“We need a SOC / EDR / MDR” — but which one? The market is crowded, vendor promises sound identical, and a wrong purchase locks up budget for years. We evaluate requirements and market neutrally: we sell no licences and have no stake in the outcome — other than the solution fitting you.
What this includes
- EDR/MDR selection (vendor-neutral): requirements workshop on protection needs, IT landscape, team, and budget frame · structured market comparison of relevant providers (Microsoft Defender vs. specialists, EDR vs. MDR vs. SOC service) · scoring matrix with a clear recommendation · SLA and contract checklist for the negotiation
- SIEM / Microsoft Sentinel concept: use-case workshop (top detection use cases by threat profile) · log-source inventory and prioritisation · target architecture with data onboarding and retention · ingest cost forecast before cost and alert noise get out of hand · operating-model recommendation
- Implementation support & PoC: PoC guidance with defined test criteria · rollout planning and onboarding steering · alerting and escalation processes · acceptance against the requirements catalogue
How we run it
Requirements
Workshop: protection needs, IT landscape, team capacity, constraints.
Market comparison
Score relevant providers against your requirements catalogue.
Decision
Scoring matrix, executive decision paper, SLA checklist for negotiation.
Implementation
Optional: PoC, rollout steering, acceptance against the catalogue.
What you get
- Requirements catalogue as a lasting evaluation baseline
- Comparison matrix with a reasoned recommendation
- Decision paper for management
- SLA and contract checklist for the vendor negotiation
- For SIEM scope: concept document with use-case catalogue, ingest cost forecast, and implementation roadmap
Why this matters
Detection projects rarely fail on technology — they fail on wrong expectations, unclear use cases, and costs nobody forecast. Clarifying requirements before buying saves more than the consulting budget — and yields a solution your team can actually operate.
Questions we get
Are you really neutral?
Yes. We sell no licences and receive no vendor commissions. If the evaluation points to our own Managed Detection & Response service, we say so openly — the scoring matrix stays transparent and belongs to you either way.
What does the consulting cost?
Fixed price after free scoping. Consulting services are also frequently eligible for public funding in Germany (BAFA and state programmes, subsidies up to 50–80%) — we handle the funding navigation. Important: the application must precede the engagement.
Do we even need a SIEM?
Not always. For many mid-sized companies, a well-run EDR/MDR is the more effective first step. A SIEM pays off when signals from multiple technologies must be correlated — exactly what the use-case workshop clarifies before ingest costs accrue.
How long does the selection phase take?
Typically four to six weeks from requirements workshop to decision paper. A SIEM concept is ready in three to four weeks.
Next step.
A 30-minute scoping call clarifies whether selection, SIEM concept, or both is the right entry point.
Request a briefing