This is an operations engagement rather than an assessment, and the difference matters. An assessment tells you where you stand on a date. Monitoring tells you what is happening now, and it only works if somebody owns it after the first quarter.
Onboarding is the unglamorous part that decides the outcome
Detection quality is bounded by log quality. The first phase was establishing what the estate actually produced, what it should produce, and closing the gap. This is where most SOC deployments quietly underdeliver: the platform is live, the dashboards look right, and three important log sources were never onboarded because the owning team was busy.
We treat the source inventory as a deliverable in its own right, reviewed with the client, so nobody discovers a gap during an incident.
Tuning against a real environment
Out of the box detection content is written for an average estate, and no estate is average. The first weeks of any deployment are dominated by tuning: understanding what normal looks like here, which administrative behaviour is expected, which scheduled job looks exactly like exfiltration at three in the morning.
Content that is not tuned produces alert volume, and alert volume produces the habit of ignoring alerts, which is worse than not monitoring at all because it comes with a false sense of coverage.
Where the AI layer sits and where it does not
CYQER assembles context before an analyst opens an alert: what ran, what it touched, which identity, what happened next. That removes the search step, which is the bulk of triage time.
It does not decide containment. Isolating a host or disabling an account is a business decision with a business consequence, and it goes to a person. That boundary is deliberate and it is written into how the service operates.
What ongoing looks like
Detection engineering continues for as long as the estate changes, which is permanently. New applications, new cloud services, new attacker technique. The engagement includes that work rather than treating the deployment as finished at go live.