Early access A managed virtual SOC from FORTISYM

Bots on watch all night.
A person approves every action.

The FORTISYM Bot SOC watches your Microsoft 365 activity around the clock. Bots triage and investigate at machine speed, 3am included, and propose what to do. Nothing changes until a person says yes.

Book a demo See how it works
  • Starts with Microsoft 365
  • Hosted in the UK
  • Priced per device
Bot SOC · Microsoft 365 sign-ins 03:12 UKBots on watch
  1. Triage bot Sign-in from a new country for this user Grouped with related events into one case
  2. Investigator bot UK sign-in two hours earlier, unknown device Likely account takeover. Rated high
  3. Responder bot Proposes: sign out all sessions, reset password Waiting for a person to approve
  4. Approver Approved with one tap Logged: who proposed, who approved, when
  5. Reporter bot Written up for the team in the morning Evidence, decision and outcome in one place
Illustration with example data. Not a live customer case.

03:00 UK

Who handles it at 3am? The bots. They do the sorting, checking and writing up overnight, so nobody on your team needs to be on call. Anything that needs a decision waits for a person, with the evidence ready.

How it works

Bots do the triage. A person makes the call.

Four bots share the work, each with its own job. They can look, explain and propose. They can't change anything on their own.

  1. 1

    Triage

    Reads new security events as they arrive. Removes duplicates, groups related events into one case, scores how serious it is and closes known, harmless noise against an agreed allow-list.

  2. 2

    Investigate

    Builds a timeline: earlier sign-ins, countries, devices, new mailbox rules and app permissions. Weighs it against the person's normal pattern and says how confident it is, and why.

  3. 3

    Propose

    Drafts one to three response options. Each one says what happens, how to undo it and the risk of acting, so the decision is quick and informed.

  4. 4

    A person approves

    An approver chooses Approve or Reject, and confirms it's them with their Microsoft sign-in. Only then does anything happen. Every decision goes in the audit trail.

  5. 5

    Report

    A daily digest and a weekly report: what came in, what was closed as noise, what was decided and what's still waiting.

The bots never act on their own. Every proposed action waits for an approver in your organisation. If nobody decides, nothing changes.

What it watches

It starts with Microsoft 365

The Bot SOC connects to your Microsoft 365 audit data with read-only access and the narrowest permissions it needs. It doesn't ask for permission to read the content of your email.

Sources

  • Sign-ins and admin actions in Microsoft Entra ID
  • Exchange mailbox activity, including inbox and forwarding rules
  • SharePoint and OneDrive activity
  • Apps given permission to your data

The kind of thing it spots

  • HighSign-ins that can't both be real, such as London and abroad an hour apart
  • HighA new rule forwarding email outside the company
  • MediumAn unfamiliar app given access to read mail
  • MediumAn admin role added to an account
  • ExpectedA colleague who often works abroad, on the allow-list, so nobody is woken

Next on the roadmap: your laptops and servers, and connectors for security tools you already use. We'll confirm timings with early-access customers.

The customer portal

See what the bots did while you slept

Sign in with your Microsoft work account. Viewers see the overview, devices, alerts and audit trail. Approvers can also approve or reject proposed actions.

Example data · mock-up Portal overview for a fictional company, Harbourside Example Ltd: risk posture score, devices covered, alerts this week, and a 3am timeline showing the triage, investigator, responder and reporter bots handling one case.

The overview, including the "bot activity at 3am" timeline.

These screens are from a design mock-up. All names, devices, numbers and events are fictional example data.

How we run it

Managed by FORTISYM first, yours to run later

Now: early access

A managed service

FORTISYM runs the Bot SOC for you. We connect your Microsoft 365, tune out the noise with you and agree who in your organisation approves actions.

Later

Run it yourself

Once it has proven itself and has connectors for the tools you already use, your own team will be able to run it.

Where it lives

UK first, EU later

Hosted in the UK. An EU region follows for EU customers, with their data kept in that region. Each customer's data is kept separate from every other customer's.

Pricing

Priced per device

A simple monthly price for each device we protect, so the cost grows with you. We'll agree with you what counts as a device.

Monitor

The bots watch, triage, investigate and report. You get alerts and the portal.

Contact us

Monitor and Respond

Everything in Monitor, plus proposed actions that run once an approver says yes.

Contact us

Self-run Later

A licence for organisations that want to run the Bot SOC themselves.

Contact us

Plans and what's included may change during early access.

Questions

Straight answers

Will the bots ever change something without asking?

No. Today every action needs an approver to say yes, and the approval is logged with who, when and why. Any move towards more automatic responses would only happen with your agreement.

Is it available now?

The Bot SOC is in early access. We're running it on FORTISYM's own Microsoft 365 first and are happy to show you a demo. Book one and we'll talk you through where it's up to.

What access does it need to our Microsoft 365?

Read-only access to your audit data, which your Microsoft 365 administrator approves. It doesn't ask for permission to read email content or change settings.

Where is our data held?

In the UK. An EU region is planned for EU customers. Your data is kept separate from other customers' data.

See the Bot SOC handle a 3am alert

A short demo, using example data, from the first alert to the approved action and the morning write-up.

Book a demo

or email [email protected]