24/7 SOC for UK businesses
When your office goes dark, we're watching.
Round-the-clock security monitoring for UK SMEs. A UK company for contracts and accountability, with trained analysts on shift every hour of the night, weekend and bank holiday.
- 02:14CRITImpossible-travel sign-in blocked, finance mailboxT1078 Valid Accounts · session revoked, client called
- 02:09HIGHEncoded PowerShell on LAP-0412 isolatedT1059.001 · EDR containment applied
- 01:52LOWInbox forwarding rule to external addressT1114.003 · rule removed, user notified
- 01:30LOW47 failed VPN logins from a single IPT1110 Brute Force · IP blocked at firewall
Watch · 30 seconds
How we stop a real attack while you sleep
London · Tuesday nightYour office is closed. Attackers aren't.
02:14:03Someone signs in with a stolen password.
Same nightBots hammer your website looking for old PHP files.
02:14:48Our AI links the alerts into one incident in seconds.
- Analyst confirms account takeover
- All sessions revoked
- Forwarding rule removed
- Your emergency contact called
02:17 · Pune SOCAn analyst locks the attacker out.
Before anyone woke up.
Dramatised example based on a common Microsoft 365 account takeover.
Firewall protection
Is your business protected by a firewall?
Your firewall sits where the internet meets your network. It's where real attacks arrive first: scans, break-in attempts on remote access, and malware calling home. Without a properly set up firewall, your business is open to the internet.
Not sure, or don't have one? Call us. We can help.
- Supply and install business firewalls
- Review and fix your existing firewall setup
- Keep firmware and security updates current
- 24/7 monitoring of firewall alerts by our SOC
Website and PHP attacks
Your website is being attacked right now
Most UK business websites run on PHP, including WordPress, WooCommerce and many customer portals. Automated tools scan every site on the internet, all day, looking for an old PHP file, an outdated plugin or an upload form they can abuse. One unpatched file can give an attacker control of your server.
| 03:02:11 | GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | PHPUnit remote code execution probe | BLOCKED |
| 03:02:14 | POST /php-cgi/php-cgi.exe?%ADd+allow_url_include%3d1 | PHP-CGI argument injection | BLOCKED |
| 03:05:40 | POST /wp-login.php (x312) | WordPress password guessing | BLOCKED |
| 03:09:03 | GET /products.php?id=7' UNION SELECT username,password FROM users-- | SQL injection | BLOCKED |
| 03:11:27 | POST /wp-content/uploads/2026/10/img_4471.php | Web shell disguised as an image upload | ALERTED |
Forgotten developer files
Test tools like PHPUnit left on live servers still let attackers run their own code. Years after the fix, bots still scan for them daily.
PHP itself
A flaw in PHP-CGI on Windows servers let attackers run commands remotely. It was used to spread ransomware within days of disclosure.
WordPress add-ons
Most WordPress hacks come through an outdated plugin, not WordPress itself. Abandoned plugins never get fixed.
Web shells
A small PHP file uploaded through a weak form gives attackers a hidden back door. They use it to steal data or move into your network.
SQL injection
Badly written PHP pages let attackers read your database, including customer details and passwords. That's a reportable data breach under UK GDPR.
Checkout skimming
Hidden code added to a WooCommerce or Magento checkout copies card details as customers type them.
How we protect your website
- Web application firewall (WAF) to block attacks before they reach PHP
- 24/7 monitoring of web server logs by our SOC
- Alerts when new PHP files appear in upload folders
- Monthly scans for outdated PHP versions, plugins and exposed files
- Patching and hardening for WordPress and PHP servers
How it works
From alert to answer, every hour of the day
Every alert follows the same path, so nothing waits for Monday morning.
We collect the signals
Endpoint, Microsoft 365, firewall and cloud logs flow into our SIEM, tuned to your business.
ContinuousAn analyst checks it
A real person investigates, rules out false positives and decides how serious it is.
Within 10 minWe contain the threat
Isolate a device, revoke a session or block an IP, using actions you approve during onboarding.
Critical: 15 minYou get the full story
A clear incident note for every escalation, plus a monthly report you can hand to your insurer or board.
MonthlyAI-assisted operations
AI does the legwork. Analysts make the call.
We use AI to handle the slow, repetitive parts of every investigation. That frees our analysts to spend their time on judgement, and it's how we reach a critical alert in minutes instead of hours.
- Alert enrichmentEvery alert is checked against threat intelligence, the user's normal sign-in pattern and the device's recent history before an analyst opens it.
- Noise reductionDuplicate and related alerts are grouped into one incident, so a single attack doesn't become 40 separate tickets.
- Risk scoringEach incident is ranked by likely impact, so the most dangerous ones reach an analyst first.
- Investigation summariesA plain-English summary of what happened, which accounts and devices are involved, and the matching MITRE ATT&CK techniques.
- Report draftingIncident notes and monthly reports are drafted automatically and reviewed by an analyst before they reach you.
- Is this a real attack?An analyst confirms every escalation. AI never closes a high or critical alert by itself.
- ContainmentIsolating a device, disabling an account or blocking traffic is approved by an analyst, within the actions you agreed during onboarding.
- Talking to youWhen something serious happens, you get a call from a person who understands your business.
- Tuning your detectionsOur senior analysts review what the automation gets wrong and adjust the rules every month.
- +0:00SIEMSign-in from an unfamiliar country, 40 minutes after a UK sign-in
- +0:20AIEnriched: IP on a known proxy list, MFA prompt approved, new inbox rule created
- +0:45AIGrouped 3 related alerts into one incident, scored critical, summary written
- +3:10ANALYSTConfirmed account takeover, revoked sessions, removed inbox rule
- +6:30ANALYSTCalled the client's emergency contact and reset the password together
What we monitor
Built around the tools UK SMEs already use
Microsoft 365
Risky sign-ins, mailbox rules, OAuth app consent and admin changes.
Entra ID · Exchange · SharePointLaptops and servers
Ransomware behaviour, malicious scripts and suspicious processes, with remote isolation.
Defender · SentinelOne · CrowdStrikeFirewalls and VPN
Brute-force attempts, unusual traffic and connections to known bad hosts.
Fortinet · Sophos · WatchGuardCloud
Exposed storage, new admin accounts and changes to security settings.
Azure · AWSVulnerabilities
Monthly scans with a prioritised fix list, ranked by real risk.
External and internal scansCompliance
Evidence and reporting for Cyber Essentials, ISO 27001 and insurer questionnaires.
Monthly report packPricing
Simple per-device pricing, billed monthly in GBP
Typical UK SOC providers charge £8–£20 per device. We start at £7, with free onboarding and a 30-day pilot so you can see the service working before you commit. Prices exclude VAT.
Essentials
For small teams that need 24/7 cover on their devices.
- 24/7 endpoint monitoring (EDR)
- Analyst triage of every alert
- Phone and email escalation
- Remote device isolation
Professional
Full visibility across devices, Microsoft 365 and network.
- Everything in Essentials
- SIEM monitoring of M365, firewall and servers
- Proactive threat hunting
- Monthly security report
Enterprise
For regulated firms and businesses in larger supply chains.
- Everything in Professional
- Incident response hours included
- Vulnerability management
- Compliance reporting and vCISO time
Minimum 10 devices. Microsoft Defender licences can be supplied or brought from your existing subscription. Switching provider? We'll onboard you before your current contract ends, so you're never unprotected.
For IT providers
Your brand. Our night shift.
UK MSPs use Lanternwatch as their white-label SOC. Sell 24/7 security under your own name without hiring a single overnight analyst.
- White-label reports and portalClients see your logo, not ours.
- Multi-tenant onboardingAdd a new client in an afternoon from one console.
- Partner marginWholesale pricing that leaves room for your markup.
- Escalation to your team or the clientYou choose who gets the 3am call.
What clients say
Trusted by UK businesses to watch their networks
We're taking on our first pilot clients. Free onboarding and a 30-day pilot.
Become a pilot clientSecurity and data
How we protect your data while we protect your business
Your logs stay in the UK
Log data is stored in UK cloud regions. Analysts review it remotely through secured sessions and nothing is copied to their machines.
UK contract, UK accountability
You contract with a UK limited company, with a named UK account manager for onboarding and serious incidents.
UK GDPR compliant
A data processing agreement with every client and approved safeguards (IDTA) for international access.
Locked-down analyst access
Phishing-resistant MFA, privileged access controls, full session logging and background-checked staff.
Questions
Common questions
What is a SOC, and do I need one?
A Security Operations Centre is a team that watches your systems for attacks and responds when something happens. Most ransomware attacks start outside office hours. If no one is watching at night, attackers can work for hours before anyone notices.
We already have antivirus. Isn't that enough?
Antivirus blocks known threats. Many attacks use stolen passwords or legitimate tools that antivirus allows. An analyst can spot a login from the wrong country or an unusual mailbox rule and act on it.
How long does onboarding take?
Most clients are fully monitored within two weeks. We deploy agents, connect Microsoft 365 and your firewall, then spend the first month tuning alerts so you only hear about what matters.
Where are your analysts based?
Our analysts work from our operations centre in India, which lets us offer real 24/7 cover at a price SMEs can afford. Contracts, account management and data storage are all in the UK.
Is my data used to train AI models?
No. The AI tools we use run inside our secured environment in UK cloud regions, under agreements that stop your data being used to train models. AI only processes your security logs to investigate alerts for you.
Will this help with cyber insurance?
Many insurers now ask about EDR and 24/7 monitoring at renewal. Our monthly report gives you the evidence to answer those questions.
Get started
Book a free Microsoft 365 security check
We review your Microsoft 365 setup and send you a short report with the five changes that would reduce your risk most. No obligation.