24/7 security monitoring and response
Analysts watch your computers, servers, accounts and network activity around the clock. They bring logs and alerts together, so activity on an account, computer and network is investigated as one incident.
Managed cybersecurity
Managed cybersecurity services with 24/7 security monitoring
FunctionOne is a managed cybersecurity service that watches your connected systems around the clock. Security analysts review alerts, investigate suspicious activity, and send you findings and next steps you can act on.
Book a security assessment
We'll review your systems and accounts, then agree scope and response rules with you before anything is switched on.
We use your details only to arrange your assessment.
What our managed cybersecurity service covers
The service brings monitoring, response and leadership reporting together, with testing and incident response available as separate scopes.
Microsoft 365 security monitoring
We flag sign-ins from unusual locations or IP addresses, repeated password attempts, unauthorized mailbox access and new external forwarding rules. We also watch for changes to multifactor authentication, permissions, security settings and application permissions.
Dark web monitoring
We identify staff credentials exposed on the dark web. You can then review and protect the affected accounts.
Incident response
FunctionOne offers incident response for events that need more than monitoring and containment. We scope it separately from the monitoring service.
Penetration testing and vulnerability management
Penetration testing checks how an attacker could get in, and vulnerability management tracks weaknesses that need fixing. Both are scoped separately.
Security reviews for leadership
A recurring management review covers material incidents, response actions, open remediation and repeat findings. It also flags systems that aren't sending expected data.
What happens when we find something
Our analysts follow the same steps for credible threats, within response rules your leadership approves.
Detect
Analysts investigate suspicious activity and prioritize credible threats. Behavior analytics learn typical activity, and threat intelligence adds context about malicious addresses, domains and attack methods.
Contain
Within the authority you approve, analysts can isolate a computer, stop a malicious process, require a password reset or disable an account.
Escalate
We send your named contacts the findings, evidence, actions taken and next steps. Your leadership makes the business and risk decisions.
Review
FunctionOne organizes remediation and follow-up. Findings then inform changes to access, configuration, monitoring or procedures.
Why does managed cybersecurity from FunctionOne matter to leadership?
FunctionOne managed cybersecurity includes 24/7 security monitoring, Microsoft 365 account protection, dark web monitoring and leadership reporting, delivered from offices in Syracuse, New York and Tampa, Florida. The NIST Cybersecurity Framework (CSF) 2.0, published in 2024, says detection runs continuously while response and recovery stay ready at all times. Our analysts watch accounts, computers, servers and network activity around the clock. Each engagement starts with a security assessment.
IBM's Cost of a Data Breach Report 2026, published in 2026, found the average time to identify and contain a breach rose for the first time in five years, up 2.5% to 247 days: 183 days to identify and 64 to contain. That average covers all breaches in IBM's study.
Verizon's 2026 Data Breach Investigations Report, published in 2026, names exploiting vulnerabilities as the most common way into a breach, ahead of stolen-credential abuse. Vulnerability management, incident response and penetration testing are separate scopes you can add to FunctionOne managed cybersecurity. During the security assessment, we review your systems and accounts, then agree scope and response rules before anything is switched on.
Microsoft Learn's Plan for mandatory Microsoft Entra multifactor authentication, published in 2026, says multifactor authentication can block more than 99.2% of account compromise attacks. Some attacks still get through, so we pair multifactor sign-in with stolen password alerts, phishing email monitoring and payment request checks.
Who does what
Our teams handle monitoring and service management, and your leadership keeps the business decisions.
| Team | Responsibility |
|---|---|
| 24/7 analysts | Monitor, investigate, contain within agreed authority and provide findings. |
| FunctionOne | Coordinates onboarding and integrations, manages the service, supports escalations, and organizes remediation and follow-up. |
| Your leadership | Identifies critical operations, approves response authority, makes business and risk decisions, and directs external communications. |
Dashboards, investigation records and reports help answer audit and insurance questions, though they don't by themselves make a company compliant.
How to get started
Your first step is a security assessment, and setup follows in stages.
Confirm the scope
We list the devices, identities, locations and data sources to cover. Your leadership identifies the critical operations.
Agree response rules
You approve the actions analysts may take, approvals for sensitive systems, primary and backup contacts, and after-hours escalation.
Connect and validate
We set up agents, cloud connections or log collectors and confirm the data arrives. Then we test notifications and responses.
Review and maintain
We check coverage, review findings with your management and update monitoring as you add users, systems and locations.
Common questions about managed cybersecurity
What does managed cybersecurity include?
Managed cybersecurity from FunctionOne includes 24/7 security monitoring, Microsoft 365 account protection, dark web monitoring, and leadership reporting. Incident response, penetration testing, and vulnerability management are available as separate scopes you can add based on your organization's needs.
What happens after hours?
FunctionOne's analysts watch your systems around the clock, including nights, weekends, and holidays. If they find a credible threat after hours, they investigate it, contain it within your approved response rules, and notify your named contacts.
What can analysts do without asking first?
Within the authority your leadership approves in advance, analysts can isolate a computer, stop a malicious process, require a password reset, or disable an account. Anything outside that authority goes to your leadership for a decision first.
How is this different from antivirus software?
Antivirus software scans a single device for known malware. FunctionOne's managed cybersecurity service monitors accounts, computers, servers, and network activity together, investigates suspicious activity across your organization, and gives you findings an analyst reviewed.
How long does setup take?
Setup happens in stages. FunctionOne first confirms scope and response rules with your leadership, then connects and validates your systems, and finally reviews coverage before moving to ongoing monitoring and maintenance.
Can FunctionOne work with our in-house IT team?
Yes. FunctionOne offers co-managed IT, which means FunctionOne works beside your in-house IT team. FunctionOne also offers fully managed IT. Both options start with a security assessment, and FunctionOne agrees scope and response rules with your team before anything is switched on.
How does FunctionOne defend against AI attacks?
FunctionOne defends against AI attacks with phishing email monitoring, stolen password alerts, multifactor sign-in, payment request checks and rules for how staff use AI tools. FunctionOne also uses behavior analytics and threat intelligence, and analysts confirm findings and act within rules you approve.
What security reports does FunctionOne give leadership?
Your leadership gets a monthly summary and a regular security review from FunctionOne. Reports name an owner and the next steps for open items.
Sources
- NIST, The NIST Cybersecurity Framework (CSF) 2.0, 2024
- IBM, Cost of a Data Breach Report 2026, 2026
- Verizon, 2026 Data Breach Investigations Report, 2026
- Microsoft Learn, Plan for mandatory Microsoft Entra multifactor authentication, 2026