bcom ICT provides 24/7 security operations centre (SOC) monitoring for Australian businesses, delivered by a specialist third-party security provider. Its analysts monitor endpoints, identities and cloud tenancies continuously, investigate alerts, separate noise from genuine intrusion and contain confirmed threats — day, night, weekends and public holidays. bcom ICT sets up the service, agrees the rules of engagement with you and handles the follow-up. Call 07 3041 8993.
Four places intrusions show up
Endpoints
Every laptop, desktop and server. Unusual process behaviour, known malware signatures, attempts to disable protection, and the early signs of ransomware before encryption starts.
Identities
Microsoft 365 and Azure sign-ins. Logins from countries you don't trade in, impossible travel, repeated failures, and mailbox rules quietly forwarding your invoices somewhere else.
Cloud tenancies
Configuration changes, new admin accounts, permission escalations and sharing settings suddenly opened up. Attackers who get in often change settings before they do anything visible.
Network edge
Firewall and remote access activity — where an intrusion typically starts, and where it's cheapest to stop.
The gap a SOC actually closes
Most businesses already own security tools. What they don't have is anyone reading what those tools produce outside business hours.
Attacks don't wait for business hours
The most common time to find an intrusion is a weekend or a public holiday, because that's when nobody is looking. A SOC removes that gap entirely.
Detection isn't the same as alerting
Most businesses have tools that generate alerts nobody reads. A SOC is people whose job is to triage those alerts, separate noise from genuine intrusion, and act.
Containment in minutes, not Monday
An isolated machine on Saturday night is an inconvenience. The same machine left running until Monday is often the whole network.
Evidence for afterwards
Continuous logging means that if something does happen, you can establish what was reached and when — which is what your insurer and, potentially, a regulator will ask for.
Do you need this yet?
Honestly, not every business does — and we'd rather say that than sell it to someone who'd get more from spending the same money elsewhere.
A SOC makes sense when:
- A breach would genuinely stop you trading, not just inconvenience you
- You hold client data whose exposure would be serious for them and for you
- An insurer or a larger client has started asking how you monitor for intrusion
- You operate in a regulated sector — financial services, health, government supply chain
- You've already had an incident and don't intend to have another
Start elsewhere when: you don't yet have multi-factor authentication everywhere, tested backups, and patching that actually happens. Those three stop far more than monitoring does, and they cost less. Our Essential Eight assessment is the honest first step.
When something is confirmed
Detection is only useful if it leads somewhere. A confirmed threat moves straight into incident response — containment, investigation, eradication and recovery, with the factual written account you'll need for your insurer and, if personal information was involved, for your assessment under the Notifiable Data Breaches scheme.
Rules of engagement — what the SOC isolates without asking, who gets called, and at what hour — are agreed with you before the service starts. Nobody should be working that out at 2am.
SOC monitoring is delivered by a specialist third-party security provider. What the provider can access, and where it operates, is explained during consultation before the service starts. How we handle data generally is set out on data handling and sovereignty.
The gap a SOC actually closes
Most businesses already own security tools. What they lack is anyone reading what those tools produce.
“We have alerts but nobody reads them”
Usually tooling generating signals into an inbox with no owner. Coverage on paper, none in practice.
What we do Put triage in front of the alerts. The value of a SOC is people separating noise from intrusion, not the software producing the alerts.
“Something happened over the weekend”
Usually intrusions are found on weekends and public holidays because that is when nobody is watching. Attackers know the pattern.
What we do Continuous monitoring closes the gap that business hours leave open. Detection at 2am rather than discovery on Monday is frequently the whole difference.
“An account signed in from overseas”
Usually credential compromise. The sign-in itself is the alert that matters most and the one most businesses never see.
What we do Detect it in minutes, disable the session, and establish what was reached while the attacker had access — rather than discovering it weeks later.
“We only found out because a client told us”
Usually no monitoring at all. The first indication came from outside, which is the worst way to learn.
What we do Continuous visibility across endpoints, identities and cloud so the business finds out first and can act before it becomes a client conversation.
“We can’t tell what happened”
Usually logging retained for days rather than months, so the investigation has nothing to work with.
What we do Retain the right telemetry for long enough to matter. Without it you may have to notify on the assumption of the worst because you cannot prove otherwise.
“Our insurer wants 24/7 monitoring”
Usually an increasingly common requirement, particularly for regulated businesses and those holding sensitive data.
What we do Provide monitored detection and response with the documentation to evidence it, rather than a tool that technically runs around the clock with nobody attached to it.
What continuous monitoring catches
Representative engagements, drawn from real work with identifying detail removed — we don’t name clients without written permission.
Contained at 2am on a Sunday
The situation
A monitored Gold Coast client’s Microsoft 365 tenancy showed a successful sign-in from an unusual location, followed within minutes by the creation of a mailbox forwarding rule.
What we found
Credential compromise from a reused password. The account had been exempted from MFA months earlier for a device compatibility reason nobody had revisited. The attacker was setting up to intercept invoice correspondence.
What we did
Session revoked and account disabled within minutes of the alert. Credential reset, forwarding rule removed, and sign-in logs reviewed to establish exactly what had been accessed in the window — which was nothing beyond the mailbox listing.
The outcome
The business was told on Monday morning what had happened and what had already been done about it. Discovered a fortnight later instead, this would have been a redirected payment and a notification decision.
Ransomware stopped before encryption
The situation
Endpoint telemetry on a monitored client flagged a process attempting to delete volume shadow copies on a workstation — a standard precursor to ransomware encryption.
What we found
A user had opened an attachment that afternoon. The payload was preparing the machine by removing local recovery options before beginning encryption. Nothing had been encrypted yet.
What we did
Isolated the machine from the network automatically under the agreed rules of engagement, then investigated. Confirmed no lateral movement, identified the delivery email, removed it from every mailbox, and rebuilt the affected workstation.
The outcome
One machine rebuilt instead of an estate encrypted. The rules of engagement — agreed in advance, allowing isolation without waiting for a phone call — are what made the timing possible.
Questions Gold Coast businesses ask us
What is a security operations centre?
A security operations centre is a continuously staffed capability that monitors an organisation's endpoints, identities, cloud services and network for signs of intrusion, investigates alerts, and contains threats. bcom ICT provides 24/7 SOC monitoring for Australian businesses through a specialist third-party security provider, covering day, night, weekends and public holidays. Call 07 3041 8993.
Who does the monitoring?
A specialist third-party security provider. Its analysts monitor your environment 24/7, investigate alerts and take the containment steps agreed with you. bcom ICT sets up the service, agrees the rules of engagement with you, and handles follow-up and remediation during business hours, 8:00am to 5:00pm Monday to Friday, Brisbane time.
Do small businesses actually need this?
Not all of them. A SOC makes sense once a breach would genuinely stop you trading, once you hold client data whose loss would be serious, or once an insurer or a larger client starts asking how you monitor for intrusion. Below that, getting the Essential Eight basics right delivers more per dollar and we'll tell you so.
Is this just software, or are there people?
Both, and the distinction matters. The tooling generates signals; the value is people triaging them. Software alone produces alerts nobody reads, which is worse than nothing because it looks like coverage.
What happens when something is detected?
Triage first — most alerts are benign and chasing every one would make the service useless. Genuine threats are contained, typically by isolating the affected device or disabling the compromised account, and you're notified. For confirmed incidents we move into full incident response.
Will you isolate a machine without asking us?
For a clear, active threat like ransomware beginning to encrypt files, yes — the SOC contains first and you're told immediately, because minutes matter. The rules of engagement are agreed with you when the service starts, so nobody is surprised at 2am.
Does this replace our antivirus?
It includes endpoint protection rather than sitting on top of your existing product. Running two is usually counterproductive — they interfere with each other and neither works properly.
Where is our data monitored from?
The SOC is delivered by a specialist third-party security provider. We explain what the provider can access, and where it operates, during consultation before the service starts. If Australian-only processing is a hard requirement, tell us before we design it.
Not sure whether you need a SOC?
We'll tell you honestly. If the basics aren't in place yet, monitoring is the wrong thing to buy first and we'll say so.