Skip to content
DMC DEFENSE

Monitor · 24/7 SOC

After the alert, who closes the gap? We do, with your IT team.

Detection in under 15 minutes, 24/7 monitoring of your Microsoft 365, then a check that the gap is closed. From €5.80 excl. VAT per user per month.

Request a free auditSee pricing
Detection log

  1. 09:41:02Alert

    Unusual sign-in spotted

  2. 09:41:14Suspended

    Hacked account suspended

  3. 10:08:31Stopped

    Attack stopped

  4. 11:30:12Fixed

    Fix approved by an expert: two-step verification enforced

  5. 11:41:05Closed

    Fix verified: gap closed

Illustrative scenario, fictional times.

Microsoft 365 sends alerts, someone still has to read them

Your licenses produce signals. Someone has to read them, understand them and act. At 3 a.m. as much as on a Sunday in August.

243days

That is the average time to spot and stop an attack that abuses a legitimate account, for instance with a stolen password.

Source: IBM, Cost of a Data Breach Report 2026

  1. Hacked account

    A stolen password raises no alarm

    The attacker signs in with a real password. They read your emails, learn who approves payments, then set up a payment fraud.

    Payment fraud

  2. Ransomware

    The lock-down comes last, not first

    Before locking your files, the attacker explores your network for weeks. Then they strike on a Friday evening, when nobody is watching.

    Business at a standstill

  3. Data theft

    No ransom, no signal: your data is gone

    Your files are simply copied. Without monitoring, you find out from a customer or a partner.

    Breach notice within 72 hours

What the public data says

48 %
of ransomware victims in France are small and mid-sized companies
ANSSI, Panorama de la cybermenace 2025, p. 10 (in French)
EUR 5M
fine imposed by the CNIL, the French data protection authority, on France Travail in January 2026, notably because its systems could not reveal abnormal behaviour.
CNIL, decision of 22/01/2026 (in French)
EUR 42M
in fines for Free and Free Mobile in January 2026, after 24 million subscriber contracts were stolen. According to the CNIL, their measures to detect abnormal behaviour were “ineffective”.
CNIL, decision of 13/01/2026 (in French)

Public sources, linked.

How we protect your business

  1. Detection< 15 min

    We spot unusual behaviour, such as a sign-in at night from abroad.

  2. Handling< 30 min on SOC Standard

    An analyst checks the alert and informs your IT team.

  3. Blocking

    We cut off the attacker’s access.

  4. Fixing

    We fix the settings that let the attack in. No time frame is promised for the fix.

Restoration

On quote, after a serious incident

What we watch for you

The three ways attackers get in.

For your IT team: the technical detailWhere your data lives: the full detail

What the service runs on

  • Microsoft security stack
  • Detection supporting NIS2 (art. 21) and the GDPR (art. 33)

  • Your accounts

    • We spot unusual sign-ins, such as at night from abroad
    • We block a hacked account to cut off the attacker
    • We keep a close eye on accounts that have full rights

  • Your emails

    • We spot booby-trapped emails and fake payment requests
    • We block the sender and the dangerous links
    • We spot an attacker quietly redirecting your emails

  • Your computers and files

    • We spot a virus or ransomware on a computer
    • We cut an infected computer off from the rest of the network
    • We spot files being copied out in bulk

Every month, you receive this report

A plain-language report that a director can read.

  • The month’s situation summed up in one sentence
  • For each gap still open in your Microsoft 365: we fix it, or we hand the fix over to your IT team, as you prefer

Illustrative example: anonymised and rounded data.

Sample report

DMC DEFENSE

Monthly security report

Month of March

This month’s forecast

Green, under control

No serious attack this month. One incident, handled with no damage, and 3 settings to fix.

This month in figures

alerts checked by our analysts
76 false alarms ruled out
real incident, handled
1Details below
your Microsoft security score
68%+5 points this monthLast month: 63%

The incident of the month

Tuesday, 8:33 pm

  1. What happened

    After a click on a booby-trapped link, a computer tried to reach a malicious website.

  2. What we did

    We cut the computer off the network, blocked the website and alerted your IT team.

  3. Outcome

    Nothing leaked. Your IT team put the computer back into service the next day.

What we recommend this month

  1. 1Reduce from 5 to 2 the accounts that have full rights
  2. 2Turn on two-step verification for the last 4 accounts without it
  3. 3Update 3 computers that are behind on updates

With your IT team

Your DMC DEFENSE analyst is available to discuss it with your IT team.

Who it is for, and how we start

Three conditions to begin. Then 2 to 4 weeks to be up and running.

This service is built for you if…

It is designed for organisations running Microsoft 365 that have an IT team or an IT provider. Check in 10 seconds.

Eligibility0/3

Tick what applies to you.

Without Microsoft 365 and Defender, we do not sell this SOC: our other services work with any system.

See our vendor-independent services (audit, penetration testing, ISSP/PSSI)

Up and running in 2 to 4 weeks

  1. Week 1

    Kick-off

    A call with your IT team to review your Microsoft 365 and agree on what we will watch.

  2. Weeks 1–2

    Installation

    We install our monitoring tools and connect them to your accounts, emails and computers.

  3. Weeks 2–3

    Tuning

    We tune the alerts and automatic blocking to your activity. Your IT team approves them.

  4. Weeks 3–4

    Check

    We check with your team that alerts come through properly, and show you your starting security score.

  5. Your SOC is live

    Monitoring runs continuously. Your first monthly report arrives after 30 days.

What we ask of you
About 2 hours in total, and administrator access

What clients ask us before signing

  • No, we reinforce it. We watch for attacks continuously, which an IT team cannot do alone. Your team stays in control of your IT and remains the contact for your users.

  • It is essential, but it sends alerts without interpreting them. Today’s attacks get around it and use real accounts. Without a human analysing, they go unnoticed.

  • Three tiers: SOC Basic €5.80, Standard €15 and Premium €30 per user per month excl. VAT, with a minimum of €100 excl. VAT per month. See pricing

  • Sentinel runs in Microsoft's cloud: no server to install or maintain on your side. It adapts to the amount of data to monitor and is natively connected to your Microsoft 365. See pricing

Are you exposed?

We review your real risks and your most urgent gaps. No commitment, with a clear answer.

Request a free auditSee pricing

After you send it

  1. Reply within 24 business hours

  2. Dedicated contact