For organizations whose security tools were installed and left alone, or whose reports go unread.
We run your Microsoft security tools day to day: Defender kept tuned, access reviewed, Secure Score tracked, and vulnerabilities worked down. Where you need one, a partner runs a 24x7 security operations center.
We run your Microsoft security tools and work the vulnerability backlog, and where you need round-the-clock detection, a partner runs the security operations center.
Microsoft security operations
Defender, Conditional Access, and MFA kept tuned, alerts triaged, devices brought back into compliance, and who has access to what reviewed on a schedule.
What you get
Alerts triaged and closed with a record
Policies tuned as Microsoft and your environment change
Devices out of compliance found and fixed
Quarterly access reviews for privileged roles and shared mailboxes
Joiner, mover, and leaver changes run from a runbook
Monthly Secure Score review with the next actions
Best for
Defender switched on at rollout and never looked at since, and accounts that outlive the people who used them.
Vulnerability management
Scans read and acted on: a backlog by severity, patches and configuration fixes scheduled through change control, and exceptions logged with compensating controls.
What you get
Weekly vulnerability review with owners
Patching in rings through change control
Exceptions logged with compensating controls
CIS and Microsoft baselines, with drift reported
Best for
A scanner that produces reports nobody works through.
24x7 security operations center, through a partner
Your Sentinel workspace watched around the clock by a security operations partner we bring in, with your incident response plan and containment rules.
What you get
Monitoring of the Sentinel workspace you already own
A severity matrix and a pre-authorized containment matrix
An incident response plan and a tabletop exercise
Monthly security review and a quarterly view of where threats concentrated
Best for
Round-the-clock detection and response without building a SOC.
A major New York City university ended its contract with a reactive managed services provider and chose Preeminent Solutions after a competitive evaluation.
Ongoing since 2020Read more
Questions we get
Do you run your own security operations center?
No. Where you need round-the-clock detection and response, we bring in a security operations partner for your engagement and stay accountable for the service. We run the Microsoft tools, the access reviews, and the vulnerability backlog ourselves.
What has to be in place before managed security starts?
Microsoft 365 security licensing, with Defender and Conditional Access configured. For round-the-clock detection, Sentinel also has to run in a workspace you own, with the connectors validated. The Assess phase lists what is missing, and putting it in place is a project before the service starts.
What do you report each month?
Secure Score and its trend, alerts by severity and how they closed, devices out of compliance, the vulnerability backlog by age, and access review results. We agree on the format at the start.
Will you replace our security team?
No. We run the tools and the routine, and your team keeps the decisions: what gets contained automatically, which exceptions stand, and what the roadmap funds.
What changes the size of a managed security agreement?
Mostly how many users and devices are in scope and which Microsoft security products you license. Round-the-clock detection and response widens it, and so does a large vulnerability backlog at the start.
How is this different from a security assessment?
A security assessment is a point in time: where you stand and what to fix first. Managed Security is the routine that follows, with the tools kept tuned, reviews on a schedule, and the numbers each month. It still opens with its own Assess phase.
Yes. Managed Security can be bought on its own or with the rest of Managed IT Services, and agreement terms are negotiable. The 24x7 security operations center is an option within it, not a requirement.
Talk to us about Managed Security
It starts with a 60-minute call. If we need more to scope it, a short questionnaire follows. Then a written proposal and statement of work. Once you approve, we begin with the Assess phase.
