What 24/7 Monitoring Actually Means When a Security Provider Says It

The difference matters more now that many serious attacks never touch a laptop. Microsoft's threat intelligence team recently published guidance on AI-assisted executive impersonation and invoice fraud. It is a good reminder that some of the most damaging incidents a small business faces play out in email and sign-in activity, not on a device where traditional antivirus is looking.

Real monitoring has three parts, and a provider should be able to explain each one in plain terms. The first is collection. Your systems produce records of activity: device events, sign-ins, mailbox changes, firewall traffic, administrative actions. Those records have to be sent somewhere they can be examined. If a system is not connected, it is not monitored, no matter what the brochure says.

The second part is analysis. Someone or something has to decide which of thousands of daily events actually matter. Automated detection rules and security tools do much of the first pass, and they do it well. Anything they flag still needs a person with context to decide whether it is a real attack, a false alarm, or your office manager signing in from a hotel.

The third part is response. This is where many 24/7 claims quietly fall apart. Detecting a compromised account at 2 a.m. does little good if the only action available is to email you and wait. NIST's current incident response guidance treats detection and response as connected parts of managing cyber risk, not separate events, and that is the right way to judge a service. Watching without acting is just record keeping.

There is nothing wrong with automation. It sorts noise faster than any person can, and good providers lean on it heavily. The question is what happens after the automation raises its hand. Some providers have analysts working overnight shifts. Some use a follow-the-sun model with teams in different time zones. Some have an on-call engineer who gets paged. Some subcontract the overnight work to a larger operations center. Any of these can work, as long as you know which one you have and the contract matches it.

Authority matters as much as staffing. The useful overnight actions are things like disabling a compromised account, ending its active sessions, isolating an infected device from the network, or blocking a malicious sender. If those actions are agreed in advance, an analyst can take them in minutes. If every action needs your approval and nobody can reach you, the alert waits for morning, and so does the attacker's head start.

This is not an idle concern. CISA and the FBI have publicly warned that ransomware actors deliberately time attacks for holidays and weekends, when offices are empty and response is slow. Coverage that is strongest on Tuesday afternoon and weakest on a long weekend is upside down.

Even excellent monitoring depends on you for a few things. The provider needs a current contact list with people who will answer the phone at night, and a clear agreement on who inside your organization can authorize drastic steps like taking a server offline. They need to hear about new systems, new cloud services, and staff departures, because an account that should have been closed is an easy door for an attacker.

Monitoring also has limits that only your own processes can cover. If a fraudster sends a well-written payment request from a lookalike domain, and an employee who has no reason to doubt it pays the invoice, there may be nothing on your systems for a provider to catch. The best defense there is a simple internal rule: any change to payment details gets verified by phone using a number already on file, never one in the email. The FBI's guidance on business email compromise makes the same point.

Your regulatory obligations sit on top of all of this. Defense contractors handling covered defense information must report cyber incidents to the Department of Defense within 72 hours of discovery under DFARS 252.204-7012, which makes how quickly you discover a problem a compliance issue, not just a technical one. Dental practices must have audit controls that record and examine activity in systems holding electronic patient information under the HIPAA Security Rule. Accounting and tax firms covered by the FTC Safeguards Rule must either monitor their systems continuously or run periodic penetration testing and vulnerability assessments. Defense contractors working toward CMMC will see similar questions about logging and incident handling, but that is a subject for another day. In every case, a monitoring service helps you meet the obligation. It does not move the obligation off your desk.