Managed Detection & Response (MDR) for Defence Tech and Critical Infrastructure

The Problem: Dwell Time Is the Attacker's Greatest Advantage

The 2023 IBM Cost of a Data Breach Report places the global mean time to identify a breach at 204 days — over six months of undetected access before the first alert fires. During that window, advanced threat actors conduct methodical reconnaissance, establish redundant persistence mechanisms, escalate privileges across the network, and stage data for exfiltration at their leisure. By the time a traditional SIEM finally surfaces an indicator, the attacker has already finished their mission.

For defence-technology companies and critical-infrastructure operators, the threat model is categorically more severe. Your adversaries are not opportunistic ransomware affiliates, but state-sponsored Advanced Persistent Threat groups with specific intelligence-collection objectives, substantial resources, and the operational patience to wait months before triggering any detectable activity. They operate inside detection thresholds by design, abusing legitimate administrative tools — a technique known as living off the land — to blend into the noise that a conventional rule-based SIEM will never surface.

Traditional security models — a SIEM fed by log forwarders, reviewed by a small team during business hours — were architected for a different era and a different adversary. They assume that prevention will occasionally fail, and that a well-tuned ruleset will catch the breach when it does. Nation-state actors defeat that assumption routinely. They study defensive tooling, test their tradecraft against commercial security products, and specifically time their most sensitive operations for evenings, weekends, and public holidays when analyst coverage is at its thinnest.

The result is a structural coverage gap that no amount of additional tooling — without dedicated human expertise and continuous operation — can close.

Our Approach: Human-Led Detection at Wartime Speed

AmonSul MDR is architecturally different from tool-led MDR services that automate alert triage and only escalate to a human when a signature fires. Our model begins with the human analyst and uses automation to multiply their effectiveness.

Every AmonSul MDR client is assigned a named analyst team: two primary analysts who know your environment and one escalation engineer on rotation. They write detection logic specific to the threat actors we know are targeting your sector, review VATRA threat-intelligence for new TTPs relevant to your asset profile, and hunt proactively for indicators of compromise that no existing rule would surface.

The technical stack sits underneath that human layer. We deploy or integrate with your EDR platform — CrowdStrike, SentinelOne, Microsoft Defender, or Sophos — and extend coverage across your network, cloud workloads, identity plane, and email. Every log source is normalised into our detection pipeline, enriched with VATRA threat context, and cross-correlated against our knowledge base of attacker behaviours observed in Ukrainian and EU defence-sector campaigns.

When an analyst identifies a true positive, they do not simply create a ticket and wait. They initiate automated containment actions — host isolation, credential revocation, hash blocking — within seconds of the detection decision, then brief your on-call contact with a clear situation report and recommended next steps. You receive a human-readable incident ticket, not a raw SIEM alert dump.

Monthly service reviews include detection coverage analysis, rule performance metrics, false-positive rates, and a forward-looking briefing on threat actors we are currently tracking that have your sector in their targeting criteria.

What You Receive

Every AmonSul MDR engagement includes a structured set of deliverables designed to give your security posture and your board continuous visibility.

At onboarding: a full asset and log-source inventory, a detection coverage map aligned to MITRE ATT&CK, a VATRA threat-actor profile for your sector, and a documented escalation and communication playbook agreed with your team.

During operations: 24/7 alert monitoring with sub-15-minute MTTD on high-severity events, a named analyst available for questions during business hours, an active incident channel for real-time communication during engagements, and continuous detection engineering to adapt rules as your environment and the threat landscape evolve.

Monthly: a written service review covering incidents handled, alert volumes, false-positive rates, detection coverage gaps identified, a VATRA threat landscape update for your sector, and any recommended configuration changes to improve your security posture.

On contract renewal: a year-in-review benchmarking your security metrics against your baseline, a revised threat-actor profile, and a prioritised recommendation list for your next twelve months.

Why AmonSul

Most MDR providers have never operated in a genuinely contested environment. They have built their detection logic against test data, against historical breach reports, against the tactics that threat actors used two or three years ago. When a client encounters a novel APT technique not yet catalogued in commercial threat-intel feeds, a conventional MDR team is operating blind.

AmonSul's analysts have defended against the specific nation-state actors that target defence tech and critical infrastructure — in real time, in active conflict. Our VATRA platform was built from intelligence gathered through operational engagement with Ukrainian military intelligence and the National Cyber Coordination Centre (NCCC), and it is updated continuously with TTPs, infrastructure indicators, and campaign data from ongoing operations in and around Ukraine.

That experience translates directly into detection quality. When a Sandworm technique appears in your environment that has never been documented in a public threat-intel feed, our analysts recognise it because they have seen it before. That is not a capability you can buy from a vendor that built their SOC in a peacetime environment.

---

Ready to see how AmonSul MDR would cover your environment? Book a 30-minute walkthrough — we will show you live detection coverage against your actual asset profile.