Keeps running day-to-day IT
Your IT team or provider
- Patching
- Help desk
- Devices
- Backups
How we work
AI Sorts The Noise.Experts Make The Call.
Inside the 24/7 operation that turns millions of events into the few that matter, and stops them.
- Analysts on watch
- 24/7
- Critical alert response
- 15 min
- To full protection
- 1 to 2 weeks
One day, one client
Sample dataEvents collected1,842,310
Correlated into cases412
Escalated to an analyst17
Confirmed and contained2
AI does the volumePeople make the calls
Certified partner of
Human-led. AI-powered.
AI Handles the Volume. People Make Every Decision
A typical small business generates hundreds of thousands to millions of security events a day. Nobody can read them. That is exactly the job AI is good at, and exactly where it should stop.
What AI does
- Collects telemetry from every connected source, day and night
- Groups related events and enriches them with threat intelligence
- Drops duplicates and known-benign noise
- Ranks what is left so analysts focus on what matters
What people decide
- Investigate every case that crosses a risk threshold
- Confirm or dismiss, and choose the response
- Approve every action, unless you pre-authorized that exact action
- Call your named contacts and explain what happened
The pipeline
From a Million Events to One Phone Call
Six stages turn raw telemetry into a decision. Machines do the first three at machine speed. A certified analyst owns the rest.
AI-assisted
Machine speed, around the clock
01AI-assisted
Collect
Telemetry from endpoints, Microsoft 365 and Google Workspace, firewalls, VPNs, cloud platforms and key SaaS apps flows into our security platform.
02AI-assisted
Correlate
Machine learning and detection rules group related events, enrich them with threat intelligence and drop the duplicates and known-benign noise.
03AI-assisted
Escalate
Anything that crosses a risk threshold becomes a case with context attached: the user, the device, what happened before and after.
Human-led
A certified analyst decides
04Human decision
Decide
A Cyberphore analyst investigates. They confirm or dismiss, and they choose the response. No automated system takes action on your business without a person approving it, unless you have pre-authorized that exact action.
05Human approved
Act
Containment follows your playbook: isolate a laptop, revoke sessions, reset credentials, purge an email, block an address. Then we call your named contact.
06Continuous
Learn
Every confirmed case feeds back into tuning and into your monthly report, with the fix that would have prevented it.
Response commitment: critical alerts are triaged and response begins within 15 minutes, 24/7/365. No automated system acts on your business unless a person approves it or you pre-authorized that exact action.
Inside an incident
Every Action Logged. Every Decision Explained
When something real happens, you get the full story: the process tree, the timeline, who decided what and when. That record is what your insurer, your lawyer and, if needed, the Privacy Commissioner will ask for.
- AI
- Correlates and escalates
- Analyst
- Confirms and approves
- Action
- Containment, logged with time
Product screens shown with sample data.
P1 · CRITICALContained in 1m 32s after analyst review
Macro-enabled invoice leads to loader execution on finance laptop
FIN-LT-014 · accounts payable · Windows 11 · owner: payables team
Process tree
- OUTLOOK.EXEuser opened attachment "Invoice_44817.docm"
- WINWORD.EXEmacro executed
- powershell.exe -nop -w hidden -enc SQBFAFgA…T1059.001
- rundll32.exe C:\Users\Public\upd.dll,StartT1218.011
- outbound 443 → 91.215.x.x (newly registered)C2 beacon
Host
Isolated
Identity
Sessions revoked
6 purged
Timeline
- 09:41:52EDR
Behavioural detection on FIN-LT-014: Office spawning encoded PowerShell.
- 09:41:58AI
Correlated with phishing email delivered 09:37 to 6 recipients. Similarity to known loader: high. Escalated as P1.
- 09:43:10Analyst
Confirmed malicious. Process tree and network beacon reviewed. Approved containment per playbook IR-03.
- 09:43:24Action
Host isolated. User sessions revoked. Hash and domain blocked tenant-wide. Email purged from 6 mailboxes.
- 09:51:05Analyst
Client contact notified by phone. No lateral movement found. Evidence package preserved.
Events analyzed (24h)
1.84M
+6.2%
Escalated to analysts
17
0.0009% of events
Median time to contain
11m 40s
−2m vs 30d
Protected assets
412
398 healthy
Alerts by severity, 14 days
LowMediumHighCritical
Alert queue
Auto-refresh · Pacific Time
| Time | Sev | Detection | Status | Owner |
|---|---|---|---|---|
| 09:42:17 | CRIT | Credential dumping via LSASS access | Contained | AK |
| 09:38:02 | HIGH | Impossible travel: Toronto → Lagos in 22 min | Investigating | JR |
| 09:21:55 | HIGH | New inbox rule forwards to external address | Investigating | JR |
| 08:57:40 | MED | Encoded PowerShell from Office child process | Triaged by AI | AI |
Onboarding
Protected in Weeks, Not Quarters
Most small and mid-sized businesses are fully onboarded in 1 to 2 weeks. Larger environments take longer. Tuning continues after that, so the alerts that reach an analyst are worth their time.
Week 1
Kickoff and Scoping
We map your environment, agree escalation contacts and write the response playbook with you: what we can do without calling, and what always needs a call first.
Week 2
Deploy and Connect
Endpoint agents roll out through your existing tools. We connect Microsoft 365 or Google Workspace, firewalls and cloud accounts.
Weeks 3 to 4
Baseline and Tune
We learn what normal looks like for your business and tune detections so the alerts that reach an analyst are worth their time.
Ongoing
Operate and Improve
24/7 monitoring and response, monthly reports, quarterly reviews with leadership.
Your Response Playbook
Written with you in week 1. For each containment action, you decide whether we act at once or call you first.
- Isolate a laptop
- Revoke sessions
- Reset credentials
- Purge an email
- Block an address
Example of a pre-authorized action: isolating a laptop that is actively encrypting files.
What Gets Installed
- Usually a lightweight endpoint agent
- A few API connections to services you already use, such as Microsoft 365
- Already own a capable EDR product? We can often work with it rather than replace it.
Your IT team and us
We Work Alongside Your IT Provider, Not Instead of It
There is no need to replace your internal IT team or managed IT provider. During onboarding we agree who does what during an incident, so nobody is guessing when something happens on a weekend.
Written down before you go live
Agreed together at onboarding
- Who does what during an incident
- Escalation contacts, in the order you choose
- The response playbook: act now or call first
- Agent rollout through your existing tools
Watches for attacks and responds
Cyberphore
- 24/7 monitoring and investigation
- Response decisions and containment under your playbook
- Detection tuning
- Monthly reports and quarterly reviews
See how this works in practice in Managed Detection and Response.
Reporting
One Page Your Leadership Team Will Actually Read
Every month, in plain language. Quarterly, we walk through it together with leadership.
Every monthly report covers
- Your posture grade and trend
- What we stopped
- Anything that became an incident
- The three changes that would reduce your risk the most
Learning loop: every confirmed case feeds back into tuning and into your monthly report, with the fix that would have prevented it.
Monthly Security Report
October 2026 · Prepared for the leadership team
Security posture
B+
Up from B− in March
MarMayJulSep
Threats stopped
23
Incidents
1 (contained)
Phish report rate
64%
What happened
A phishing email with a macro-enabled invoice reached six staff. One device ran the attachment; we isolated it within two minutes of analyst confirmation. No data left the network.
Top three actions for next month
- 1Block Office macros from internet files across the tenant (1 hour, IT provider)
- 2Replace SMS codes with phishing-resistant MFA for finance and executives
- 3Run the ransomware tabletop exercise booked for November 19
Data handling
Your Monitoring Data Stays in Canada
Data residency matters under Canadian privacy law and to many insurers and customers. Client monitoring data is stored in Canadian data centres by default. Other regions are used only if a client asks.
Read our privacy policy- Default storage location: Canadian data centres
- Canada
- Default storage location: Canadian data centres
- Monitoring data kept searchable
- 90 days
- Monitoring data kept searchable
- Monitoring data kept in archive
- 1 year
- Monitoring data kept in archive
A Record You Can Hand Over
Every action is logged with who decided it and when. If an incident becomes a privacy breach, that record is what your insurer, your lawyer and the Privacy Commissioner will ask for.
FAQ
How the Operation Runs
Is the AI making decisions about our systems?
No. AI ranks and groups activity so analysts can focus. Response actions are approved by a Cyberphore analyst, or are actions you have explicitly pre-authorized in your playbook, such as isolating a laptop that is actively encrypting files.
What happens at 3 a.m. on a holiday?
The same thing that happens at 3 p.m. on a Tuesday. Analysts are on shift around the clock, every day of the year. If an incident needs your involvement, we call the contacts in your escalation list in the order you chose.
Do we need to install anything?
Usually a lightweight endpoint agent and a few API connections to services you already use, such as Microsoft 365. Where you already own a capable EDR product, we can often work with it rather than replace it.
Where is our data stored?
Data residency matters under Canadian privacy law and to many insurers and customers. Client monitoring data is stored in Canadian data centres by default; other regions are used only if a client asks.
Get started
See How This Model Would Run in Your Environment
A free assessment call with a certified specialist. We map what you have, tell you plainly what is worth doing first, and give you a written quote in CAD if there is work worth doing.
- 1Free scoping callDay 1We learn how your business runs and where the gaps are.
- 2Onboarding1 to 2 weeks for most clientsPlaybook and escalation contacts agreed, agents deployed, services connected.
- 3LiveOngoingAnalysts on watch 24/7/365, with monthly reports and quarterly reviews.