Quick Snapshot: Your Security Reality

• How would you briefly describe your current security monitoring model? Options: In-house 24/7 SOC, In-house partial hours + tools, MSSP / Managed SOC, Ad hoc monitoring (no 24/7), Rely on cloud vendor native alerts only, Other
• Which telemetry sources are already sending data into a central place we could use (check all that apply)? Options: Endpoint agents (EDR), Network flow / NGFW logs, Cloud workload logs (AWS/Azure/GCP), Identity / SSO logs, Email security / ATP logs, Vulnerability scan output, None of the above / not centralized yet, Other
• How many full-time people (or FTE-equivalent) cover security monitoring and response today? Options: 0, 1, 2–4, 5–9, 10+
• Give one short example of a recent alert or incident that felt handled well—or one that fell apart. What happened?
• What’s the single biggest goal your executive team expects from improved monitoring in the next 12 months? Options: Reduce incident risk / prevent breach, Meet cyber insurance requirements, Demonstrate program to the board, Enable faster detection & containment, Reduce internal SOC staffing burden, Other

If Alerts Were People: Who’s Crying Wolf?

• How often do you think legitimate threats are lost in alert noise rather than being investigated? Options: Almost always, Often, Sometimes, Rarely, Never sure
• Approximately what percentage of alerts do you estimate are false positives today (ballpark)? Options: >90%, 70–90%, 40–70%, 10–40%, <10%, Don’t know
• When an alert is false or low-value, what typically happens to it—ignored, triaged, escalated, or something else? Options: Ignored/archived, Triage queue delay, Escalated to senior analyst, Sent back to tool vendor, We don’t have a consistent flow, Other
• Tell us about one time alert fatigue directly delayed or prevented a meaningful investigation. What did that feel like for the team?
• Which of these alert-quality signals matter most to you (select up to three)? Options: False positive reduction %, True positive rate, Precision/Noise ratio, Contextual enrichment per alert, Time to validation, Incident-to-alert conversion rate

When a Breach Is Knocking, Who’s Holding the Door?

• If a critical confirmed threat happens at 2 AM, what is the fastest, agreed path to contain it today? Options: Internal on-call team handles containment, MSSP performs containment with prior authorization, MSSP recommends actions but internal team executes, No clear after-hours path exists, Other
• What are your current mean-time-to-detect (MTTD) and mean-time-to-contain (MTTC) expectations for high-severity incidents? Options: MTTD < 15 min / MTTC < 30 min, MTTD < 1 hour / MTTC < 4 hours, MTTD < 4 hours / MTTC < 24 hours, Expectations vary by case, No formal expectations documented
• Who in your org has formal authority to approve blocking/containment actions (e.g., isolate endpoint, disable account)? List roles and escalation order.
• How would a containment action by an external provider make you feel—relieved, uneasy, neutral? Why? Options: Relieved, Uneasy, Neutral, Depends on the action
• What containment SLA windows would give you confidence for critical incidents? Options: Immediate / within 15 minutes, Within 30–60 minutes, Within 2–4 hours, Within same business day, Depends on evidence and approvals

What Does 'Done' Look Like — For Each Person in the Room

• If the board asked 'How will we know this service is working?' what three measurable outcomes would you name first?
• Which of these outcomes is top priority for your leadership right now? Options: False positive reduction, Faster detection (MTTD), Faster containment (MTTC), Improved visibility across cloud/endpoints/identity, Regulatory/insurance evidence
• What percentage reduction in false positives would you consider a successful PoV? Options: >80%, 60–80%, 40–60%, 20–40%, <20% / unsure
• For MTTR (detection to containment) what target would satisfy your security leadership for critical incidents? Options: <15 minutes, <1 hour, <4 hours, <24 hours, Depends on incident type
• Beyond metrics, what behavioral or organizational changes would signal success (e.g., fewer all-hands calls, calmer on-call rotations)?

Proof-of-Value: What Will Make Us Say Yes?

• What single outcome from a 30–60 day PoV would make you comfortable committing to full managed service?
• Which PoV deliverables matter most to you (pick up to three)? Options: Verified reduction in false positives (%), Documented incidents with timelines and outcomes, MTTD and MTTC metrics during PoV, Evidence of detection for specific threat scenarios, Clear handoff and playbook for incidents, Executive summary for board/insurance
• How many validated incidents during the PoV would you expect to see to feel the service is effective (even small, low-severity ones)? Options: 0 (expect none), 1–2, 3–5, 6–10, More than 10
• What acceptance criteria would make the PoV a clear pass/fail for your team? Be specific (metrics, timeline, behaviors).
• Who must sign off on PoV acceptance (roles)? Options: CISO, VP/Director of IT Security, Head of SOC, IT Operations Lead, Legal/Compliance, Other

Trust Signals: What Keeps You Up at Night

• What’s the one vendor behavior that would make you lose trust in a managed detection partner within 90 days?
• How transparent do you expect the provider to be about investigations (live chat, remediation steps, post-incident report)? Options: Real-time collaborative chat + detailed reports, Near-real-time updates + summary reports, Daily updates during incidents, Only post-incident reports, Minimal updates unless critical
• Which artifacts are essential for you after each incident (select all that apply)? Options: Timeline of events, Root cause analysis, Containment actions taken, Recovered evidence (logs/artifacts), Recommendations and playbook updates, Executive summary
• In past engagements, where did reporting or transparency fail you most—timeliness, detail, or tone? Options: Timeliness, Level of technical detail, Actionable recommendations, Communication tone/ownership, All of the above, Other
• How would you prefer escalation to execs occur for a suspected breach (phone, secure chat, email, scheduled briefing)? Options: Immediate phone call + secure chat, Secure chat with real-time updates, Email with urgent flag, Scheduled briefing within 1 hour, Other

Integration Reality Check: Will Data Tell the Full Story?

• Which telemetry sources are likely to be difficult or delayed to provision (pick all that apply)? Options: EDR agent install, Cloud workload logs, Identity/SSO logs, Network device logs, Email security logs, Vulnerability scanning integration, None / all accessible
• What are your current log retention windows for critical sources (endpoint, identity, cloud)? Options: <7 days, 7–30 days, 31–90 days, >90 days, Varies widely by source, Don't know
• If we need sysadmin access, API tokens, or agent installation, how long does that typically take inside your organization? Options: Same day, 1–3 business days, 1–2 weeks, 3–6 weeks, Longer / requires special approvals
• Describe any technical constraints we should know about (segmentation, air-gapped systems, restricted admin rights, compliance walls).
• Who are the internal owners we’ll need to coordinate with for integrations (roles and contact method)?

Roles, Responsibilities & The Handoff Dance

• Where have handoffs between internal teams and external providers failed before—and what was the fallout?
• Do you have existing incident response runbooks that define who does what during containment? Options: Yes, documented and practiced, Yes, but rarely practiced, Partially documented, No runbooks
• Which model do you prefer for containment authority during incidents? Options: Provider authorized to act within defined scope, Provider recommends; internal team executes, Hybrid: provider may act for specific actions only, Undecided / needs discussion
• List the top three internal teams we will coordinate with during incidents (e.g., IT ops, legal, PR).
• How would you like after-action ownership to work—provider drafts report then internal reviews, or joint ownership from the start? Options: Provider drafts, internal reviews, Joint drafting and ownership, Internal drafts with provider input, Other

SLAs: What's Career-Threatening vs Negotiable

• Which SLA miss would have the biggest negative consequence for your team or leadership? Options: Failure to detect a critical incident, Containment took too long, Repeated false positives causing board attention, Inaccurate or late reporting to execs/insurance, Unauthorized containment action
• For detection (time-to-detect) what SLA targets feel realistic and necessary (per severity)? Options: Critical <15m, High <1h, Medium <4h, Low <24h, Critical <1h, High <4h, Medium <24h, Low <72h, Custom by asset class, No formal SLA yet
• For containment (time-to-contain) what SLA windows would you consider non-negotiable for critical systems? Options: <15 minutes, <1 hour, <4 hours, <24 hours, Varies by system
• What remedies or escalation steps do you expect if an SLA is missed (credits, remediation plan, leadership review)? Options: Service credits, Root cause & remediation plan, Executive escalation meeting, Contract termination clause, Other
• Are there regulatory, contractual, or insurance obligations that impose specific detection/containment timeframes we must meet? Options: Yes—insurance requirements, Yes—regulatory (e.g., HIPAA, PCI), Yes—customer contracts, No specific obligations, Unsure

Next Steps: Tiny Bets, Big Confidence

• What’s the smallest, least risky pilot we could run this week to build mutual confidence? Options: Monitor a single critical application, Start with identity logs only, Enable EDR telemetry on a small cohort, Run detection logic in read-only mode, Other
• Who are the decision-makers and approvers for a pilot and the subsequent service contract (roles and timeline)?
• What timeline would you prefer for pilot kickoff, tuning period, and decision review? Options: Kickoff this week; 30-day PoV, Kickoff within 2 weeks; 60-day PoV, Kickoff next month; flexible PoV length, Undecided—need more prep
• What would be a clear, non-technical indicator during the pilot that trust is growing (examples: calmer on-call, fewer escalations to execs)?
• What outstanding concerns would you need addressed before we begin (legal, data handling, test scope)?

• Solution Experience — Executive Alignment
• Solution Experience — Detection & Investigation Walkthrough
• Solution Experience — Incident Response Simulation (Tabletop / Live Playbook)
• Solution Experience — PoV Success Metrics & Acceptance Confirmation

• Both parties to schedule the PoV kickoff and the final PoV evaluation meeting with named approvers.
• Validate that investigation artifacts and context materially shorten detection-to-validation timelines.
• Agree on specific tuning actions and any additional telemetry required for the PoV.
• Provider to deliver a scenario-by-scenario tuning summary that lists rule changes, suppressed noise, and expected FP reduction.
• Customer to provide missing sample logs or grant temporary read access to specific telemetry sources.
• Schedule focused rule-tuning sessions and assign attendees (SME + SOC analyst) for hands-on adjustments.
• Scenario Brief & Success Criteria
• Validate the end-to-end response process and confirm exact containment handoffs and SLA timings.
• Ensure all decision-makers explicitly accept their responsibilities during an incident.
• Identify operational gaps and agree remediation actions prior to PoV start.
• Customer to finalize and share the incident escalation matrix with named contacts and backup contacts.
• Provider to produce a documented incident playbook for the simulated scenario, including required evidence and communication templates.
• Assign owners and due dates for any remediation items uncovered during the simulation.
• PoV Scope & Monitored Asset Confirmation
• Agree on a measurable PoV plan with clear metric definitions and thresholds tied to the agreed future state.
• Confirm baseline data availability and the methods for metric validation.
• Lock the reporting cadence and sign-off process for PoV acceptance.
• Provider to deliver a PoV Measurement Plan document with metric definitions, data sources, and dashboard examples.
• Customer to provide historical baselines or authorize methods to establish baselines within X days.
• Introductions & Meeting Objective
• Obtain executive agreement on the single future-state outcome the Solution Experience must prove.
• Secure explicit, quantified consequences that make the outcome urgent.
• Commit to stakeholders, timeline, and pre-work required to run an effective experience.
• Customer to confirm named decision-makers and incident escalation contacts.
• Customer to approve the one-sentence current state and future-state outcome for the experience.
• Provider to deliver a 1-page plan showing which scenarios will be used to prove the outcome.
• Pre-work & Data Scope Confirmation
• Demonstrate tuned detections against customer telemetry and prove measurable reductions in false positives for chosen scenarios.
• One-sentence Current State Recap
• Define Success Metrics & Thresholds
• Confirm Roles, Authorities & Constraints
• Select & Prioritize Scenarios
• Baseline Data & Measurement Methods
• Scenario A — Tuned Detection Proof
• Consequence Quantification
• Play-by-Play Response Walkthrough
• Define the Future State (Outcome)
• Handoff Decision Points (Forced Validation)
• Scenario A — Contextual Investigation Walkthrough
• Reporting Cadence & Stakeholder Review Points
• How the Experience Will Prove That Outcome
• Acceptance Criteria & Commercial Trigger
• Post-incident Timelines & SLA Confirmation
• Scenario B — Quick Proof & Differences
• Validation Checkpoints & Tuning Decisions
• After-action Review & Acceptance Criteria
• Decision & Next Steps

• 24/7 SOC Monitoring and Alert Triage
• Per-client Detection Rule Tuning
• Endpoint Detection and Response Management
• Network Traffic and IDS/IPS Monitoring
• Cloud Workload and IAM Telemetry Monitoring
• Identity Monitoring and Privileged Account Alerts
• Proactive Threat Hunting and IOC Sweeps
• Incident Response Coordination and Containment
• Forensic Data Collection and Evidence Preservation
• SIEM/Log Integration, Normalization, and Parsing
• Automated Containment Actions (isolate/block)
• Threat Intelligence Enrichment and Contextualization
• Vulnerability Remediation Support and Patch Tracking

24/7 SOC Monitoring and Alert Triage

• What monitoring coverage do you require? Options: 24/7 SOC with escalation, Business hours only, Business hours + on-call after hours, Custom schedule
• Which alert priority levels should trigger immediate human triage? Options: Critical, High, Medium, Low
• Do you have existing alert thresholds or noise-reduction rules we must preserve? Options: Yes, No
• Estimated daily alert volume (raw/untriaged)? Options: <100, 100-500, 500-2,000, 2,000+
• What initial SLA do you require for first-response/triage on Critical alerts? Options: <15 minutes, <60 minutes, <4 hours, Business hours only
• Who are the escalation contacts and how are they reached (list methods and roles)?

Per-client Detection Rule Tuning

• What is your target false-positive rate reduction versus out-of-box rules? Options: <25%, 25-50%, 50-80%, 80%+
• Are there organization-specific baselines or acceptable behaviors we must encode into rules (e.g., nightly backup traffic, scheduled scans)? Options: Yes, No
• Which detection types should receive priority tuning during PoV? Options: Ransomware/Encryptors, Data exfiltration, Lateral movement, Credential misuse, Custom/Other
• How often do you want tuning cycles conducted (rule updates, suppression updates)? Options: Weekly, Bi-weekly, Monthly, On demand
• Who has approval authority for enabling/disabling custom detection rules? Options: Customer SOC Lead, CISO, Designated IT Manager, Joint approval
• Provide examples of recent false-positive patterns or missed detections to prioritize tuning (free response)

Endpoint Detection and Response Management

• Which EDR vendors/agents are currently deployed or preferred? Options: CrowdStrike, Microsoft Defender for Endpoint, SentinelOne, Carbon Black, Other/None
• What percentage of endpoints do you expect to bring under management during PoV? Options: <25%, 25-50%, 50-75%, 75-100%
• Are automated endpoint remediation actions allowed (isolation, process kill) or must we require manual approval? Options: Allow automated isolation, Process kill allowed, Manual approval required for containment, No automated actions
• Which OS types are in scope (list counts if possible)? Options: Windows, macOS, Linux, Other
• Are there OT/ICS endpoints or air-gapped systems with special agent restrictions? Options: Yes, No
• Are there required maintenance windows or change controls for agent rollouts? Options: Yes, No

Network Traffic and IDS/IPS Monitoring

• Which network telemetry sources are available or required (select all that apply)? Options: NetFlow/PCAP, IDS/IPS (vendor), Firewall logs, SWG/Proxy logs, Cloud VPC flow logs
• Do you have span/tap/mirror ports or packet capture capability in your environment? Options: Yes - full taps, Yes - selective mirroring, No, only logs
• Which IDS/IPS vendor(s) are in use and need integration? Options: Snort/Suricata, Palo Alto, Cisco, Fortinet, Other/None
• Are encrypted traffic inspection or TLS decryption capabilities required for monitoring? Options: Required, Preferred but not required, Not allowed
• Which network segments or subnets should be excluded from monitoring (if any)?
• Expected daily network telemetry volume (GB/day) or events/day? Options: <1GB, 1-10GB, 10-50GB, 50GB+

Cloud Workload and IAM Telemetry Monitoring

• Which cloud providers/accounts are in scope? Options: AWS, Azure, Google Cloud (GCP), Other, On-prem only
• Do you have cloud-native logs enabled (CloudTrail, CloudWatch, Azure Activity, Audit Logs)? Options: Yes - all required logs, Partial, No
• Are container/Kubernetes workloads in scope? Options: Yes, No
• How should access be provisioned for cloud telemetry (IAM role, API keys, read-only service account)? Options: IAM role (recommended), API key, Service account, Other
• Which cloud IAM events or behaviors should be prioritized (e.g., privilege escalation, policy changes, service account key creation)? Options: Privilege escalation, Policy changes, New admin users, Service account key creation, Other
• Are there compliance or data residency constraints for cloud log export/storage? Options: Yes, No

Identity Monitoring and Privileged Account Alerts

• Which identity providers and directories are in use (select all that apply)? Options: Active Directory (on-prem), Azure AD, Okta, Google Workspace, Other
• Are privileged accounts inventoried and available for monitoring (list count or groups)? Options: Yes - inventoried, Partially inventoried, No
• What privileged activity should trigger alerts (select all that apply)? Options: Admin login outside policy, New admin creation, Privileged group membership changes, Service account key creation, Other
• Is MFA enforced for administrative accounts? Options: Yes - enforced, Partial, No
• Do you require integration with identity governance or PAM tools? Options: Yes, No, Planned
• Who owns identity incident triage and remediation on the customer side? Options: IT Ops, Security/IR Team, IAM Team, Other

Proactive Threat Hunting and IOC Sweeps

• How frequently do you want proactive hunts during the PoV? Options: Weekly, Bi-weekly, Monthly, Ad-hoc
• What historical telemetry window should hunting cover (days/months)? Options: 7 days, 30 days, 90 days, Custom (specify)
• Which data sources should be prioritized for IOC sweeps? Options: Endpoints, Network, Cloud logs, Identity logs, SIEM aggregated
• Do you have in-house threat intel or specific IOCs you want included in hunts? Options: Yes, No
• What deliverable format do you prefer for hunting results (executive summary, technical playbook, raw indicators)? Options: Executive summary, Technical report + IOC list, Raw IOC export, All of the above
• Are there constraints on active scanning or noisy hunting techniques in your environment? Options: Yes, No

Incident Response Coordination and Containment

• Do you want the provider to perform containment actions or only provide recommended actions? Options: Perform containment (with approval), Perform automated containment, Recommend only, customer acts
• What is the approval process for containment (roles, SLAs, phone authorization)?
• Are there legal, privacy, or compliance restrictions that affect containment (e.g., data access, customer notification)? Options: Yes, No
• Who are the primary and secondary on-call contacts for incident coordination?
• What containment SLAs are required after a validated incident (time to isolate, time to block)? Options: <15 minutes, <60 minutes, <4 hours, Business hours
• Do you require joint tabletop rehearsals or live handoffs during the PoV? Options: Yes - tabletop, Yes - live handoff, No

Forensic Data Collection and Evidence Preservation

• Do you require full disk imaging capability for impacted hosts? Options: Yes, No, Case-by-case
• What chain-of-custody and evidence preservation standards must we follow? Options: NIST/ISO, Legal/counsel-specified, Internal policy, None specified
• What retention window do you require for preserved forensic artifacts? Options: 30 days, 90 days, 1 year, Custom
• Where may forensic data be stored (on-prem, customer cloud, provider cloud)? Options: On-prem, Customer cloud, Provider cloud, Hybrid
• Are there restrictions on collecting volatile memory or sensitive PII during forensics? Options: Yes, No
• Who is the primary contact for chain-of-custody sign-off on the customer side?

SIEM/Log Integration, Normalization, and Parsing

• Which log sources must be integrated during PoV (select all that apply)? Options: Firewall, Endpoint/EDR, Proxy/SWG, Cloud Audit, Identity/AD, Vulnerability scanner
• How will logs be forwarded to the service (agent, syslog, API, S3/Blob)? Options: Syslog, Agent, API ingestion, Cloud storage (S3/Blob), Other
• Estimated log ingestion volume per day (GB/day) or events/day? Options: <1GB, 1-10GB, 10-50GB, 50GB+
• Do you require custom parsing/normalization for proprietary logs? Options: Yes, No
• What retention and access controls are required for ingested logs? Options: 30 days, 90 days, 1 year, Custom
• Are there compliance/PII masking rules that must be applied to log data? Options: Yes, No

• Statement of Work (SOW)
• Master Services Agreement (MSA)
• Service Level Agreement (SLA)
• Proof-of-Value Acceptance Criteria
• Pricing and Payment Schedule
• Operational Handoff & Containment Responsibilities
• Onboarding & Deployment Plan
• Data Processing & Privacy Addendum (DPA)
• Escalation & Communication Matrix
• Insurance, Indemnity & Liability Addendum
• Change Control & Scope Modification
• Termination, Exit & Data Return Plan
• Technical Acceptance Checklist
• Authorized Signatures & Final Mutual Commitment

• Outcomes Review & Acceptance
• SLA Transition & Operational Handoff
• Incident Handoff Simulation & Playbook Validation
• Continuous Improvement & Shared Channel Setup
• Executive Success Brief

• Establish a prioritized improvement backlog with initial owners and timelines.
• Provision dashboard access and validate telemetry visibility with customer security admin.
• Publish approved runbooks and schedule a training/handoff session for customer responders.
• Pre-brief: objective and one-sentence current state
• Demonstrate operational handoffs meet agreed containment and communication targets in practice.
• Identify and prioritize playbook or process gaps with assigned owners and timelines.
• Schedule follow-up retest to validate remediation effectiveness.
• Update playbooks with captured changes and publish versioned runbooks.
• Assign remediation owners and deadlines for each identified gap.
• Schedule retest simulation and invite required operational participants.
• Provision shared channel and access policy
• Create and provision a shared collaboration channel with agreed access and etiquette.
• Agree recurring cadences and owners to sustain continuous improvement and tuning.
• Opening — Current state (one sentence)
• Create the shared channel, invite stakeholders, and publish access/usage guidelines.
• Publish the recurring meeting schedule and invite owners for weekly/monthly/quarterly cadences.
• Open the initial CI backlog items in the tracking tool and assign owners with due dates.
• Secure executive endorsement for the transition to steady-state managed service and SLAs.
• One-sentence current state and consequence
• Ensure executives understand business value delivered and residual risks remaining.
• Obtain approval for any required executive-level communications (board update, insurance documentation).
• Circulate a one-page executive summary for board and insurance use containing agreed metrics and endorsement statement.
• Capture any executive requests and assign owners for follow-up actions.
• Schedule the first Quarterly Business Review and share agenda with executive stakeholders.
• Confirm PoV met the objective metrics (target false-positive reduction and MTTR thresholds) or capture specific gaps.
• Validate that incident handoffs were handled with required context and that customers are comfortable with operational coordination.
• Obtain formal acceptance to transition to steady-state SLAs or document precise remediation actions and timeline.
• Produce and circulate finalized PoV report with metric snapshots and signed acceptance (or agreed remediation list).
• Confirm SLA go-live date and update calendar invites for operational cadence meetings.
• Assign owners and due dates for any outstanding remediation items required before SLA start.
• SLA package review
• Reach mutual agreement and signatures on SLA terms and start date.
• Ensure every operational responsibility and escalation path has a named owner.
• Confirm access to dashboards and reporting that the customer requires for transparency and compliance.
• Finalize and circulate signed SLA document and operational RACI.
• Consequence recap
• Simulated incident run
• Roles & responsibilities matrix
• Outcome highlights
• Define meeting cadence and ownership
• Live coordination evaluation
• CI metrics and dashboards to track
• Residual risks and mitigation plan
• Escalation matrix and contacts
• PoV metrics dashboard review
• Tooling access, dashboards, and reporting
• Post-mortem and gap identification
• Tuning request and backlog workflow
• Business impact and compliance value
• Validated incident case reviews
• Pilot improvement items and owners
• Agree remediation and retest plan
• Acceptance criteria checklist & sign-off
• Runbooks, playbooks, and change control
• Executive decisions & endorsement
• Confirm go-live checklist
• Escalation and change governance
• Immediate next steps and SLA start timeline