Containment is delivered within the severity response itself, not as a separate metric. On a confirmed Critical case, the analyst investigates, contains pre-approved endpoints, and escalates, all inside the 30 minute response. You choose a response posture per client at onboarding: under Active Posture the SOC acts on confirmed threats without waiting for approval; under Measured or Cautious Posture the SOC escalates or seeks your approval first. Where an endpoint is not pre-approved, we escalate within the response target and carry out the quarantine action within 1 hour of your approval.

These commitments are contractual, not aspirational.

And the reporting that comes with them

You see the work, not just the outcomes. Every partner receives a weekly data pack each Friday covering cases, escalations, tuning actions and open items, and a monthly service report by the 5th of each month covering SOC activity by severity, SLA performance and threat trends. After any declared security incident, a full post-incident report lands within 5 business days of closure: timeline, root cause, indicators of compromise, containment actions taken and recommendations.

Your named Fractional Security Director: what they do and when

Fractional does not mean anonymous. Your FSD is a named individual who joins your client introductions, leads quarterly security reviews, owns escalation when an incident is live, and translates findings into language a board acts on. They work through and in partnership with your team; your clients know who their security director is from the first conversation.

When a partner's manufacturing client replaced its core network switches, our FSD designed the OT monitoring architecture around the change, specifying sensor placement across the data center and production sites so coverage was in place before the new topology went live.

During an enterprise partner's proof of concept, our FSD defined the containment authority model with the client's security team, documenting exactly which response actions run automatically and which wait for approval, before go-live.

And fractional does not mean less. It means a CISSP-certified security director scaled to the size of the engagement, backed by a full 24/7 SOC, at a fraction of the cost of an in-house hire. An in-house CISO is a six-figure salary and a single person covering a 24/7 problem. Your FSD brings the same seniority, backed by a SOC that never goes offline.