A 30-day environment investigation and monitoring service. See which systems are exposed, what activity the SOC observes, and what your team should fix first.
See how the 30 days work ↓The outcome
What is exposed, and what needs a decision?
An asset register can tell you what should be connected. Scanning and monitoring help establish what is actually visible. We agree the sites, systems, contacts and safe collection methods with you before the 30 consecutive days begin.
You receive a baseline, an account of the activity observed in scope, and a list of issues your team can assign. We distinguish verified improvements from open risks and areas we could not observe.
Coverage
Three ways to understand the environment
Establish the baseline
We identify assets visible within the agreed estate and check for known weaknesses, missing updates and configuration issues. An unavailable system or a missing credential is recorded as a coverage gap. Each priority finding has a system owner and a proposed next action.
Investigate activity while fixes are under way
Our UK-based Security Operations Centre monitors connected sources around the clock during the engagement. Analysts use Sumo Logic to correlate signals, examine the underlying events and escalate suspicious activity through the contacts agreed with you.
Understand changes in service behaviour
Available gateway, network and application logs can show whether a service stopped responding or whether access changed after an update. For connected buildings and operational systems, we agree collection with the operational owner and use existing telemetry wherever possible.
Investigation in practice
Follow the finding through to the fix.
If a remote-access gateway exposes an unexpected service, we check the evidence with its owner. Your team approves and makes the change. We repeat the relevant check and record the result.
Your 30 days
From readiness to handover
Agree the scope
Confirm the environments, exclusions, safe windows and people authorised to make changes. The service starts once access and agreed sources are ready.
Establish the baseline
Discover the visible estate, check collection and record the initial exposure. We flag gaps early so you can decide whether they can be addressed within the engagement.
Investigate and verify
Analysts review findings and activity as your team applies approved fixes. We record what changed, what was rechecked and what still needs attention.
Agree the next 90 days
At the closing review, we present the evidence, discuss residual risk and agree a practical order of work with your technical and business owners.
Your report
Evidence a technical team and a board can use
- Coverage
- Which assets and log sources were observed, which could not be verified, and how those limits affect the findings.
- Exposure and activity
- Validated weaknesses, relevant monitoring evidence and the implications for the business services in scope.
- Ownership and next steps
- Completed fixes, outstanding risks, named owners and a prioritised 90-day roadmap. Evidence can support assurance work; certification decisions remain with the assessor.
Common questions
Before you start
Who makes changes to our systems?
Your nominated owners approve and apply changes unless a different responsibility has been agreed. We investigate, recommend actions and verify fixes within the agreed scope.
Can you include connected building or OT systems?
Yes, where the system owner approves a safe method and relevant evidence is available. We confirm exclusions and maintenance windows first. Active scans or controller changes need separate authorisation.
What happens at the end of the 30 days?
We review the final report with you and hand over the roadmap. Your team can carry it forward or discuss further support. Ongoing monitoring is a separate agreement.
Discuss your environment
Tell us which sites or services you need to understand and who owns them. We’ll agree a practical scope for the investigation.
Talk to the C-Clear team ↗