← All Blogs

24/7 Monitoring Means Four Different Things. Ask Which One You Bought.

By Best IT MSP Editorial Team - Updated October 20, 2026 - 10 min read

The Best IT MSP editorial team maintains this directory's provider data across the US and Canada. We rank providers on verified rating and firmographic data, label paid placement, and do not sell IT services.

What does 24/7 security monitoring actually mean?

24/7 security monitoring means one of four different services, and the phrase alone never tells you which one you bought. The four tiers run from an automated rule that emails an alert into an unattended inbox to a staffed service authorized to isolate an infected machine at 3am without calling you first. Both are honestly described as 24/7 monitoring. The price difference between them is large.

The difference matters because attackers work the hours nobody is watching. CrowdStrike measured an average eCrime breakout time of 29 minutes in 2025, a 65 percent speed increase on the year before, with the fastest observed breakout taking 27 seconds. Sophos, reviewing 661 incident response and managed detection and response cases, found 88 percent of ransomware payloads were deployed during non-business hours. A monitoring tier that produces its first human decision on Monday morning is not watching the window that gets used.

This guide names the four tiers, gives you the single question that separates them, and walks the same Sunday-night alert through each one. Read it beside Who at Your MSP Can Log Into Your Systems at 2am?, which covers who holds the credentials, and Would You Actually Know? A 7-Check Audit of Your MSP's Detection and Logging, which covers whether the alert gets generated at all. This post covers who is allowed to act on it.

The four tiers of 24/7 monitoring, from cheapest to real

Four tiers sit behind the phrase, and they differ by who acts rather than by what is installed. Every tier collects data around the clock. What changes is whether a person is awake, whether that person may touch your systems, and how long they may take.

• Tier 1. Automated alerting. An automated rule fires and emails an alert into a shared inbox nobody reads overnight. Nothing else happens until someone opens the mailbox.
• Tier 2. Collected telemetry. Endpoint detection and response agents and a SIEM collect telemetry all night. A technician reads the queue the next business morning and decides what matters.
• Tier 3. Staffed triage. A staffed tier-1 desk performs alert triage at 3am, confirms the alert is real, then works your escalation path and waits for approval before acting.
• Tier 4. Authorized containment. A security operations center is contractually authorized to isolate a host, disable an account or block an address immediately, then tell you what it did.

Only tier 4 shortens the clock on its own. Tiers 1 and 2 are automated detection with deferred human judgment, and the deferral is the product you are buying. Tier 3 looks like the real thing and frequently is not, because an analyst who may not act can only escalate. Sophos put the time from an attacker getting inside to reaching the Active Directory server at 3.4 hours. Three of the four tiers lose that race by design.

Two services sit outside the ladder and get confused with it. Extended detection and response widens the data an analyst can see, and XDR changes none of the four tiers, because a tier is a staffing and authority question rather than a telemetry question. Threat hunting is a separate line item, where an analyst proactively hunts for intrusions no rule flagged.

Tier 1 and tier 2 are not fraud, and plenty of small businesses are correctly served by them. The failure is buying one and believing you bought another. Most proposals describe a tiered service without ever naming the tier, so ask any provider to place its own offer on this ladder. A proactive provider answers in one sentence, because the tier is a staffing fact rather than a marketing claim. The stakes sit in what the alerts are about. Sophos traced 67 percent of the incidents it investigated to identity-related attacks, and a stolen login looks exactly like an ordinary one until a human examines it.

The one question that separates the four tiers

Ask who is authorized to act without you, and the longest they may take. That one question sorts all four tiers in a single answer, because every tier monitors and only one may contain. An alert nobody is permitted to act on is a log entry with a timestamp.

Most buyers ask the wrong question instead. Asking whether a provider monitors 24/7 returns a yes from all four tiers, so the answer carries no information. Asking who may isolate a machine at 3am without reaching you, and what the longest permitted delay is, returns a different answer from each tier. Put the second question in the contract and the tier becomes contractual rather than implied.

The cost of getting this wrong shows up in how victims find out. Mandiant, reporting on investigations through 2025, found that in ransomware cases the adversary notified the target 44 percent of the time, internal teams identified it 41 percent, and an external entity told them in 15 percent. The most common way a ransomware victim learns what happened is the attacker telling them. Across all investigations the picture is better and still uncomfortable, with organizations detecting the activity internally 52 percent of the time, up from 43 percent.

Speed is why authority beats awareness. Mandiant measured the median time between initial access and hand-off to a second threat group falling from more than 8 hours in 2022 to 22 seconds in 2025. No phone call reaches a business owner in 22 seconds. Where the containment decision has to travel through a sleeping customer, the decision arrives after the event it was meant to prevent.

Monitoring without a pre-agreed authority to contain is not protection. It is a well-timed record of what happened.

What each tier means at 3am on a Sunday

At 3am on a Sunday, the four tiers produce four different outcomes from the same alert. Picture one event. A privileged account signs in from an unfamiliar country at 02:14 and starts enumerating your file shares.

• Tier 1 outcome. The rule fires at 02:14 and an email lands in a shared mailbox. The first human reads it at 08:40 on Monday, hours after the encryption finished.
• Tier 2 outcome. The sign-in is captured in the SIEM and waits in a queue. A technician works the queue on Monday, finds the event, and opens an investigation that is now forensic rather than preventive.
• Tier 3 outcome. An analyst triages the alert at 02:21, confirms it is real, and starts working the escalation path. Your mobile is on silent. The analyst logs three attempts and waits.
• Tier 4 outcome. The analyst isolates the host at 02:19 under a standing runbook, disables the account, and sends a summary you read on Monday with the incident already closed.

The off-hours pattern is deliberate rather than accidental. Sophos found 79 percent of data exfiltration actions take place outside business hours and that median dwell time has fallen to three days. Attackers now compress the whole operation into the window a weak contract leaves uncovered. CrowdStrike recorded one intrusion where data exfiltration began within four minutes of initial access.

Notice what tier 3 costs you. You paid for a staffed desk, a real analyst looked at your alert inside seven minutes, and nothing was contained, because the one permission that mattered was never granted. A provider that may not act cannot respond; it can only report. That is the most expensive failure on the ladder, and it stays invisible until an incident.

Why a staffed desk still cannot help you without authority

A staffed desk cannot contain what it is not authorized to touch, so the authority clause decides whether the staffing you pay for converts into a shorter incident. Three things get in the way, and all three are measurable.

The first is noise. The SANS 2025 Detection and Response Survey found false positives are the leading detection challenge, cited by 73 percent of respondents, up from 64 percent in 2024, and that 59 percent cite a lack of skilled personnel. A high false positive rate is also the honest reason a provider withholds containment authority, because nobody wants to isolate the finance director's laptop over a bad rule. The fix is a tuned runbook naming which alert types are pre-authorized, not a blanket refusal to act.

The second is staffing economics. ISC2 surveyed 16,029 practitioners and found 33 percent say their organization lacks the resources to staff its team adequately, while 29 percent cannot afford people with the skills they need. Covering every hour of the week needs roughly five full-time analysts for one continuously occupied seat, which is why genuine tier 4 costs real money and why tier 1 gets sold under the same four words.

The third is the clock. IBM measured the mean time to identify and contain a breach at 247 days, reversing five straight years of improvement, and found breaches running past the 200-day mark cost about a third more than those closed sooner, against a record global average of $4.99 million. Containment speed is the one variable in that equation you can actually buy.

What to get in writing about who may act

Put six lines in the contract rather than the proposal, because a proposal describes intent and a contract creates an obligation. The allied cyber agencies already recommend this split in plain terms.

CISA, the NSA, the FBI and international partners advise MSP customers to establish in the contract whether the MSP or the customer owns specific responsibilities, such as hardening, detection, and incident response, and state that contracts should detail how and when MSPs notify the customer of an incident affecting the customer's environment. Detection and incident response appear there as separable duties in government guidance, so treat the split as a normal thing to ask about.

• Name the tier in plain words, including whether the overnight shift is staffed or on call.
• List the specific actions the provider may take without you, such as isolate a host, disable an account, block a domain or kill a process.
• Set a maximum time to containment for each pre-authorized action in the service level agreement, measured in minutes from alert to action.
• Fix the escalation path, naming who is called, in what order, and what happens when nobody answers.
• Require a monthly report of mean time to detect and mean time to respond, with the count of containment actions taken.
• Agree the runbook in advance and review it quarterly, so the pre-authorized list still matches your real tolerance.

The default matters more than the list. Decide now which alert types you authorize in advance, and what happens when nobody answers the phone at 3am. Contain and tell me afterwards is a defensible position. Wake me and wait is also a defensible position. Having never decided is not. Sophos found only 34 percent of small organizations with 100 to 250 employees stopped attacks before encryption or extortion, while 56 percent of attacks still reached encryption, up from 50 percent the year before. Verizon now puts 48 percent of all breaches as involving ransomware. Your default is doing most of the deciding.

How to test what you actually bought

To test what you bought, send three requests this week and read the answers for specifics. Each one takes a provider running a genuine tier 4 a single sentence to answer, and each one is awkward for a tier 1 sold as something more.

• Request the written list of actions your provider may take at 3am without reaching you.
• Request last quarter's mean time to respond, plus the number of hosts isolated outside business hours.
• Request the name of the organization that staffs the overnight shift, because the security operations center behind a small provider is often a third party you have never been told about.

Then run the live test, which is worth more than all three answers. Call the after-hours number at 10pm on a weekend and time how long it takes to reach a person who can describe your environment. A tier 4 provider treats that call as routine. A tier 1 provider treats it as an escalation. Mandiant put the global median dwell time at 14 days, up from 11, and closing that gap is the whole job of an overnight shift.

Judge what comes back on numbers rather than tool names. Good sounds like nine named alert types, a 15-minute containment window, and four hosts isolated out of hours last quarter. Weak sounds like we monitor 24/7 and we would call you straight away. Check what survives the night too, because Sophos reported that cases hampered by missing logs due to retention issues doubled year over year, so verify your log retention outlasts the investigation it has to support.

Three answers should end the conversation.

• Refusing to put any containment action in writing.
• Quoting a response time that measures the first email rather than the first action.
• Declining to name who staffs the overnight shift.

None of this buys perfect security, and no honest provider claims it does. It buys a measurable, contractual answer to one question, which is more than most buyers hold today. Best IT MSP is independent and does not sell IT services, so we rank providers on verified rating and firmographic data and publish our evaluation method in full. Take the authority question to three vetted providers in your city and compare the answers side by side.

FAQ

What does 24/7 monitoring mean in an MSP contract?

It means one of four tiers, and most contracts never say which. The four are an automated alert into an unattended inbox, telemetry read the next morning, a staffed desk that must call you first, and a service authorized to contain a threat alone. Sophos found 88 percent of ransomware payloads deployed outside business hours.

Can my MSP isolate a computer without my permission?

Only if your contract says so. Isolation authority is granted in advance or not at all, and most agreements are silent, which defaults to waiting for you. Mandiant measured the median hand-off between threat groups falling to 22 seconds, so a permission call rarely arrives in time. Decide the default before an incident.

Is 24/7 monitoring the same as a SOC?

No. A security operations center is a staffed facility, while 24/7 monitoring can be an automated rule with nobody behind it. Tiers 3 and 4 both use a SOC, and only tier 4 may act alone. ISC2 found 33 percent of organizations lack the resources to staff teams adequately.

What response time should I ask for in a monitoring SLA?

Ask for time to containment in minutes, not time to first notification. CrowdStrike measured an average 29 minutes from first access to lateral movement, so a 15-minute containment window on pre-authorized alert types is a defensible target. A four-hour notification promise measures an email, not a defense.

How do I know if my 24/7 monitoring is automated or staffed?

Call the after-hours number at 10pm on a weekend and time the answer. A staffed tier reaches a person who can describe your environment, while an automated tier reaches voicemail or a ticket. Then ask how many hosts were isolated out of hours last quarter. Zero across a year usually means nobody is authorized.

← All Blogs