SOC
Threat detection and incident handling. Connect alerts with organisational context, assess impact and follow the agreed response process.
Outcome: an assessed incident, a case owner and documented actions.
CYBERSECURITY AS A SERVICE · SOC + NOC
DATPOL Shield
Continuous protection
for your organisation.
Monitoring, threat detection, response and penetration testing in one protection plan. Cover the agreed IT and OT network, from computers and servers to VPN infrastructure, routers, switches and technical systems.
Automated monitoring runs 24/7. Incident handling and response times follow the contract and agreed SLA.
EXAMPLE DATA · DEMONSTRATION
Unauthorised sign-in attemptIncident under review
10:24Suspicious address blockedExample of an agreed rule
10:22New network device detectedAdministrator review required
10:18
Security monitoring
automated, 24/7
automated, 24/7
Cyber threat
detection
detection
Network pentests
initial and recurring
initial and recurring
Network and
server protection
server protection
Security
reports
reports
Response using
agreed rules
agreed rules
DATPOL expert
support
support
A SHARED PROTECTION FOUNDATION
Four capabilities.
One agreed plan.
A cyberattack and an outage can look alike. SOC and NOC share context; SIEM organises evidence and XDR/MDR extends detection and handling. Choose coverage around the environment rather than an arbitrary collection of tools.
NOC
Infrastructure availability and health: routers, firewalls, switches, Wi-Fi, Windows/Linux, NAS, backups, UPS, environmental measurements and WAN, VPN and LTE links.
Outcome: a fault alert with dependency context and an escalation path.
SIEM
Centralised logs from agreed sources, normalisation and event correlation. Monitor data quality, clock synchronisation and interruptions to ingestion too.
Outcome: a consistent event history supporting investigations and reports.
XDR / MDR
Extended detection and managed handling of signals from computers, servers, identities and email. Coverage depends on the service option, licences and verified integrations.
Outcome: connected signals and response within the authorised mandate.
Combine these layers or start with a defined scope. Integrations, licences, retention and operational coverage are recorded in the quotation and contract.
BUSINESS
Protect business operations.
Beyond the computers.
Offices, manufacturing, branches and remote work. The shared foundation covers the agreed network, identities and critical services, prioritised by their business impact.
Discuss business protectionLOCAL GOVERNMENT / INSTITUTIONS / LCPD
The same attention.
An additional formal layer.
Public bodies also need institutional accountability, service governance, documentation and procurement support. Explore Polish KSC/NIS2, KRI, GDPR, CSIRT and shared-services coverage.
Explore Shield for local governmentRegulated businesses may also face extensive obligations. Assess the actual organisation: a public-body label or sector name alone does not establish the applicable duties.
VISIBILITY. CONTEXT. ACTION.
Technology, people
and clear responsibility.
Combine technical monitoring with analysis and an agreed response process. Support your IT team, establish priorities and document actions.
See meaningful events
We organise logs and signals from agreed systems, connecting recurring alerts with their context.
Respond with a plan
We agree permissions, contacts and permitted actions. Automated blocking covers approved scenarios only.
Get practical priorities
Clear reports identify risks, completed actions and recommendations for the next stage of protection.
DATPOL SHIELD
The whole environment.
Scope confirmed before launch.
We protect entire IT and OT networks: computers, servers, VPN servers, routers, switches and other network-connected devices. Every device within the agreed scope is inventoried and monitored according to its role and available integrations.
Initial and recurring penetration tests
Networks and remote access
Routers, switches, firewalls, Wi-Fi and VPN servers. Oversight of traffic, remote access, segmentation and configuration changes.
Servers and computers
System events, material changes and the security state of covered systems.
Identity and email
Unusual sign-ins, permissions and phishing-related signals through available integrations.
IT, OT and IoT
Controllers, HMIs, automation, IoT devices, cameras, recorders and other network equipment. Monitoring respects process continuity; methods and actions are agreed for each installation.
Data and backups
Signals about agreed jobs and service availability. Recovery tests are scoped separately.
Reports and requirements
Evidence supporting risk management and work towards NIS2 and ISO/IEC 27001. The service is not certification.
PENETRATION TESTING WITHIN THE SERVICE
Test the whole network.
At the start and regularly.
DATPOL Shield includes a penetration test of the entire network covered by the service during the initial audit. Throughout the engagement, we repeat testing to an agreed schedule to identify new weaknesses and assess the effectiveness of security controls.
Whole-network coverage
Routers, switches, Wi-Fi, VPN, servers, computers, web services, cameras and IoT devices. We agree all sites, subnets and available testing perspectives: internal and internet-facing.
Discovery and validation
We assess vulnerabilities, outdated software, configuration errors, segmentation, encryption and access controls. Automated scanning is combined with manual validation and controlled confirmation of exploitability.
A report that guides remediation
You receive findings, evidence, risk priorities and practical recommendations. We identify what to update, reconfigure or replace, including devices whose manufacturer support has ended.
Fixes and follow-up testing
After remediation, we verify fixes within the agreed scope. Recurring penetration tests help uncover new risks following changes to devices, services and configuration.
Before testing, we agree authorisation, the complete network scope, schedule and exclusions. Methods for OT, alarm systems and medical devices are specific to each installation. Potentially disruptive tests require separate agreement. Testing and retesting frequency is defined in the contract.
PRACTICAL DELIVERABLES
Know what is covered.
See what needs to improve.
From discovery to ongoing operations: a clear scope, tested rules, documentation and priorities. Work alongside your IT team and application suppliers.
An environment and coverage map
An asset inventory, service owners, event sources and explicit visibility gaps. New devices prompt a scope review rather than disappearing between suppliers.
Penetration testing and remediation
Initial and recurring testing of the agreed network. Evidence, risk priorities, recommendations and retesting, with end-of-life equipment identified for replacement decisions.
Reports for IT and management
Summarise incidents, monitoring gaps and completed actions. Technical detail for administrators, with decisions, priorities and investment needs for management.
Responsibility and escalation
System owners, primary and deputy contacts, permitted actions and execution checks. Establish who takes ownership and what needs approval before an incident.
THE DATPOL SHIELD PROTECTION CYCLE
Protection evolves
with your organisation.
A penetration test establishes a baseline. Monitoring supplies current context. Follow-up tests check whether fixes worked and changes introduced new attack paths.
-
01
Audit
Inventory, risk assessment and an agreed-network penetration test.
-
02
Deployment
Integrations, permissions, tests and operational acceptance.
-
03
Monitoring
Automated 24/7 monitoring and source quality checks.
-
04
Detection
Signal correlation and organisational impact assessment.
-
05
Response
Escalation and actions within the agreed mandate.
-
06
Reporting
Timeline, evidence, completed actions and recommendations.
-
07
Improvement
Remediation, retesting, EOL review and new scenarios.
Testing frequency, methods, retesting and exclusions are agreed in the contract. OT and critical services need testing adapted to safe operating conditions.
START / BUSINESS / ENTERPRISE
Protection tailored
to your organisation.
Choose a starting point for discussion. Final coverage, licences, log volume, retention, penetration testing and operational terms are confirmed in an individual quotation.
Shield Start
Monitoring and notifications
For small businesses and offices
from 868.55 PLNnet / month
- Security event monitoring
- Basic threat analysis
- Incident notifications
- Basic NOC availability monitoring
- Network penetration test during the initial audit
- Recurring network penetration tests to an agreed schedule
- Vulnerability report and remediation recommendations
- Monthly report
- Reports through an agreed channel
Recommended coverage
Shield Business
Extended protection and response
For businesses and institutions
from 1,593.55 PLNnet / month
- Everything in Start
- Advanced SIEM event correlation
- Network security monitoring
- IDS/IPS integration to the agreed design
- Approved automated blocking
- Incident handling under the SLA
- Extended reports and expert support
Shield Enterprise
Individually scoped protection
For public bodies and multiple sites
Individual quotation
- Everything in Business
- Extended IT / OT / IoT monitoring
- Multi-site integration
- Dedicated detection scenarios
- Individual rules and SLA
- Regulatory documentation support — individually scoped
- Technical account manager if contracted
Starting prices exclude VAT, applied as appropriate. Initial and recurring penetration tests form part of the agreed service, with defined scope, methods and schedule. Extended licences, long-term archiving, public-sector documentation and bespoke SLAs require a quotation and are not automatically included by the calculator.
PLAN YOUR BUDGET
What might protecting
your network cost?
Enter the devices you want covered. See an indicative subscription, its calculation and an inventory to include in your enquiry.
Rates and calculation method
We use the higher of the plan minimum or the sum of device charges. The minimum is not added again and is not a device allowance. All rates below: PLN net per device per month.
| Category | Start | Business |
|---|---|---|
| Physical servers / VMs | 217.50 | 326.25 |
| Computers and laptops | 50.75 | 87.00 |
| Routers, firewalls and VPN gateways | 87.00 | 130.50 |
| Network switches | 50.75 | 72.50 |
| Other IT / IoT devices | 29.00 | 43.50 |
| OT / automation devices | 108.75 | 159.50 |
Start minimum: PLN 868.55 net/month; Business: PLN 1,593.55 net/month. Enterprise: individual quotation. Do not count the same device in two categories, such as a VPN server again as a separate router.
This is an initial budget estimate, not a binding quotation. Rates use a market-informed model with different weights for device categories. The final cost depends on integrations, sites, log volumes, penetration testing scope and the agreed SLA. OT, unusual devices and critical installations require individual confirmation of methods and pricing.
DATPOL SHIELD
Different organisations.
A shared need for control.
Accountancy practices
Financial data, system access and phishing. Sign-in visibility and information protection priorities.
Small and medium businesses
Distributed accounts, laptops and services. One agreed protection scope and practical recommendations.
Schools and education
Several user groups and devices. Monitoring of meaningful events and access.
Local authorities
Public services and institutional data. Risk reporting and agreed escalation paths.
Manufacturing
IT/OT dependencies and process continuity. Monitoring tailored to the installation and its constraints.
Multi-site businesses
Branches, links and suppliers. A shared view of events from agreed locations.
CLEAR SERVICE TERMS
Agree the terms.
Then measure the service.
Trust comes from explicit scope and verifiable outcomes. Environment-specific parameters are confirmed in the quotation and at acceptance.
What runs automatically 24/7?
Event ingestion, agreed availability checks and detection rules. Missing data is monitored too. Automated monitoring does not by itself mean round-the-clock analyst staffing.
When does a specialist respond?
Agree coverage hours, on-call arrangements, contact channels and deputies before launch. The SLA distinguishes receipt, analysis, notification, action and service restoration.
What may be blocked without calling the client?
Only pre-approved scenarios and resources with an explicit mandate. Critical-system isolation, network changes and OT intervention follow agreed exceptions and approvals.
Where are logs stored and who can see them?
Choose on-premises, hybrid or external processing to match requirements. Record locations, subcontractors, retention, access and export in the contract rather than assuming one location for every client.
How do you receive reports and evidence?
Through an agreed secure channel, with named recipients and a reporting schedule. The panel below is a demonstration; report delivery does not depend on a portal that has not launched.
Who is responsible for the environment?
DATPOL delivers the agreed operational scope. The client retains system ownership and risk decisions; administrators and application suppliers have tasks defined in the responsibility matrix.
SEE HOW SIGNALS BECOME CONTEXT
Less noise.
A clearer picture.
Explore the demonstration views for example incidents, devices and reports. This is a client portal concept, not a production SOC or customer data.
FAQ
Good questions.
Clear answers.
Do you only cover computers?
No. Shield covers entire IT and OT networks within the agreed scope: servers, VPN infrastructure, routers, switches, Wi-Fi, IoT and other devices. After inventory, we select event sources and monitoring methods. Control actions, blocking and active tests depend on available integrations and agreed authority.
Is the calculator result a final price?
It is an indicative budget in PLN excluding VAT. The result uses device counts and transparent rates. The final quotation follows a review of infrastructure, integrations, penetration testing scope and SLA. OT and Enterprise require individual agreement.
Are penetration tests included in Shield?
Yes. We test the entire network covered by the service during the initial audit and then on a recurring basis. Scope, methods, schedule and retesting are agreed in the contract. Findings include priorities, evidence and remediation recommendations.
Does Shield guarantee there will be no incidents?
No. It helps detect threats, reduce risk and organise response. No security measure eliminates every threat.
What does 24/7 monitoring mean?
Automated event collection and detection rules run continuously. Specialist availability, escalation and response times are defined in the contract and SLA.
Will I need to replace existing infrastructure?
Not necessarily. We review integrations, device support and data quality, identifying where configuration is sufficient and where modernisation is needed.
Can you block threats automatically?
Yes, within pre-approved scenarios and available integrations. Permissions, exclusions and rollback procedures are agreed before commissioning.
Can the service cover OT?
Enterprise can cover agreed IT/OT/IoT systems. Methods are installation-specific; actions affecting a process require separate authorisation and acceptance.
Does it ensure NIS2 or ISO 27001 compliance?
Shield can supply evidence and reports supporting risk management. Organisational obligations require a separate assessment. The service is neither certification nor a compliance guarantee; Polish regulatory scope does not imply UK compliance.
Is the client portal already available?
This page provides a labelled demonstration. The production client portal is planned for future integration. We do not provide a fictional login.
How do SOC and NOC differ?
SOC investigates threats and handles security incidents. NOC monitors infrastructure availability and health. Shared context helps distinguish a fault from an attack and coordinate response.
What additional coverage is available for local government?
The shared foundation can include agreed support for documentation, responsibilities, log retention, CSIRT cooperation and procurement acceptance. Scope depends on the body’s status and requirements; the dedicated offer explains it in more detail.
Can I request 24-month log retention?
We design and price options of 24 months or longer, confirming sources, volume, capacity, searchable retention, archiving and exports. This is not every plan’s default parameter.
Are CSIRT notifications submitted automatically?
No automatic submission is promised. Prepare agreed technical material, a timeline and evidence, and support an authorised person. Recipients, deadlines and mandate require assessment of the actual situation.
START WITH YOUR ENVIRONMENT
Let’s start with
your organisation.
You do not need a finished specification. Tell us your approximate scale, sites and key services. We will identify a starting point, integrations and information needed for a quotation. Do not send passwords, keys or confidential logs.
datpol@datpol.com +48 55 621 29 29This form is for sales enquiries. Report urgent incidents through your agreed support channel.