Skip to content
Made in the UK

Managed Detection and Response

Our cyber insurer wants evidence of 24/7 monitoring. What counts?

By , Head of SOC and IR, CybaVerse. Last reviewed

Evidence of 24/7 monitoring usually means showing that a staffed service watches your systems around the clock and responds out of hours. Strong evidence includes the MDR contract or service description, a list of covered devices and accounts, records of out-of-hours alerts handled, and your escalation process. Always check the insurer's exact wording and questions.

This page is part of our managed detection and response guide.

Why do insurers ask about 24/7 monitoring?

Attacks often happen outside office hours, and the longer one runs unnoticed, the bigger the claim. Insurers ask about monitoring to judge how quickly an incident is likely to be spotted and contained. The NCSC's cyber insurance guidance encourages organisations to understand what policies require and to answer questions accurately.

Questions vary between insurers. Some ask whether you have endpoint detection and response; others ask specifically whether alerts are monitored around the clock by people. Answering a different question from the one asked can cause problems if you later make a claim.

What evidence is likely to count?

The strongest evidence shows people, coverage and action, not just software licences. The table below lists the evidence most organisations can gather, and what each item proves. Ask your broker which items the insurer wants, because requirements differ between insurers and policies and can change at each renewal.

EvidenceWhat it proves
MDR contract or service descriptionA service exists, with 24/7 cover in scope
Covered devices and accounts listHow much of the estate is watched
Out-of-hours incident or alert recordsMonitoring happens in practice
Escalation process and contactsSomeone acts on what is found
Incident response planThere is a plan for serious incidents

How should you gather the evidence, step by step?

The steps below suit most MSPs and their clients preparing for an insurance renewal. Start well before the renewal date, because collecting coverage records and agreeing wording with the client takes time. Keep the pack, as most insurers ask similar questions each year.

  1. Step 1: Read the exact question

    Note what the insurer asks: tool, people or response.

  2. Step 2: Confirm coverage

    List which devices, accounts and services the monitoring covers.

  3. Step 3: Gather the contract

    Collect the service description that states 24/7 monitoring.

  4. Step 4: Pull example records

    Export a few out-of-hours case records, with sensitive details removed.

  5. Step 5: Document escalation

    Include the escalation process and response plan.

  6. Step 6: Answer accurately

    Describe gaps honestly rather than overstating coverage.

What should you be careful about?

Be careful not to overstate coverage. If monitoring covers laptops but not servers, or Microsoft 365 but not on-premises systems, say so. An inaccurate answer may give the insurer grounds to question a claim later. Check every statement against your records before the client signs the proposal form.

  • Do not claim coverage for devices without an agent or connector
  • Do not describe automated tools as staffed monitoring
  • Check that out-of-hours escalation contacts are current
  • Keep a copy of exactly what was submitted

Where does CybaOps fit?

CybaOps is the CybaVerse MDR platform, delivered through MSPs, backed by our UK-based security operations centre. Our UK SOC monitors client environments around the clock, and incidents are worked as cases, so MSPs have records they can draw on when an insurer asks how monitoring works.

  • Our UK-based security operations centre monitors customer environments 24 hours a day, 7 days a week.
  • CybaVerse offers three MDR packages, CybaCore, CybaEdge and CybaOne, sold through MSPs and resellers.
  • Incidents are worked as cases in CybaOps, so every alert, action and note sits in one record your team can see.
  • CybaVerse is certified under the NCSC Cyber Incident Response (CIR) scheme at Standard Level.
  • CybaVerse is ISO 27001 certified.

Insurer evidence

What counts as evidence of 24/7 monitoring

Evidence of 24/7 monitoring usually means showing that a staffed service watches your systems around the clock and responds out of hours.

01 Your tools

Multi-tenantPartner / MSP CustomerCustomerCustomer+
CybaOps by CybaVerse

Insurer evidence

02 The 6-step path

  • Role-based access
  • UK-based analysts
  • ISO 27001

03 Outcomes

Explore

Hover or tap any part of the diagram to see what it does.

  • MDR in
  • CybaCore
  • CybaEdge
  • CybaOne

What else do MSPs ask about insurer evidence?

These are the follow-up questions we hear most around insurance renewals.

Is having EDR the same as 24/7 monitoring?

No. EDR is a tool that detects and records activity on devices. Twenty-four-hour monitoring means people are watching its alerts and acting on them out of hours. Answer the insurer's question about whichever one it actually asks.

Can we share real incident records with the insurer?

Share summaries with sensitive details removed, and only with the client's agreement. Most insurers want evidence that monitoring happens, not full technical logs or personal data.

Who should answer the insurer's questions?

The client signs the proposal, so the client is responsible for its accuracy. The MSP should supply the facts and check the technical answers, so nothing is overstated.

What should you do next?

See how the CybaVerse SOC monitors client environments on the CybaOps platform page. MSPs can read about the CybaVerse partner model for MSPs.

Related: What should happen in the first 60 minutes after a 2am MDR alert?, How should an MDR provider escalate critical incidents?, How can an MSP offer 24/7 MDR without building its own SOC? and Who fixes the issue after an MDR provider detects it?

See how out-of-hours cases are recorded.

Book a CybaOps demo