Frequently Asked Questions

Straight answers about our services, programs, and how we work with your team.
What does TwoDefend do as an MSSP?
We provide managed security services: SOC monitoring, SIEM configuration and tuning, endpoint protection, email and identity security, security awareness training, phishing simulations, and hardening projects. You choose Essential, Professional, or Premium, or mix services à la carte after discovery.
What is the difference between Essential, Professional, and Premium?
Essential focuses on visibility and business-hours support when you are building foundations. Professional adds 24/7 SOC, EDR, training, and an annual phishing campaign (most clients start here). Premium adds threat hunting, advanced simulations, hands-on hardening, and priority SLAs for higher-risk or regulated environments.
Do you run phishing simulations and train our staff?
Yes. Professional includes an annual phishing simulation and security awareness training. Premium adds advanced campaigns, role-based modules, and executive reporting. We coach repeat clickers. The goal is fewer incidents, not embarrassing employees.
Which SIEM platforms do you support?
We are vendor-neutral: Splunk, Microsoft Sentinel, Elastic, open-source stacks, and others. We design ingestion, parsing, detection rules, and dashboards for the platform you use or plan to adopt.
How quickly can onboarding start?
Most customers begin with a discovery workshop, then phased rollout of log sources, endpoint agents, and training. Timelines depend on your change windows; we prioritize early visibility and quick wins in the SOC queue.
What happens during a security incident?
Analysts triage alerts, validate malicious activity, recommend containment, and coordinate with your IT team. On supported platforms we execute pre-approved response actions from playbooks you sign off on in advance.
Is pricing fixed or custom?
Every program is quoted after discovery based on assets, log volume, coverage hours, and optional modules. The pricing page shows what each tier includes; your proposal reflects your real environment.
Do you replace our internal IT team?
No. We augment your team with specialized security operations. You keep business context and final say on production changes; we bring monitoring, engineering, and response depth.
Can you help with compliance (HIPAA, SOC 2, PCI, etc.)?
Yes. We map logging, training, and control evidence to frameworks you already answer to, without slowing down incident response.
How do we get started?
Use the contact form or book a discovery call from the pricing page. Tell us team size, cloud stack, and your biggest worry (ransomware, phishing, audits). We will recommend a tier and send a clear proposal.

Still have questions?

We are happy to walk through Essential, Professional, or Premium on a short call, no obligation.