The article
Your email platform, your cloud account and every laptop in the office already write down who signed in, from where, and what changed. The logs exist. The question is whether anyone reads them while it still matters. Cyber security monitoring services put people behind those logs: we collect them from your servers, cloud accounts, apps and devices, watch them with tools that run all the time and act when something looks like an attack.
I have spent 18 years in software development, and 26 Lines of Code has 70+ specialists who build, test and look after software. Below: what we watch, what happens to a single alert, why monitoring starts with tuning out the noise, and what to ask any monitoring provider before you sign.
What our cyber security monitoring services watch
We watch five kinds of sources. For each, this is what we look for and what it can look like when it happens.
| Source | What we look for | What it can look like |
|---|---|---|
| Sign-ins | Odd places, odd hours, too many tries | The finance mailbox opened at 3 a.m. from a country nobody travels to |
| Servers and cloud accounts | Changes nobody planned | A new admin account created on a Saturday |
| Devices | Malware and suspicious programs | A laptop running a remote-access tool nobody installed |
| Phishing that got through | A message asking to "confirm" a password, opened by five people | |
| Applications | Errors and requests that look like attacks | Hundreds of failed sign-ins on your app in ten minutes |
The logs your own applications write matter as much as the cloud's. RxPhoto, the clinic photo record we work on, keeps an audit log of every user action, so an administrator can show who opened which record and when; logs like that are what monitoring reads. More in the RxPhoto case.
The life of one alert
A tool raises an alert; a person decides what it means. This is what happens between the two.
| Step | What happens | Who |
|---|---|---|
| 1. Raised | A rule matches: a sign-in from a new country, a new admin account | Our tools |
| 2. Read | A person checks the context: is the user travelling, does this happen every month | Our people on watch |
| 3. Sorted | A false alarm is dropped and its rule adjusted; a real one goes on | Our people on watch |
| 4. Contained | The account is locked or the device isolated, by the rules agreed with you | Us |
| 5. Told | You hear what happened and what we did | Us, to the contact you named |
| 6. Reported | The month's alerts, actions and what to improve, in one report | Us |
If an alert turns out to be the start of an incident, incident response takes over: finding out how they got in, cleaning up and restoring.
Why monitoring starts with the noise
A new set of rules cannot know what is normal for you. It flags the accountant who works from home at night, the backup that copies a lot of data every Sunday, the sales trip to another country. That is why the service starts in three steps:
- Connect. Your logs and tools connected to our monitoring.
- Tune. Alert rules adjusted to what is normal for you, to cut the noise.
- Watch. Alerts handled within the response time in your contract, with a monthly report.
Tuning is not a formality. People who drown in false alarms start skimming, and a skimmed alert is how a real one slips through. Each false alarm we drop leads to a rule change, so the alerts that reach a person are worth reading.
In October 2026 I read the sites of the five monitoring providers Google showed me for this search. Four promise 24/7 watching and the fifth real-time detection. None says how soon a person looks at an alert, and only one talks about alert noise at all. Five sites are a small sample, but round-the-clock is the easy half of the promise; the time to a human look is the half that decides how your Monday goes.
What to ask a cyber security monitoring company
These questions separate a watch from an inbox of alerts. Ask them of any provider, us included.
- Who watches at night? People or software, your provider's own team or a partner's.
- How soon does a person look at a serious alert? The answer belongs in the contract, not only on a website.
- What do you do without calling us? Locking an account stops an attack and someone's work; agree in advance what is done alone.
- What happens to false alarms? If the answer is "we forward everything to you", you are buying an inbox.
- How long are our logs kept, and where? And what you get back when the contract ends.
- Can we see a monthly report? With the client's name removed.
Our answers: tools watch all the time, and a person reads every alert they raise and decides; what we do alone is agreed with you at the start; false alarms are dropped and the rules adjusted; the monthly report says what happened and what we did. The time to a first look is written into your contract once we know what we watch.
Monitoring alone, or inside managed security
Monitoring is the core of our managed cybersecurity services, and it can also be bought on its own. Alone, it fits a company whose IT team keeps the systems and needs eyes on the logs; managed security adds updates, phishing training and a team that runs security end to end. If you are not sure yet what to watch, monitoring consulting designs it first: which logs to collect, which alerts deserve a person and who answers.
Monitoring does not replace a test. A penetration test tries to break in once and shows the holes; monitoring watches every day for someone using one.
Where we watch from, and what it costs
Our cyber security monitoring runs remotely as a service for companies in the USA and Europe. The logs travel to the monitoring, so the people reading them do not need to sit in your building.
The price depends on how many sources send logs, how many devices and accounts there are, how long the logs are kept and whether response and updates are included. It is estimated before work starts, and the first call and the rough estimate are free. Tell us what you need watched, and we reply with what we would monitor first. The rest of our security work is on the cybersecurity page.
