Managed security services put an accountable team in charge of detecting, investigating and containing threats across your identities, devices, email and cloud. Arke Technologies, in Johannesburg, delivers managed detection and response (MDR) for organisations across South Africa on Microsoft Sentinel and Defender, with continuous automated monitoring, SLA-bound human response and monthly reporting.
Managed security services are security operations delivered by an outside team under contract: monitoring, detection, investigation, response, vulnerability management and reporting. A managed security service provider (MSSP) runs the tools and the process, so you gain a security operations capability without building one.
In one line, a managed security service provider is the company accountable for watching your environment for attacks and acting when it finds one. The definition has widened. Older MSSPs mostly managed firewalls and forwarded alerts; managed detection and response goes further, investigating each alert, containing confirmed threats and explaining what happened.
MSP and MSSP, compared: a managed service provider (MSP) keeps IT running, and an MSSP keeps it secure. We deliver managed IT services and managed security under one contract, so IT operations and IT security answer to one accountable team, within our wider cybersecurity services.
Security information and event management (also written security event and information management, or security incident and event management) collects logs from identities, devices, firewalls, email and cloud services, correlates them and raises an incident when a pattern looks like an attack. An untuned security information and event management system produces noise, not detection.
Endpoint detection and response watches process behaviour on every laptop and server, blocks known malware and can isolate a device once an attack is confirmed. Paired with web and email filtering, EDR covers the routes most attacks use.
A security operations centre, or security ops centre (SOC), is the team and process that run the SIEM and EDR: triage, investigation, response and reporting. SOC services are increasingly bought rather than built, and "SOC as a service" and MDR now describe much the same thing.
A network operations centre watches availability; a SOC watches for attackers, and "SOC network" searches often mix the two. Our managed service covers both: security detection here, and availability through network monitoring.
Known-bad addresses, domains, file hashes and attacker techniques. Microsoft's threat intelligence flows into Sentinel and Defender, and we map detections to MITRE ATT&CK so each alert names the technique it caught.
Cybersecurity threat management ties these together, so every real alert reaches a person who can act.
Microsoft Sentinel, formerly Azure Sentinel and often called MS Sentinel, is Microsoft's cloud-native SIEM with built-in automation, running in Azure. For Microsoft 365 organisations, Microsoft Defender and Sentinel together are a practical start, because many already license much of Defender: it protects endpoints, email, identities and cloud apps, and Sentinel correlates its alerts with everything else. Microsoft Sentinel SIEM is the natural Azure SIEM for most Microsoft estates.
Sentinel also takes logs from firewalls, Linux and Windows servers, Google Workspace and AWS, so one Microsoft SIEM can cover a mixed estate. We connect AWS CloudTrail and other AWS logs to the same workspace, so an AWS-heavy estate gets the same SOC view as a Microsoft one.
Our team has deployed Microsoft Sentinel as the SIEM for several client organisations in South Africa, alongside Microsoft 365 hardening and Entra ID governance; see managed security operations. Sentinel MDR from Arke means we build and tune the analytics rules and playbooks, and respond to what they find. The workspace can be created in a Microsoft Azure region in South Africa, inside your own tenant, so your logs are stored in the country and remain yours.
Microsoft Sentinel pricing, like Azure Sentinel pricing before the rename, depends on how much data you ingest and how long you keep it, billed by Microsoft to your Azure subscription. The drivers:
We forecast the Sentinel bill before you commit and report actual consumption every month.
Lists of top MSSP companies and MSSP providers are easy to find. Analyst research from Gartner, such as its Magic Quadrant and Market Guide reports, profiles large international MDR and managed security services providers. Then test any shortlist, us included:
Whatever a provider calls its offer, these questions separate a cyber MSSP that responds from one that only forwards alerts.
We price managed security services after an assessment, billed monthly in advance under your SLA. Microsoft licences and Sentinel consumption are billed separately and shown as they are. The drivers are users and devices, log sources and volumes, hours of cover, the scope of containment and log retention.
For context, published South African managed IT rates run from about R180 to R400 per user per month (matnet.co.za, September 2026). Managed security is scoped separately, and it is the fastest-growing segment of South African IT services, forecast to grow at 14.2% a year (Mordor Intelligence).
Last reviewed: September 2026.
