Back to the blog
Cybersecurity
24/7 SOC
Networks
Our Own SOC: 24/7 Monitoring of Networks, Servers and Services
October 2026
Meular Team
4 min read
When a business has several sites, a cloud ERP, VPN tunnels between branches and applications that depend on one another, the question is not whether something will fail, but how long it takes for anyone to notice. All too often the first warning is a user ringing up to say "the system's down". To make sure that does not happen to our clients, we have built our own network and security operations centre (NOC/SOC): a platform that keeps continuous watch, 24 hours a day, 7 days a week, over the connectivity and services their business depends on.
It already serves clients in very different sectors — healthcare, distribution, manufacturing and energy — and currently monitors more than a hundred components: firewalls, VPN tunnels, servers, databases, APIs, websites and data loading processes. These are the pieces that make it genuinely useful.
The router can be up while the firewall is down, or the firewall can be alive while the VPN tunnel carries no traffic. That is why we do not stop at pinging the public IP: for every tunnel, we check that we can reach a real device on the other side and that its service answers (the database, the ERP, the file server). We measure this from two different vantage points — the cloud and our own office — so we know exactly which leg has failed.
Firewalls and VPN tunnelsA real device on the far side of the tunnelLatency and packet loss per tunnelOn every server we monitor CPU, memory, load and each individual disk, with a forecast of how many days are left before it fills up. For databases (Oracle, SQL Server, PostgreSQL, MySQL) we check that they are accepting connections, and in the cloud we also read the physical health of volumes and the performance credit balance of each instance.
CPU, memory and disksDisk-full forecastingOracle, SQL Server, PostgreSQL and MySQLEvery API and website is checked every minute: whether it responds, with which status code, how quickly, and how many days its certificate has left. And not only our clients' own services, but also the third-party services their applications rely on, such as official registers, SMS gateways and suppliers' platforms. We also watch the things that tend to fail silently: overnight data loads and backups. If a job has not run on schedule, or finished with an error, an alert is raised even if "everything seems to be working".
Status code and response timeCertificate expiryETL jobs and backupsWhen something goes down, the technical team gets an email alert instantly. And they get one, not twenty: if a site's firewall drops, the platform understands that the devices behind it are unreachable for that reason and groups the incident under it. Every incident is logged, with who saw it and what was done, and that record produces each client's actual availability against the agreed service level.
Instant email alertsRoot cause, no alert stormsAvailability and SLA per clientThe security side is built on our own SIEM, which collects and correlates security events from servers and workstations: failed login attempts, known vulnerabilities in installed software and changes to critical system files. Serious alerts are grouped, prioritised and explained in plain language, with the specific action to take, so engineers do not have to wade through thousands of warnings. The monitoring platform itself is only reachable from our authorised networks, with named users, roles and a log of every access: who logged in, when and what they looked at.
Centralised SIEMNetwork-restricted accessAccess logging
The most visible change is that we find out before anyone else. A tunnel dropping in the small hours, a disk that will fill up within a week or a data load that never ran stop being Monday-morning surprises. The second is that each client has its own availability report, measured against the services they actually use rather than whether "the network was switched on".
The third, and perhaps the most important: the platform is ours. We have built it on proven open technologies, with our own interface, hosted on our own cloud infrastructure. We are not tied to per-device licensing, and we can onboard a new client, with all their sites and services, in a matter of hours.
We review your sites, your tunnels and your critical applications, and recommend what to monitor and at what service level.
Get in touchMay 2026
Business IntelligenceApril 2026
ServiceView the full service
A secure network between branches, Oracle SIGES as the common system and AI reading invoices, delivery notes and orders.
Let's talk
Tell us about your situation and we will recommend the right level of protection for your business, with no obligation.