In late October, attackers took about $6.3 billion from the crypto exchange Binance, most of it in a window of roughly 20 minutes. The FBI has attributed the theft to North Korea (NPR, TechRadar). Most attacks on mid-sized organizations are far smaller. The clock is just as short.
This week I gave a talk called "The One-Person SOC" to a packed room of system administrators. Many of them are their organization's entire IT department. When I asked who would see a critical alert at 11 p.m. on a Friday, the answers ranged from… "me, on my phone," "our MSP, maybe," and "no one until Monday." This post covers what we talked about.
Not alone, and the math explains why. But a lean team can get real after-hours coverage by deciding which signals must be watched, who watches them, and who is allowed to act at night. The tools most teams already own are rarely the gap. The gap is a person reading them together, around the clock.
Because that is when no one is looking. A week has 168 hours. A 40-hour IT week covers about 24% of them. Covering all 168 takes roughly 4.2 full-time people, before vacation, sick days or turnover. Attackers know this, and they plan around your calendar: Friday nights, long weekends and holidays.
A one-person team can carry a phone and hope to catch the alert that matters. That is coverage by willpower, and it fails the first time you are asleep, on a plane or at your kid's game.
Reconnaissance used to mean scanning your network and probing for open ports. It still does. Today attackers add a second layer that never touches your network at all: public information that tells them how big your IT team is, what you run, and when you are least likely to notice.
None of this trips an alert. By the time anything touches your environment, the attacker already knows your team is small and your coverage is thin.
Sometimes the attacker does not need to find a weakness, because one has already been found and left open. Monitoring can shorten an attack. It cannot make up for a critical vulnerability everyone knew about and no one fixed.
Here is a real case from an organization I am familiar with. More than a year before the attack, an outside security consultant told them their virtual server cluster was missing critical patches. The patches were never applied. An attacker got in through that gap, took administrator control, and locked out everyone, including the system administrators. The network never technically went down. DHCP simply stopped handing out IP addresses, so the first sign was users calling the help desk. Only then did IT realize the critical infrastructure had been encrypted.
The lesson for a lean team is uncomfortable. "We will patch it next quarter" is a risk decision, whether or not anyone signs off on it. Critical patches on internet-facing systems and virtualization hosts belong at the top of the list, ahead of almost everything else.
Most lean teams log far more than anyone reads. The test is simple: for each important source, ask whether it is logged, whether it alerts, whether anyone would see that alert at 11 p.m. on a Friday, and how long it would take to act. Any blank in the last two columns is an after-hours gap.
Run it against five sources:
Most teams find that sign-ins and EDR alert reasonably well during the day, while mailbox rules and domain controller activity are logged and never reviewed. Those are exactly the places attackers hide.
So yes, you can be a one-person SOC. But it takes a lot to go right. You need to be Superman, with the wind at your back and luck on your side. Your environment has to be fully patched, every critical source has to alert, and you can never be asleep, sick or on vacation when the alert that matters fires. Most lean teams eventually do the math and decide they don’t want to bet the organization on that. The next question is what kind of help is actually worth paying for.
A detection and response partner should give you real overnight eyes across identity, email, endpoint and network, the authority to act on your behalf within limits you set, and findings written for a person rather than a console. If a provider can't show you all three in writing, keep looking.
Ask every provider where their response clock starts. If it starts when an alert reaches their SOC rather than when the event happens in your environment, the number hides significant delay.
For transparency, this is the work Gradient Cyber does. Quorum AI, our AI-native MXDR platform, reads Microsoft 365 and Google Workspace activity by direct API, works with the EDR you already run, and uses network telemetry to see devices that have no agent. Our analysts work over the loop, directing AI agents and owning the decisions that matter. Pre-approved actions are automated; the rest are analyst-driven. We aim to respond to critical findings within 30 minutes.
Start with what costs little and closes the biggest gaps, then decide how you will cover nights and weekends before your next long holiday. A phased plan keeps it realistic for a team of one to three people.
About 4.2 full-time people just to staff 168 hours a week, before vacation, sick days and turnover. That is why most organizations with small IT teams cover nights and weekends through a managed partner rather than an in-house rotation.
An MSP typically runs day-to-day IT: help desk, patching, devices and networks. An MXDR / MDR provider specializes in detecting and responding to threats around the clock. Many lean teams use both, and the two work best when it is clear who acts on a security finding at 2 a.m. Note that many MDR providers are really managed EDR services, watching endpoints only. MXDR covers a much broader set of telemetry: network, identity, email and cloud as well as endpoint.
Ask for a stated response time for critical findings and where the clock starts. Gradient Cyber aims to respond to critical findings within 30 minutes, and recent performance has run around 21 minutes. Whatever the number, confirm it is measured from the event, not from when a ticket was opened.
It is a free, ten-question self-assessment for IT teams of one to ten people. It takes about ten minutes and shows where your coverage holds on its own and where it depends on someone being at a desk. Take the After-Hours Test, or if you want to move faster, start a free proof of value in your own environment.
Attackers count on your team being small. The answer is making sure someone is watching when you are not.