Choose signals someone can investigate.
More security notifications do not make a website safer if nobody knows which ones matter or who can act on them.
We start with the website, hosting, accounts, and tools already in use. Relevant signals may include access changes, suspicious login patterns, file changes, vulnerable components, or an alert from an existing security tool. The selection depends on the site and available evidence. Each signal needs a clear source, a severity rule, and someone authorized to investigate it.
An alert without context can waste time. The monitoring plan helps the recipient answer what changed, when it changed, which asset may be affected, and what information must be preserved before a response alters the system.
Separate monitoring from incident response.
Monitoring can surface a reason to investigate. It does not by itself prevent an attack, contain an incident, restore data, or make a legal determination. We define where the monitoring task ends and when an incident owner, hosting provider, security specialist, or other responsible professional takes over.
For example, a repeated suspicious login alert may call for account review and evidence preservation. A confirmed compromise calls for a broader response and recovery plan. Those are different states and often need different people.
What the monitoring covers
- An inventory of assets, accounts, and existing security signal sources.
- Selected alert rules with severity and authorized recipients.
- Triage steps for checking an alert and preserving relevant records.
- Escalation contacts and a handoff route for incidents.
- A review process for noisy signals, access changes, and monitoring gaps.
We need the relevant system and account context, current tools or logs, and the names of people authorized to receive and act on alerts. The exact coverage and response responsibilities belong in the service agreement.
Security Monitoring pricing and scope
Starter Website Care begins at $549 per month and includes security scans in a recurring plan. Growth and Premium add wider technical support, including malware removal in their stated scope. Your agreement defines what is monitored, alert and response ownership, access, reporting, and which remediation is covered. Incident cleanup, forensic investigation, vendor charges, and new security architecture need explicit terms when outside routine care.
Define the alert before it arrives.
Inventory the tools that already send security notices and who receives them today. We turn those signals into a clear monitoring and escalation route.
