result: a shared target picture and a prioritised roadmap with numbers.
- 02
Build in milestones
Implementation in clearly prioritised stages – each with a measurable goal. You always see what is going live, what it delivers and what comes next.
- 03
Operation & continuous improvement
Monitoring, support, patch and security management then run as an ongoing operation. Monthly reporting with clear KPIs – availability, response times, costs – no black box.
Typical starting situations we solve
These patterns keep coming up in our audits. If one of them fits, a conversation is almost always worth it.
Servers and network have been running on their own for years – nobody knows what depends on what and what is patched.
Backups exist, but nobody knows if they work – a restore has never been tested.
Microsoft 365 is licensed, but MFA, permissions and data protection remain unresolved – often until an incident makes them visible.
Shadow IT and single tools grow alongside the core system – without integration, without a security standard, without a budget overview.
What we deliver – concretely
Measurable KPI roadmap
Clear goals per milestone – from availability to response time. We name the KPIs that should change before we start.
GDPR, consent & data hygiene
Compliance is part of every setup: consent, deletion concepts, clean data – no retrofitting after the data-protection audit.
Documentation & handover
Everything documented: setups, workflows, logic. Your team can keep working independently after the collaboration – no lock-in.
Frequently asked questions
Isn't an EDR tool enough, why do I need managed security?
The tool alerts – but no mid-market company sits at the alerts permanently. EDR without analysis is a smoke detector nobody hears. Managed security fills the gap: analysis, prioritisation, handling and documentation, 24/7. The tool alone also costs money – what decides is what you do with the alerts.
Do I have to convert all devices and systems to the monitoring for that?
No – we start where the risk sits: endpoints (EDR), email and M365 logs, firewalls, central servers and shop/API systems. More sources are added once the value is visible. No full conversion as an entry barrier, but incremental coverage.
What happens when your monitoring reports an attack – how fast do you react?
Critical incidents (e.g. ransomware signs, compromised admin account) escalate to the responsible technician within the SLA response time – including at night. The client is informed, the affected scope is isolated, and afterwards you receive a documented timeline: what happened, what we did, what follows next.
What does Managed Security (MSSP) cost with Core IT Services?
It depends on scope, tools and data quality. In the first call you get a concrete range and a milestone roadmap – no strings attached. Ongoing operation is available as a monthly package, projects as a fixed price.
How quickly will we see first results from Managed Security (MSSP)?
Usually after 4–8 weeks, depending on the starting point. In the audit we define the KPIs that should change, and we report monthly and transparently – what is better, what is unchanged, what is worse.
Do you work with our existing tool stack?
Usually yes – we are tool-agnostic. If an existing tool makes sense, we keep it; if not, we advise on switching. Partner discounts do not drive recommendations.
Do we need dedicated staff on our side for this?
One contact person for decisions is enough. We handle build and operation and document everything, so your team can continue independently after the collaboration.
Are you set up for international markets (e.g. Italy, Spain, the UK)?
Yes. We are based in Berlin and operate sites across DACH, the UK and Europe with one team and one systems architecture – reporting in one currency: your KPIs.
Do you also run the ongoing operation, or just the setup?
Both is possible. Many clients start with the setup and take over the operation themselves afterwards – we document and train. Others let us run the whole operation. In the first call we say honestly what serves you better in your situation.
How do you handle legacy systems and existing data?
We start with an inventory audit: what is usable, what needs to be cleaned up, what can be retired. Legacy systems are mapped and migrated where it is worth it – not blindly. You start clean, without inheriting debt.
Managed Security (MSSP): Let us calculate what it is worth for you
30 minutes, no strings. We look at your numbers and show where the lever is.
Request a call30 minutes, no strings. No pitch – we look at your data.