Building an in-house SOC takes years, over 1 million euros per year, and talent that's hard to find. Fortgale gives you immediate access to a team of specialised European analysts, active 24·7·365. SOC as a service (SOCaaS) run by a European team, on the SIEM and EDR you already own.
SIEM, EDR and SOAR technologies are tools. Without expert analysts interpreting context, they're just alert generators. The difference between an effective SOC and one that detects nothing lies in the people who run it.
Team composed exclusively of senior figures with direct experience on threat actors active against European markets. Contextual knowledge of campaigns specifically targeting European industry: fewer false positives, faster real detection.
Enterprise SIEM, EDR/XDR, SOAR and proprietary CTI integrated in a single operational pipeline. Technology filters noise; analysts make decisions. Rule ownership delivered to the customer: no proprietary lock-in.
Every SIEM rule is fed by CTI generated by the Fortgale team: 287 profiled tools and actors, 34k+ weekly IOCs, continuous dark web monitoring. The SOC knows in advance when an actor is preparing campaigns against your sector.
Fast triage, measured containment, continuous coverage, full NIS2 compliance support, across the entire monitored customer base.
Fortgale SOC doesn't just collect logs. Every event is correlated, analysed and classified by analysts who know the tactics of threat actors active against European organisations.
Telemetry from endpoint, network, cloud, identity, applications: firewall, IDS/IPS, EDR, M365, Azure, AWS, GCP, Active Directory. All centralised in the SIEM with normalisation and contextual enrichment.
Correlation of thousands of events per second with detection rules mapped on the MITRE framework. AI pre-filter reduces noise by over 90% before analyst triage. Proprietary CTI applied in real time.
The senior team verifies alerts, eliminates false positives, classifies real severity. Triage in 15 minutes with MITRE-mapped runbooks. Direct knowledge of threat actors active against European markets.
Every confirmed threat is contextualised with Fortgale CTI: 287 profiled tools and actors, 34,000+ weekly IOCs, dark web monitoring. Rapid attribution, vector understanding, right runbook selection.
Median containment <30 min. Cross-tool response (EDR, firewall, IAM), direct escalation to the CISO, support for national CERT notification within 24 hours for NIS2-significant incidents.
Many providers say 24/7 and mean an on-call phone after 6 p.m. In the Fortgale SOC, analysts are on shift at night, at weekends and on public holidays, with the same mandate they have at noon.
One subscription, no hiring, no new platform to buy. The Fortgale SOC runs on the SIEM and EDR you already own and delivers the outpost as a service, 24·7·365, with a European team.
Fortgale Managed SOC is not just a dashboard: in the Fortgale Defence Platform the analysts and the customer work on the same case. It's a complete service combining enterprise technology, certified analysts, and proprietary intelligence under guaranteed SLAs.
Continuous coverage by senior team on shift, in Europe. No "after-hours" gap: 76% of attacks happen at night, on weekends, on holidays. Immediate escalation to the customer's reference contact for every confirmed incident.
Log correlation from all corporate sources on enterprise SIEM. Rules mapped on the MITRE framework, continuously updated based on active campaigns against European markets. Tuning on the customer profile.
Managed detection and response on endpoint, network and cloud. The SOC doesn't just alert: it actively blocks, isolates compromised systems, coordinates technical response without waiting for manual approval of every action.
Proprietary feeds on IOCs and TTPs of adversaries active across Europe. When an actor prepares a campaign against your sector, the SOC knows it in advance and adapts defenses, no third-party vendor dependency.
If a confirmed incident occurs, the SOC coordinates containment, eradication, forensic analysis, and safe restoration. Support for national CERT notification within 24 hours, 72-hour documentation, board and legal communication.
Monthly executive reports for management, detailed technical reports for the IT team, complete event documentation for audit and compliance. The SOC becomes a governance ally, not just a technical supplier.
There is no generic price list: the fee follows the perimeter you ask us to watch. You get an annual fee, predictable and with zero CapEx, on the licences you already own. Request a quote and we size it on your environment.
Seven questions to put to any provider, with the Fortgale answer. For the full comparison of costs and staffing, read why a managed SOC instead of an in-house one.
| Model | What it does | Where it stops |
|---|---|---|
| MSSP | Manages devices, forwards alerts | Investigation and response stay with you |
| Managed SOC | Monitors, investigates and escalates 24·7·365 across the whole stack | Response depth depends on the mandate |
| MDR | Detects and contains on endpoint, network and cloud | Narrower governance and reporting scope |
The Fortgale SOC includes MDR. For the details, read why MDR goes further than a SOC and MDR vs EDR vs XDR, or see the SOC on your platform: Microsoft Defender, CrowdStrike Falcon, SentinelOne.
Every internet-connected company is a potential target. Fortgale SOC adapts to different organisations, with plans built on the specific risk profile of each.
Manufacturing is the most-targeted sector across Europe. Production lines stopped by ransomware cost tens of thousands of euros per hour. The Managed SOC is the only realistic defence for those without an internal team.
NIS2 mandates continuous monitoring and documented incident response. Fortgale SOC directly supports these requirements with complete audit trail, timely national CERT notification, and governance reporting.
Energy, transport, utilities: sectors where operational disruption has immediate consequences for public safety. Fortgale SOC includes OT/ICS expertise for protecting connected industrial environments.
Law firms, consulting practices, and accountants handle high-value confidential data. They are increasingly targeted because they often have weak defenses but access to client systems, an ideal vector for supply chain attacks.
Hospitals and healthcare facilities are among the most-hit targets at European level. Healthcare data has very high value on the dark web. We support environments with connected medical devices and specific compliance.
Microsoft 365, Azure, AWS: misconfigured cloud environments are among the leading vectors 2025-2026. Fortgale SOC monitors identity, permissions, anomalous access, and risky configurations even in multi-cloud environments.
Fortgale SOC integrates SIEM, EDR/XDR, SOAR and Threat Intelligence in a single operational pipeline. Technology filters noise; analysts make decisions. The same scheme covers detection on enterprise AI systems: see AI Security.
The Fortgale team is composed exclusively of senior figures with direct experience on actors and campaigns against European markets. No generalists: each member specialises in specific threat actors and industrial sectors.
Knowing LockBit or RansomHub TTPs is necessary but not sufficient. Fortgale analysts know the specific campaigns against European industry, reducing false positives and accelerating real detection.
The SOC doesn't start with generic rules. During onboarding, analysts study infrastructure, critical assets, and sector to build an optimised rule set and minimise noise.
No generic ticket: in case of incident, direct access to the analyst handling the situation. SLA with notification within 15 minutes of confirmed alert and updates every 30 minutes during active management.
The Fortgale European SOC observes this kind of behaviour 24·7 across monitored customers. Enumeration, lateral movement, credential dumping, exfiltration attempt, when these patterns are recognised, triage starts in 15 minutes and containment is automatic.
The Managed SOC coordinates and amplifies all other security services. A unified view that eliminates blind spots between different tools and teams.
EDR/XDR technology managed by the SOC to detect and block real-time threats on endpoint, network, and cloud. The operational layer of the SOC for continuous detection.
Discover MDR →Proprietary feeds on IOCs and TTPs of actors active across Europe. Proactive alerts when a threat actor begins preparing campaigns against your sector or geography.
Discover CTI →When an attack is in progress, every minute counts. The Fortgale IR team intervenes in emergency to contain, eradicate and restore, with NIS2 and GDPR notification support.
Contact the IR team →The Managed SOC is the operational defence outpost: the team of European analysts 24·7·365, the processes, governance, executive reporting, NIS2 compliance, and integrated CTI. MDR is the technological component for detection and response on endpoint, network, and cloud. Fortgale SOC includes MDR but is a broader dimension that orchestrates the entire security stack.
An internal H24 SOC requires at least 5 analysts for shifts and holidays, enterprise SIEM licences, infrastructure, ongoing training: over 1 million euros per year. The Fortgale Managed SOC costs on average 30% of an equivalent in-house setup, with predictable monthly fees, zero CapEx, and activation in 2-4 weeks.
Standard onboarding takes 2 to 4 weeks. Week 1: log collection and data source integration. Weeks 2-3: detection rules tuning on the company's specific profile, false positive reduction. Week 4: SOC operational H24 with calibrated runbooks and active SLAs.
Endpoint (workstations, servers, laptops), network (firewall, IDS/IPS, switches, VPN), cloud (M365, Azure, AWS, GCP), identity and access (Active Directory, Entra ID, privileged access), critical applications and, on request, OT/ICS systems. All correlated in a centralised SIEM with MITRE ATT&CK rules.
Yes. Fortgale SOC supports NIS2 requirements: continuous monitoring, IOC collection for national CERT notification within 24 hours, technical documentation for the 72-hour notifications, complete audit trail, and reporting for corporate governance.
Yes. Fortgale SOC is technology-agnostic: it integrates with the major SIEM, EDR/XDR, firewall, identity, and cloud platforms used in EU enterprises. No forced replacement of existing investments.
An in-house SOC makes sense when you already have analysts on shift around the clock, a SIEM and people who tune it every day. For most European companies the managed SOC is the practical choice: a European team operating since 2017, detection in <15 minutes, containment in <30 minutes, noise cut by >90 % by day 30, on the licences you already own. Rules and data stay yours: no lock-in, and you can bring the SOC in-house later if you decide to.
Yes. The Fortgale European SOC runs on shifts every hour of the year: nights, weekends and public holidays included. Alerts are triaged by a human analyst, not parked until Monday. Confirmed incidents are escalated to the contact you nominate, with notification within 15 minutes and updates every 30 minutes during active management.
No new purchase is required. If you already have a SIEM or EDR, the Fortgale SOC works on your licences and the rules stay yours. If you do not, the SIEM layer is part of the service scope agreed during onboarding.
A traditional MSSP manages security devices and forwards alerts. A managed SOC investigates every alert with analysts and acts on confirmed incidents. The Fortgale SOC adds integrated MDR and proprietary CTI, so detection, triage and containment happen in one team.
Check that SLA and KPIs are written into the contract, that analysts are on shift 24/7/365 and not on call only, where data is processed, whether the provider works on your existing SIEM and EDR, who performs the response, what reporting you receive and what happens to rules and data if you leave.
Our SOC detections come from first-hand analysis of the actors hitting European organisations: MITRE-mapped rules, fresh IoCs, runbooks tuned on real campaigns. From this research we fuel the 24·7·365 outpost, aligned with the threat landscape we observe every day.
No exploit. No attachment. No phishing email. In this campaign the threat actor needs the victim to do exactly one thing: copy a command from an installation guide and paste it i…
Read article →
ABSTRACT The FBI recently issued an advisory on Kali365, a Phishing-as-a-Service platform that abuses legitimate Microsoft OAuth flows to bypass multi-factor authentication. Kali…
Read article →
Intelligence · Phishing Kit · Q1 2026 April 24, 2026Fortgale CTI14 min readRPT-26-0424 Observation of the quarter The 2026 phishing ecosystem has outpaced traditional defenses. M…
Read article →
In the high-stakes world of venture capital and corporate funding, where millions hang in the balance and sensitive financial data flows freely, a new breed of cyber threat is em…
Read article →
In February 2026, the Fortgale Incident Response team investigated a multi-stage intrusion attributed to Mora_001, a Russian-origin threat actor exploiting Fortinet vulnerabiliti…
Read article →
UPDATES: 27.11.2024: As mentioned by TrustWave, "Supercar Phishing Kit" has an high level of overlapping with the most recent update of "Rockstar 2FA Phishing-as-a-Service" 26.09…
Read article →The CISO decides on risk and budget. The IT lead decides on response. The Fortgale Managed SOC produces evidence for both.
An in-house 24·7 SOC needs at least 5 analysts, SIEM licensing and over EUR 1 million a year. The Fortgale Managed SOC delivers the same coverage at a fraction of the cost, with governance and board-ready reporting.
76% of attacks happen outside business hours. The Fortgale SOC runs 24·7·365 with a senior European team: triage in 15 minutes, <30 minutes median containment, integration on the stack you already have.
On 27 December 2024 the Fortgale SOC detected Operation MN-1224: a large-scale Microsoft 365 user enumeration (group Mater Nebula) against European companies, confirmed across multiple tenants protected by the MDR.
Read the analysis →The SOC rules come from direct analysis of real campaigns: 9 phishing kits profiled in the Q1 2026 CTI report.
Read the report →Over 100 published analyses. Attributions corroborated by third parties such as Mandiant (Google), Amazon, SentinelOne and Huntress. European SOC, 24·7·365.
What is a SOC → · Why a managed SOC → · What is a SIEM →
76% of attacks happen outside business hours. Speak with our analysts and find out how to activate a Managed SOC calibrated to your specific risk profile, operational in 2-4 weeks.
No nurturing sequences, no auto-replies. One of our analysts calls you back within one business day.
The full Report (executive summary · operational IoCs · technical runbook) is restricted. Share two details and one of our analysts contacts you with access and a short technical briefing.
Response in 30 minutes, containment in 1–4 hours. Even if you are not a Fortgale customer.
