Most businesses we speak with already have antivirus, a firewall and multi-factor authentication. That's a good start. But each of those tools has the same blind spot: when something gets past them, or when they raise an alarm, someone has to notice and act. If that alarm goes off at 2am on a Saturday, or during the Christmas shutdown, who is watching?

That gap between an attacker getting in and someone stopping them is where the damage happens. Closing it is the job of 24/7 managed detection and response, usually shortened to MDR.

The threat landscape has changed

The Australian Signals Directorate's Annual Cyber Threat Report for 2024–25 makes sobering reading. Its Australian Cyber Security Centre responded to more than 1,200 cyber security incidents, an 11% increase on the year before, and received a cybercrime report on average every six minutes. The average self-reported cost of cybercrime for a small business rose 14% to $56,600 per report.

Just as telling is how attacks now happen. Business email compromise, where an attacker takes over a mailbox and uses it to redirect payments or deceive clients, is among the most commonly reported cybercrimes affecting Australian businesses. Many of today's attacks have these traits:

  • They target identities, not just devices. Stolen passwords, phished MFA codes and hijacked session tokens give attackers a legitimate-looking sign-in to Microsoft 365, with no malware involved.
  • They use legitimate tools. Remote access software, PowerShell and built-in Windows utilities let attackers blend in with normal IT activity, so traditional antivirus has nothing obvious to block.
  • They move quickly once inside. Hidden inbox rules, new forwarding addresses and disabled security settings can be put in place within minutes of a successful sign-in.
  • They strike outside business hours. Attackers know evenings, weekends and holidays are when nobody is looking.

Why tools alone aren't enough

Security software is excellent at generating alerts. What it can't do on its own is decide which of those alerts matter, investigate them in context and take decisive action. In a typical small or mid-sized business, alerts land in an inbox that nobody checks until Monday morning. By then a compromised mailbox may have been quietly reading client correspondence all weekend, or ransomware may have spread from one laptop to the file server.

Managed detection and response pairs the technology with people: a security operations centre (SOC) staffed around the clock by analysts whose job is to triage every alert, hunt for suspicious behaviour and respond the moment something is confirmed, whether it's 2pm or 2am.

How In2Tech delivers 24/7 protection with Blackpoint Cyber

We partner with Blackpoint Cyber, a specialist MDR provider whose human-led SOC monitors our clients' environments 24 hours a day, 7 days a week. We deploy it in two complementary layers.

Endpoint MDR on every computer. A lightweight Blackpoint agent is installed on each workstation and server we manage. It watches for the behaviours that signal an attack in progress, such as unusual remote access, suspicious use of administrative tools and attempts to disable security software. When a threat is confirmed, Blackpoint's SOC can actively respond, including isolating an affected computer from the network to stop an attack spreading while the rest of the business keeps working. It also integrates with our SentinelOne Antivirus and Microsoft Defender, so the protection you already have is managed and monitored rather than left to fend for itself.

Cloud MDR Essentials for Microsoft 365. Because so many attacks now begin with a stolen identity, we extend the same 24/7 monitoring to your cloud accounts. Blackpoint's Cloud MDR watches sign-ins and account activity across Microsoft 365, and also supports Google Workspace, Cisco Duo and Azure single sign-on. It flags risky events such as sign-ins from unexpected countries, suspicious mailbox rules and other signs of account takeover, and its SOC responds to confirmed threats rather than simply sending a notification.

Together, these layers cover the two places most modern attacks start: the device in front of your staff, and the cloud account behind their email and files.

What this means for your business

  • Faster containment. A threat that's isolated in minutes is an inconvenience. One discovered days later can become a reportable data breach.
  • Coverage when you're closed. Nights, weekends and public holidays are monitored just as closely as business hours.
  • Less noise for your team. Analysts filter out false positives, so you only hear about what genuinely needs attention.
  • A stronger position with insurers and clients. Cyber insurers and security-conscious clients increasingly ask whether you have endpoint detection and response and continuous monitoring. Being able to answer yes, with evidence, makes renewals and due-diligence questionnaires easier.
  • Support for your Essential 8 journey. 24/7 monitoring doesn't replace the ACSC Essential 8 controls, but it gives you visibility and a response capability if one of those controls is ever bypassed.

Questions worth asking about your current setup

  • If an employee's Microsoft 365 account was compromised at 10pm on a Friday, how long would it take for someone to notice?
  • Who reviews your security alerts today, and what happens to them outside business hours?
  • Could you isolate an infected computer remotely, before the problem reached your file server or cloud storage?
  • When your cyber insurer asks about EDR and 24/7 monitoring, what will you tell them?

If any of those answers are uncomfortable, you're not alone. Most businesses were simply never set up with round-the-clock coverage, because until recently it was only practical for large enterprises with their own security teams. Partnering with Blackpoint lets us bring that same level of protection to businesses of every size.

Let's talk

Blackpoint's Endpoint MDR and Cloud MDR Essentials are available to In2Tech managed services clients, and we handle deployment, tuning and day-to-day coordination with the Blackpoint SOC. If you'd like to know how your current protection stacks up, or what 24/7 coverage would look like for your business, get in touch for a no-obligation conversation.