EDR & SIEM alert triage
Every detection reviewed, enriched and classified, with false positives closed out.
Managed SOC services
SOC as a service for MSPs
SOC as a service that runs on the security tools you already sell: managed SOC analysts handle EDR and SIEM alert triage, investigation, containment by your playbooks and clear reporting your clients can understand, without you building a SOC.
- From $3,000/mo
- Coverage: 24/7, or after-hours and weekends
- ISO 27001 & SOC 2 certified
What's included
From $3,000/mo · per analyst seat
Threat investigation
Process trees, user activity and indicators investigated before anything is escalated.
Containment by playbook
Host isolation, account disablement and other containment actions you pre-approve.
Vulnerability follow-up
Critical findings turned into tickets and tracked to remediation.
Security awareness ops
Phishing reports triaged and suspicious emails analyzed.
Client-ready reporting
Monthly security summaries per client for QBRs and compliance.
How the work is split
What LTVplus handles
- Reviewing and classifying every EDR and SIEM detection
- Investigating process trees, users and indicators before escalating
- Containment actions you pre-approve, such as isolating a host
- Monthly security summaries per client for QBRs
What you keep
- The client relationship, contracts and billing
- Your PSA, RMM, documentation and security stack
- Escalation decisions and anything outside the agreed scope
How pricing works
SOC as a service is priced per analyst seat per month, based on coverage hours. Because we operate the security tools you already resell, you keep the product margin.
From $3,000/mo · per analyst seat · See all pricing
Works inside your stack
No new tools to buy. We work in your PSA, RMM, documentation and security platforms, under your brand.
-
SentinelOne -
CrowdStrike -
Huntress -
Sophos - Microsoft Defender
- Microsoft Sentinel
Typical certifications
Engineers are matched to the certifications and vendor experience your clients' environments need.
- CompTIA Security+
- CompTIA CySA+
- Microsoft Security Operations Analyst
The process
Live in 30 days.
From first call to tickets resolved under your brand.
- 1
Scoping Call
We learn your stack, your SLAs, your clients’ expectations and where coverage breaks today. 30 minutes.
- 2
Solution Design
Coverage hours, escalation matrix and runbooks agreed up front. Engineers are matched to your stack – ConnectWise, Datto, Kaseya, NinjaOne.
- 3
Knowledge Transfer
We handle the heavy lifting – access, documentation and SOPs set up in your PSA, RMM and docs platform. You simply review and approve.
- 4
Go Live
Tickets and alerts are worked under your brand. We handle QA, shift coverage and daily oversight, with weekly reporting. You focus on growth.
The comparison
Why MSPs choose us over the alternatives.
VS. HIRING IN-HOUSE
Skip the recruiting and training headache
No recruiting costs. No 90-day ramp. No two-week notices. Your team is managed, backed up, and replaceable without disruption.
VS. SHARED HELPDESK
Your engineers, not a ticket queue
Dedicated engineers who learn your clients' environments and quirks. Not a shared queue with scripted responses.
VS. STAFFING AGENCIES
Managed results, not just resumes
We don't send you a resume and wish you luck. We manage QA, scheduling, training, and performance. You get results, not headcount.
Frequently asked questions
Is this an MDR product?
No. We operate the security tools you already sell to clients, so you keep the margin and the relationship. See our MSP vs. MSSP vs. MDR guide for how the models differ.
What containment actions can analysts take?
Only the actions you approve in the playbook, such as isolating a host or disabling an account. Anything beyond that is escalated to you.
How is client data protected?
LTVplus is ISO 27001 and SOC 2 certified. Analysts work in your tenants with least-privilege, named accounts and MFA.
What is SOC as a service?
A security operations center delivered as a service: analysts monitor, investigate and respond to security alerts for you. With LTVplus it is white-labeled and runs on the EDR and SIEM tools your MSP already uses.
What is the difference between managed SOC services and MDR?
MDR is usually a packaged product with its own tooling. Managed SOC services from LTVplus operate your existing security stack under your brand, so the client relationship and margin stay with you.
How much does SOC as a service cost?
Pricing is per analyst seat per month. See the pricing page for starting rates or book a scoping call for a quote based on your alert volume.
Let's scope your coverage.
Tell us about your stack, your SLAs and where tickets pile up. We'll show you exactly how we'd cover it.
