Product
How Wakefence ZeroSOC works
A security operations team as software, connected to the Microsoft security tools you already own. It investigates every alert, acts within the boundaries you set and keeps a person informed and in control.
Watch it handle a ransomware attack, from the first alert to a contained laptop.
From alert to verdict
Every alert gets a real investigation
When Microsoft Defender raises an alert, Wakefence ZeroSOC gathers the evidence from your own tools: sign-ins, mailbox activity, devices, the history of the accounts involved. It tests the competing explanations, the innocent ones too, and reaches a verdict with its reasoning in under two minutes.
Every step lands on the Case timeline, the attacker's actions and the response side by side, so anyone can follow what happened and why.
- Recorded event02:29Lena signs in from Munich on her own laptop.
- Attacker action03:09Sign-in from Lagos with a stolen session token; no MFA prompt is shown.
- Attacker action03:11An inbox rule starts forwarding invoices to an outside address.
- Alert03:14Microsoft Defender XDR raises "Unfamiliar sign-in properties".
- Investigation03:15Sign-ins, mailbox and laptop checked; travel, VPN and a delegated assistant ruled out. Verdict: malicious.
- Action03:15Inbox rule disabled, pre-approved and reversible.
- Approval03:16Disabling the account is proposed; waiting for an answer in Teams.
Less noise
Only real threats reach you
Most alerts turn out to be harmless. Each one is still investigated, and closed with its reason on the record.
A real threat
Contained within the boundaries you set, and brought to you with the evidence.
A false alarm
The rule fired on something harmless, such as a nightly backup job. The Case is closed with its evidence, and a request to tune the rule is filed.
Expected activity
The activity was real and approved, such as IT's scheduled software rollout. The Case is closed under the exception you approved, and the detection stays on for everything else.
Within the boundaries you set
It acts, and you stay in control
You decide which actions Wakefence ZeroSOC may take on its own and which wait for a person, and you widen that freedom at your own pace.
You choose how far it goes alone
For each kind of action, such as isolating a laptop or disabling an account, you choose how far Wakefence ZeroSOC goes on its own: from asking a person before every action, to acting alone only outside business hours, to acting straight away. Most teams start cautious and widen it as they gain confidence.
When your setting asks for a person, ZO, the ZeroSOC Orchestrator, brings the decision to Microsoft Teams. A phone call is kept for what cannot wait, such as a high or critical Case that nobody has answered in Teams or the portal.
Business-critical stays yours
Systems and people you mark as business-critical always need explicit approval.
Reversible actions
Containment is chosen so that it can be undone, from the portal or from Microsoft Entra and Defender.
A pause on every screen
One tap stops every automatic action until you resume it.
Written back into Defender
Every verdict, decision and action is written into your own Microsoft Defender incidents, with who decided and why. It stays yours, even if you stop using Wakefence ZeroSOC.
Decisions where you already work
A brief in Teams, a call when it matters
When your setting asks for a person, ZO brings the decision to Microsoft Teams: what happened, what it found, what it proposes, and one tap to approve or decline.
Every morning, a short brief says what was handled overnight and what still needs you.
When it cannot wait
ZO picks up the phone
ZO calls when something cannot wait: for example, a high or critical Case needs a person's decision and nobody has answered in Teams or the portal. It calls the people on duty in the order you choose. The call says what is waiting; one keypress acknowledges it, and nobody else is called.
The rest happens on the same phone: ask ZO why in the Teams thread, approve with one tap, and follow the Case in the portal's mobile view.
The portal
The whole week on one page
Where every alert went, how many Cases ZO closed on its own and which ones a person decided, what is waiting for you and what was handled overnight. Ask ZO about anything on the page, in plain words.
More than alert handling
Protection that grows over time
ZeroSOC Detect
Our own detections on top of Microsoft's, starting with identity: suspicious sign-ins and risky changes in your Microsoft 365 audit log become alerts like any other.
A knowledge base that learns
Your critical systems, what normal looks like, the exceptions you approved. It grows with every Case, belongs to you and can be exported at any time.
The Advisor
Between incidents it reviews your Microsoft security configuration, maps the gaps to NIS2 and explains how to close them, coaching your IT team as it goes.
Works with
The Microsoft security stack you already have
Wakefence ZeroSOC needs Microsoft 365 with Microsoft Defender. Each customer gets a dedicated instance on Microsoft Azure in the EU, and the portal, the briefs and the calls speak English, Italian and German.
- Microsoft Defender XDR and Microsoft Defender for Endpoint: alerts, incidents, devices and response actions.
- Microsoft Entra ID: sign-ins, accounts and their containment.
- Microsoft Purview audit log: the activity behind identity detections.
- Microsoft Teams: briefs, approvals and conversations with ZO.
- Your phone: escalation calls to the contacts you choose.
See it on your own tenant
In a 30-minute call we show Wakefence ZeroSOC at work on a Microsoft 365 tenant: how it investigates alerts, the verdicts it reaches and the decisions it brings to you.