In late October, attackers took about $6.3 billion from the crypto exchange Binance, most of it in a window of roughly 20 minutes. The FBI has attributed the theft to North Korea (NPR, TechRadar). Most attacks on mid-sized organizations are far smaller. The clock is just as short.
This week I gave a talk called "The One-Person SOC" to a packed room of system administrators. Many of them are their organization's entire IT department. When I asked who would see a critical alert at 11 p.m. on a Friday, the answers ranged from… "me, on my phone," "our MSP, maybe," and "no one until Monday." This post covers what we talked about.
Can a one-person IT team get 24/7 security coverage?
Not alone, and the math explains why. But a lean team can get real after-hours coverage by deciding which signals must be watched, who watches them, and who is allowed to act at night. The tools most teams already own are rarely the gap. The gap is a person reading them together, around the clock.
Why do attackers work nights and weekends?
Because that is when no one is looking. A week has 168 hours. A 40-hour IT week covers about 24% of them. Covering all 168 takes roughly 4.2 full-time people, before vacation, sick days or turnover. Attackers know this, and they plan around your calendar: Friday nights, long weekends and holidays.
A one-person team can carry a phone and hope to catch the alert that matters. That is coverage by willpower, and it fails the first time you are asleep, on a plane or at your kid's game.
How do attackers size up a lean IT team today?
Reconnaissance used to mean scanning your network and probing for open ports. It still does. Today attackers add a second layer that never touches your network at all: public information that tells them how big your IT team is, what you run, and when you are least likely to notice.
- LinkedIn. Who runs IT, how many people report to them, and whether anyone's title includes security.
- Job posts. A listing that asks for experience with a specific firewall, EDR product or Microsoft 365 license tier tells an attacker exactly what you run.
- Local news. Budget cuts, layoffs, mergers, a new site opening. Each one signals distraction or change.
- Reddit and online forums. Staff venting that the VPN is always down or that IT never answers tickets is free intelligence.
- The dark web. Credentials from old breaches, sometimes sold with access already established.
None of this trips an alert. By the time anything touches your environment, the attacker already knows your team is small and your coverage is thin.
What happens when a known vulnerability stays unpatched?
Sometimes the attacker does not need to find a weakness, because one has already been found and left open. Monitoring can shorten an attack. It cannot make up for a critical vulnerability everyone knew about and no one fixed.
Here is a real case from an organization I am familiar with. More than a year before the attack, an outside security consultant told them their virtual server cluster was missing critical patches. The patches were never applied. An attacker got in through that gap, took administrator control, and locked out everyone, including the system administrators. The network never technically went down. DHCP simply stopped handing out IP addresses, so the first sign was users calling the help desk. Only then did IT realize the critical infrastructure had been encrypted.
The lesson for a lean team is uncomfortable. "We will patch it next quarter" is a risk decision, whether or not anyone signs off on it. Critical patches on internet-facing systems and virtualization hosts belong at the top of the list, ahead of almost everything else.
Is your security data watched, or just collected?
Most lean teams log far more than anyone reads. The test is simple: for each important source, ask whether it is logged, whether it alerts, whether anyone would see that alert at 11 p.m. on a Friday, and how long it would take to act. Any blank in the last two columns is an after-hours gap.
Run it against five sources:
- Sign-ins to Microsoft 365 or Google Workspace
- Mailbox rules and forwarding
- EDR alerts
- Firewall and DNS
- Active Directory and the domain controller
Most teams find that sign-ins and EDR alert reasonably well during the day, while mailbox rules and domain controller activity are logged and never reviewed. Those are exactly the places attackers hide.
So yes, you can be a one-person SOC. But it takes a lot to go right. You need to be Superman, with the wind at your back and luck on your side. Your environment has to be fully patched, every critical source has to alert, and you can never be asleep, sick or on vacation when the alert that matters fires. Most lean teams eventually do the math and decide they don’t want to bet the organization on that. The next question is what kind of help is actually worth paying for.
What should a lean team look for in an MDR or MXDR partner?
A detection and response partner should give you real overnight eyes across identity, email, endpoint and network, the authority to act on your behalf within limits you set, and findings written for a person rather than a console. If a provider can't show you all three in writing, keep looking.
Six things to require
- Real 24/7 coverage. Analysts on shift nights, weekends and holidays, not business hours plus an on-call pager.
- Breadth, read together. Identity, email, endpoint and network signals correlated, not reviewed one tool at a time.
- Response authority. What they can do in your environment without waiting for you, agreed in writing.
- Measured speed. A stated response time for critical findings, and a clear answer on when the clock starts.
- Readable findings. What happened, what is affected and what to do next. Not raw alerts.
- Fit with what you own. It works with your existing EDR, firewall and identity stack. No rip-and-replace.
Red flags
- Alert forwarding sold as response
- "24/7" that means a pager after 5 p.m.
- A requirement to replace tools you already own
- Per-alert, per-log or overage pricing
- No sample report before you sign
Ask every provider where their response clock starts. If it starts when an alert reaches their SOC rather than when the event happens in your environment, the number hides significant delay.
For transparency, this is the work Gradient Cyber does. Quorum AI, our AI-native MXDR platform, reads Microsoft 365 and Google Workspace activity by direct API, works with the EDR you already run, and uses network telemetry to see devices that have no agent. Our analysts work over the loop, directing AI agents and owning the decisions that matter. Pre-approved actions are automated; the rest are analyst-driven. We aim to respond to critical findings within 30 minutes.
Where should a lean IT team start?
Start with what costs little and closes the biggest gaps, then decide how you will cover nights and weekends before your next long holiday. A phased plan keeps it realistic for a team of one to three people.
Now: this month, little or no cost
- Phishing-resistant MFA for finance, payroll and administrators
- Turn off legacy authentication
- Alert on new mailbox rules and forwarding
- Apply any critical patch already flagged on internet-facing systems or virtualization hosts
- A one-page incident response plan: names, numbers, your cyber insurance hotline and counsel
Next: this budget cycle, modest spend
- EDR on every staff device and server, with someone acting on its alerts
- Offline or immutable backups, with a test restore at least twice a year
- Run the watched-or-collected check on every log source
Then: before your next long holiday
- Decide how after-hours coverage will work: an in-house rotation, your MSP, or an MDR or MXDR partner
- Use the requirements and red flags above before you sign anything
Frequently asked questions
How many people does 24/7 security coverage take?
About 4.2 full-time people just to staff 168 hours a week, before vacation, sick days and turnover. That is why most organizations with small IT teams cover nights and weekends through a managed partner rather than an in-house rotation.
What is the difference between an MSP and an MXDR / MDR provider?
An MSP typically runs day-to-day IT: help desk, patching, devices and networks. An MXDR / MDR provider specializes in detecting and responding to threats around the clock. Many lean teams use both, and the two work best when it is clear who acts on a security finding at 2 a.m. Note that many MDR providers are really managed EDR services, watching endpoints only. MXDR covers a much broader set of telemetry: network, identity, email and cloud as well as endpoint.
What response time should I expect from an MDR provider?
Ask for a stated response time for critical findings and where the clock starts. Gradient Cyber aims to respond to critical findings within 30 minutes, and recent performance has run around 21 minutes. Whatever the number, confirm it is measured from the event, not from when a ticket was opened.
What is the After-Hours Test?
It is a free, ten-question self-assessment for IT teams of one to ten people. It takes about ten minutes and shows where your coverage holds on its own and where it depends on someone being at a desk. Take the After-Hours Test, or if you want to move faster, start a free proof of value in your own environment.
Attackers count on your team being small. The answer is making sure someone is watching when you are not.