Field note / security monitoring
Security monitoring and incident response is named on the pricing page as its own written decision - deliberately kept separate from the Plus baseline. It sits above configuration hygiene and is qualified on its own, the same way backup and disaster recovery is.
Why it sits above the baseline
The Plus reference band's security-baseline routine finds configuration drift on a fixed review cadence - a snapshot, checked periodically. Security monitoring and incident response asks a different question: if something goes wrong between two scheduled reviews, who sees it, and what happens in the next few minutes. Bundling the two under one name would blur a scheduled check with a standing watch, and this site avoids exactly that kind of unqualified promise elsewhere.
Review what the Plus baseline actually covers →Where it comes up
A licensed platform is already installed somewhere in the environment, generating alerts that may or may not be reviewed.
Where it comes up
Nothing is currently watching identity sign-ins or endpoint behaviour for signs of compromise.
Where it comes up
Something has already happened and the facts are still unclear.
Where it comes up
The immediate event is over and the question turns to what it means going forward.
Boundary table
| Question | Why the public bands cannot answer it | Where it gets answered |
|---|---|---|
| What counts as "watched"? | Coverage depends entirely on which systems, accounts, and signal sources are actually in scope. | Written into the service boundary record. |
| Who is on the hook when an alert fires outside business hours? | Coverage hours and after-hours ownership are a separate qualification variable, not an assumed default. | Confirmed alongside the after-hours coverage decision. |
| What does "incident response" actually deliver? | Containment authority, communication ownership, and technical depth vary by incident and are never generic. | Named in the written agreement. |
| How is severity decided? | A triage standard has to fit the tools and accounts actually in place - there is no universal severity scale. | Set during scoping, not assumed from a marketing page. |
What not to promise yet
A qualified monitoring lane is a genuine, sellable service. An implied one - assumed because a tool exists somewhere - is a liability with someone else's name on it.
Related decision
RMM and endpoint monitoring watch device health and patch state. Security monitoring watches for signs of compromise. Some tooling overlaps; the ownership and response do not.
Name the tool, the account, or the alert nobody has looked at in months. That is enough for an initial fit review.