Your customer's security questionnaire asks: "Do you have 24/7 security monitoring?"
Most startups answer "yes" and mean "we have a tool that generates alerts." Those are two very different things.
24/7 monitoring means someone is watching, triaging, and responding to security events around the clock. Not a dashboard. Not an inbox. A human being who understands your environment, can distinguish a real threat from noise, and knows what to do when something is real.
For a company with 20 to 100 employees, building this internally is impractical. A three-person security operations center running 24/7/365 requires at least 5 full-time analysts to cover shifts, vacations, and sick days. At $80,000 to $120,000 per analyst, that's $400,000 to $600,000 in staffing alone, before tools.
There's a better way.
The layers of monitoring
Not everything needs the same level of attention. A practical monitoring strategy for a small company has three layers.
Layer 1: Automated detection (always on). Your security tools run continuously and generate alerts based on rules, signatures, and behavioral analysis. EDR watches endpoints for malicious processes. Cloud security tools monitor for configuration changes and suspicious API calls. Email security flags phishing attempts. SIEM or log aggregation correlates events across sources. This layer runs itself. The tools detect. They alert. But an alert without a human is just noise in an inbox.
Layer 2: Managed triage (24/7 human review). A managed detection and response (MDR) provider monitors your security tool alerts around the clock. When an alert fires, an analyst reviews it, determines whether it's a true positive or a false positive, and either contains the threat or closes the alert with documentation. This is the layer most small companies are missing. They have the tools (layer 1) but nobody watching the output. Good MDR providers include CrowdStrike Falcon Complete, SentinelOne Vigilance, Arctic Wolf, Huntress, and Expel. Costs range from $3,000 to $10,000 per month depending on the number of endpoints, log sources, and the depth of coverage.
Layer 3: Strategic oversight (your vCISO). The MDR provider handles the tactical alert-by-alert triage. Your vCISO handles the strategic layer: reviewing monthly reports, identifying trends, adjusting detection rules, coordinating incident response when something significant happens, and reporting to leadership.
This three-layer model gives you genuine 24/7 monitoring with human response at a fraction of the cost of building an internal SOC.
What gets monitored
For a typical startup or healthcare company, the monitoring scope should cover:
Endpoints. Every laptop, workstation, and server. EDR monitoring for malicious processes, ransomware behavior, credential theft, lateral movement, and unauthorized software installation.
Cloud infrastructure. AWS, Azure, or GCP. Configuration changes, IAM modifications, unusual API activity, resource creation in unexpected regions, root account usage, security group modifications.
Email. Inbound phishing attempts, business email compromise indicators, unusual forwarding rules, impossible travel on email logins.
Identity. Failed login attempts, brute force patterns, impossible travel (logging in from two locations that are geographically impossible in the timeframe), password spray attacks, MFA bypass attempts.
Application. If your product handles sensitive data, monitor for unusual access patterns: mass data downloads, access outside normal hours, privilege escalation, API abuse.
For healthcare companies specifically
HIPAA requires audit controls (45 CFR 164.312(b)): mechanisms to record and examine activity in systems that contain or use ePHI. 24/7 monitoring with documented triage and response directly satisfies this requirement.
Health-ISAC (the healthcare sector's threat intelligence sharing organization) regularly publishes alerts about active threats targeting healthcare. The ShinyHunters campaign targeting health tech companies through helpdesk social engineering is the most recent example. Monitoring that's tuned to healthcare-specific threat intelligence catches these attacks faster.
Your monitoring should specifically watch for access to systems containing PHI outside normal business hours, bulk export or download of patient records, changes to user permissions on clinical systems, and new device connections to networks that access patient data.
What to tell your customers
When a security questionnaire asks "do you have 24/7 monitoring," here's what a strong answer looks like:
"Yes. We deploy endpoint detection and response across all endpoints monitored 24/7 by [MDR provider]. Cloud infrastructure monitoring is performed through [tool]. Security events are triaged by the MDR provider's SOC with documented escalation procedures. Our vCISO reviews monitoring reports monthly and coordinates incident response for any events requiring executive attention."
That's specific, defensible, and verifiable. Compare that to "yes, we have monitoring tools in place." The first answer closes deals. The second one generates follow-up questions.
What we do
We design and manage the monitoring stack for our clients. We select and deploy the right EDR and monitoring tools, coordinate with MDR providers, configure the alerting and escalation rules, and provide the strategic oversight layer as your vCISO. For healthcare companies, we tune the monitoring for HIPAA-specific requirements and healthcare threat intelligence.
Farbod Fakhrai is the founder of Com-Sec, a cybersecurity and compliance consulting firm supporting startups and growth-stage companies, with deep expertise in healthcare and health tech.