Skip to content
Made in the UK

Managed Detection and Response

What should happen in the first 60 minutes after an MDR alert fires at 2am?

By , Head of SOC and IR, CybaVerse. Last reviewed

In the first 60 minutes after a 2am MDR alert, an analyst should confirm whether it is real, work out which users and devices are involved, take any containment the client has pre-approved, escalate anything else to a named contact, and record every step so the MSP can pick it up at the start of the working day.

This page is part of our managed detection and response guide.

Why do the first 60 minutes matter so much?

Attackers often choose nights, weekends and bank holidays because fewer people are watching. Every hour an attacker goes unnoticed gives them more time to steal credentials, move to other systems or prepare ransomware. The CISA ransomware guide stresses fast identification and isolation of affected systems to limit how far an attack spreads.

For an MSP, a 2am alert is also a test of the agreements made weeks earlier. If nobody agreed what the SOC may do without a call, or the escalation list has gaps at night, the first hour is spent waiting rather than responding. That is a process problem, not a tooling problem.

What should happen, step by step?

The steps below describe a good first hour for an MDR-handled alert out of hours. They follow the detection, analysis and containment stages in NIST incident response guidance. Use them to test your own provider, or to write the runbook your MSP team and SOC partner agree for each client.

  1. Step 1: Confirm the alert is real

    The analyst checks the evidence, related activity and whether the behaviour is normal for that client.

  2. Step 2: Scope the incident

    Identify which accounts, devices and services are involved, and whether activity is still happening.

  3. Step 3: Decide on containment

    Apply only the actions the client has pre-approved, such as disabling a compromised account. Anything else needs a decision.

  4. Step 4: Escalate to the right person

    For a critical incident, phone the first available contact on the escalation list, then work down it.

  5. Step 5: Record everything

    Write each finding, action and call attempt to the case, with times.

  6. Step 6: Prepare the morning handover

    Summarise what happened, what was done and what the MSP needs to do next, such as recovery or user communication.

What should the MSP agree before any alert fires?

The first hour only works if the MSP and its SOC partner have agreed the rules in advance for every client. Write them down during onboarding and review them at least twice a year, because staff, systems and risk appetite change over time and old contact lists quietly go stale.

AgreementWhy it matters at 2am
Pre-approved actionsThe SOC can act without waking anyone
Escalation contacts for every hourDecisions are not stuck waiting for office hours
List of critical systemsServers are not cut off without a conversation
Client communication ownerThe client hears one consistent voice
Recovery ownerSomeone is ready to rebuild or restore in the morning

We hear from MSPs that the most common gap is the escalation list: it covers office hours well and nights or weekends badly. Test it with a call at an awkward hour before you rely on it.

Where does CybaOps fit at 2am?

CybaOps is the CybaVerse MDR platform. A human analyst watches CybaCore alerts 24/7, so an alert at 2am is looked at by a person straight away rather than waiting in a queue until the morning.

  • CybaCore is our AI-enabled MDR package, with 24/7 UK cyber operators, continuous monitoring, identity threat detection and response, and a monthly allowance of incident response.
  • CybaEdge adds unlimited incident response, threat hunting and premium identity threat detection and response, delivered by our UK SOC.
  • Incidents are worked as cases in CybaOps, so every alert, action and note sits in one record your team can see.
  • Our SOC hunts for new threats across customer environments and alerts customers when a new attack affects tools they use.
  • Pre-approved response actions are agreed with the MSP for each client during onboarding.

Out-of-hours response

The first 60 minutes after a 2am alert

A human analyst watches CybaCore alerts 24/7, confirms and scopes the alert, takes only pre-approved containment, escalates the rest and records it all for the morning.

01 The alert

Multi-tenantPartner / MSP CustomerCustomerCustomer+
CybaOps by CybaVerse

Out-of-hours response

02 The 6-step path

  • Role-based access
  • UK-based analysts
  • ISO 27001

03 Outcomes

Explore

Hover or tap any part of the diagram to see what it does.

  • MDR in
  • CybaCore
  • CybaEdge
  • CybaOne

What else do MSPs ask about out-of-hours alerts?

These are the follow-up questions MSP owners and service managers ask most about what happens overnight.

Should the SOC call us for every alert at night?

No. Calls should be reserved for confirmed incidents that need a decision you have not already made. Low-risk findings can wait for the morning summary. Agree the threshold with your SOC partner so nobody is woken unnecessarily.

What if nobody on the escalation list answers?

Then only the actions you pre-approved can be taken, and the rest waits. That is why complete escalation cover, including weekends and bank holidays, matters as much as the list of approved actions.

Who tells the client what happened?

In an MSP-delivered model, usually the MSP. The SOC escalates to the MSP and supplies the facts; the MSP speaks to the client. Agree this in writing so the client hears one clear account of events.

How do we know the first hour went well?

Review the case record the next day. Check when the alert was confirmed, what was done, who was contacted and whether anything waited for a decision that could have been agreed in advance.

See how an out-of-hours incident is worked and handed over.

Book a CybaOps demo