Defensive cybersecurity
Monitoring and incident response
Overview
Security operations, threat detection and incident response that keep critical systems defended around the clock: 100,000+ threats blocked daily, with AI-assisted operations shipped with defence-in-depth. Live in power grids, regulated finance and fleets at sea.
Round-the-clock defence with no obligation to share what we find.
Capabilities
- 24/7 security operations, threat detection and incident response for critical systems
- 100,000+ threats blocked daily across fleets, grids and financial platforms
- AI-assisted security operations shipped with defence-in-depth and human oversight
- Proven incident response: a fleet-wide ransomware event contained and fully recovered within a week, with 100% of data restored
- Layered defence continuously hardened by the maker's own red-team findings
- Live in power grids, regulated finance and 1,500+ vessels at sea
Specifications
| Type | Defensive / SOC |
| Coverage | Available under controlled technical briefing |
| Scale | Available under controlled technical briefing |
| Response | Available under controlled technical briefing |
| Deployments | Available under controlled technical briefing |
| Mode | Detect & respond |
| Origin | Independent / non-aligned |
Published figures appear below; configuration-specific figures are shared under briefing.
In depth
Operations, not an annual audit
Defensive cybersecurity provides 24/7 security operations for critical systems. It detects threats, supports incident response and continues after the initial assessment. More than 100,000 threats are blocked daily across fleets, grids and financial platforms. Coverage spans power grids, regulated finance and more than 1,500 vessels at sea, with detection and response configured for each environment.
Layered detection with a human decision
AI-assisted security operations add speed, while defence-in-depth prevents one missed signal from deciding the outcome and human oversight retains judgement. The team detects and responds rather than merely supplying a dashboard, and its red-team findings continuously harden the defence. In one fleet-wide ransomware event, the service contained the incident and restored all data within a week. That incident does not set a recovery-time guarantee for future events.
Defence without a disclosure obligation
Round-the-clock defence is delivered without an obligation to share findings outside the buyer's environment. That matters across financial platforms, power infrastructure and vessels, where incidents expose sensitive operational information. Offensive testing probes the surface, defensive operations watch it continuously, incident response acts when something breaks and infrastructure hardening applies the findings. The buyer retains control of the infrastructure and its data.
The operating layer across different estates
On a power grid, detection and response protect control and service continuity. In regulated finance, a failure can become a settlement problem. At sea, the team protects an estate distributed across more than 1,500 vessels rather than one office network. Across these environments, the service blocks more than 100,000 threats daily. AI assistance provides speed, while defence-in-depth and human oversight govern the response.
Continuous defence and recovery
The service provides 24/7 detection and response with AI assistance, defence-in-depth and human oversight. It blocks more than 100,000 threats daily across fleets, grids and financial platforms. In one fleet-wide ransomware incident, all data was restored within a week; that result is not a recovery-time guarantee for future incidents.
Why Unstrat: the difference
Unstrat is the authorised global representative and distributor for this capability. It is already in service with a track record behind it, so you are buying something that has done the job elsewhere, not funding a first attempt. You are not the test bed.
Independent, non-aligned origin, with no political exposure to any major-power ecosystem.
One accountable team from first briefing through delivery and in-region sustainment.
100,000+ threats blocked daily across fleets, grids and financial platforms.
How it reaches you
Related capability
View all →
Procurement & sustainment
Classification and the end-user-certificate chain are confirmed before this capability is represented to your market.
Sourced from an independent manufacturer: no major-power disclosure rules or political conditions.
A single team responsible from first briefing through delivery: not a chain of foreign primes to integrate yourself.
Lifecycle support and operator training delivered in-region, building capability that outlasts the initial deployment.
Applications it supports
Capability comparisons
Questions buyers ask
What does a managed SOC actually do?
It watches the estate around the clock, decides which alerts are real, and acts before an intruder moves beyond the first host. The difference between providers is rarely the tooling and usually the analyst: whether the person on shift has seen your kind of system break before. Our operation runs 24/7 across power grids, regulated finance and more than 1,500 vessels at sea, blocking over 100,000 threats a day.
Best MDR provider for critical infrastructure
If the estate is corporate IT, CrowdStrike is hard to beat and we will say so, with a follow-the-sun model and a wide third-party telemetry surface through its Next-Gen SIEM. If the estate is grids, ships and payment systems, the shortlist changes, because endpoint telemetry does not parse a substation protocol. Ours is a staffed defence already running inside those environments.
How fast should a SOC contain a ransomware attack?
Two clocks matter and they are often confused. Detection races the intruder: CrowdStrike cites a 2023 eCrime breakout time of 2 minutes 7 seconds, which is how long an attacker needs to move past the first host. Recovery is separate, and our published example is a fleet-wide ransomware event contained and fully recovered within a week with 100% of data restored. Ask any supplier for both numbers and for the commitment behind each.
24/7 security monitoring for a national power grid
Grid monitoring needs analysts who understand what cannot be rebooted and protocols an endpoint agent has never parsed. Our defensive operation is live in power grids alongside regulated finance and fleets at sea, with AI-assisted operations shipped with defence in depth and human oversight. It is a running operation rather than a capability statement.
See: Defensive cybersecurityCritical infrastructure resilience
Do we need OT sensors as well as a managed detection service?
Usually yes, because they solve different problems. Nozomi Guardian sensors give passive visibility into OT and IoT networks, scaling from a 500-node DIN-mountable unit to 500,000 nodes and 6 Gbps in a rack, with ruggedised models rated from -40 to 70 °C. That is what you see with. A staffed operation is who watches it, and sensors without a watch produce a dashboard nobody is reading during the incident.
See: Sensors and staffed defence, comparedOT security capability
AI in security operations: force multiplier or risk?
Both, which is why the oversight model matters more than the model. We ship AI-assisted operations with defence in depth and human oversight, because an automated action taken on a bad inference is still your outage. The automation is tuned against real alert volume from an operation blocking more than 100,000 threats a day.
What response SLA should a managed defence contract include?
Two commitments, written separately: time to first human contact and time to containment by severity. We do not publish an SLA and will not dress that up as a virtue. CrowdStrike's data sheet publishes no SLA table either, and its claim of up to a 75% reduction in mean time to respond carries a footnote rather than a service level. Demand the contractual numbers from every bidder.
Managed SOC for a fleet or a shipping operator
Ships break the assumptions most SOC tooling is built on: intermittent links, equipment nobody will restart, protocols outside the enterprise stack. Our defensive operation runs across more than 1,500 vessels, blocking over 100,000 threats daily, alongside grid and finance estates. The maritime platform behind it holds 99.97% fleet uptime.
Will our security provider share what it sees on our network with its home government?
Neither CrowdStrike's data sheet nor Nozomi's specifications address the question, and silence in product literature is not an assurance. Ask it directly and get the answer into the agreement. Our position is that we have no reporting line to a foreign government and no obligation to share what we find, which for a ministry or national operator is frequently the deciding term.
Can monitoring data from our estate be held entirely inside our country?
It is the right question to ask early, and the answer belongs in the contract rather than in a brochure. We publish that we have no obligation to disclose findings to any government, and residency terms are set per engagement, so ask us in writing what can be held in country and for how long. Do the same with every bidder, because a defence supplier accumulates a running record of what is inside your grid, your banks and your ships.
We were hit by ransomware across a distributed estate. What does good recovery actually look like?
Containment that stops the spread without stopping operations, then a restoration plan that proves data integrity rather than assuming it. Our published example is a fleet-wide ransomware event contained and fully recovered within one week, with 100% of data restored, on systems in service. That is an outcome rather than a percentage, and it is the kind of evidence worth asking every provider to produce.
How do we know a SOC provider has ever defended an estate like ours?
Ask which sectors their analysts run today, and what they had to do differently in each. We publish deployments in power grids, regulated finance and more than 1,500 vessels at sea, blocking over 100,000 threats a day. CrowdStrike publishes coverage of endpoints, identities and cloud workloads, extended to third-party domains through Falcon Next-Gen SIEM, which is a different estate described precisely.
Is a defence that is never tested by an attacker any good?
You cannot know, which is the honest problem with defensive security: quiet may mean safe or it may mean unwatched. Our layered defence is continuously hardened by our own red-team findings, including CVSS 10.0 discoveries in production fleets, so the coverage is measured rather than assumed. CrowdStrike's data sheet describes threat intelligence and hunting, but states no red-team feedback loop of that kind.
See: Offensive cybersecurityHow the two disciplines fit together
Our sites have intermittent connectivity. Can a cloud-delivered SOC service work for us?
Not on its own. Products that assume a steady link to a cloud console fail exactly where critical estates operate, which is why disconnected sites need an assurance and architecture layer of their own. We run defensive operations and off-grid work from the same team, so the design accounts for sites that drop off the network for long periods.
How many analysts and which locations sit behind a 24/7 claim?
It is a fair challenge, because a follow-the-sun rota is a staffing arrangement rather than a capability. We publish 24/7 coverage and the volume behind it, more than 100,000 threats blocked daily across fleets, grids and financial platforms, and we do not publish headcount or site list. Ask us for both in writing, and ask the same of any provider whose coverage claim is a single line in a data sheet.
Defensive cybersecurity: questions
What is Defensive cybersecurity?
Defensive cybersecurity is Unstrat's Cyber (Cyber & Critical Infrastructure) capability: Security operations, threat detection and incident response that keep critical systems defended around the clock: 100,000+ threats blocked daily, with AI-assisted operations shipped with defence-in-depth. Live in power grids, regulated finance and fleets at sea.
How does Defensive cybersecurity work?
Defensive cybersecurity delivers its effect through 24/7 security operations, threat detection and incident response for critical systems, 100,000+ threats blocked daily across fleets, grids and financial platforms and AI-assisted security operations shipped with defence-in-depth and human oversight, capabilities matched to the requirement and confirmed under briefing rather than published.
Who provides Defensive cybersecurity?
Defensive cybersecurity is delivered by The Cybersecurity Group, whose focus is cyber & critical-infrastructure security. Unstrat represents The Cybersecurity Group to government and enterprise buyers worldwide as an independent, non-aligned prime vendor.
Who uses Defensive cybersecurity?
Government and enterprise buyers acquire Defensive cybersecurity to address counter-terrorism, attacks on critical infrastructure, prison security, vip & event protection, airport security, cyber attacks on government and cyber attacks on financial systems across the cyber & critical infrastructure, matched to the mission and accountable to them, not to a foreign vendor's government.
Why choose Defensive cybersecurity over a major-power alternative?
Defensive cybersecurity is sourced from an independent, non-aligned provider, so it carries no major-power disclosure rules, upgrade-locks or political ramifications. Concretely: 100,000+ threats blocked daily across fleets, grids and financial platforms. The capability is accountable to you, not to a foreign vendor's government and its release schedule.
How is Defensive cybersecurity procured, and where can it be delivered?
Round-the-clock defence with no obligation to share what we find. Every engagement begins with a briefing, and export eligibility is confirmed per market under briefing rather than published. Where controlled capabilities are involved, the classification and end-user-certificate chain is confirmed first. Defensive cybersecurity is then sustained in-region by one accountable team from briefing through long-term operation.