Most breaches in mid-sized Indian companies are not found by the security team. They are found by a customer, a bank or an attacker who has already been inside for weeks. The gap is rarely tooling. It is that nobody is watching the alerts at two in the morning, and nobody owns the decision about what to do when one turns out to be real.
SecureRoot runs managed detection and response for businesses across Noida and the wider Delhi NCR region. We monitor your environment around the clock, triage what the tools raise, and tell you plainly which alerts matter and what to do next. Our corporate office sits in Greater Noida West, so when an incident needs people rather than a dashboard, we are in the same city.
The regulatory position in India changed in 2022 and most companies have not caught up with it. The CERT-In Directions issued on 28 April 2022 require organisations to report specified cyber incidents to CERT-In within six hours of noticing them. The same directions require you to keep security logs for 180 days and to keep them inside India.
Six hours is the part that catches teams out. It is not a reporting deadline you can meet by discovering an incident on Monday from Friday logs. It assumes somebody is watching continuously and can recognise a reportable event as it happens. An organisation without monitoring has no realistic path to compliance, whatever its policy documents say.
The 180 day retention requirement has a second effect that is easy to miss. Logs are only useful if somebody queries them. Most companies we assess are already paying to store data that nobody has ever searched.
1. Scope and baseline. We map what you actually run: endpoints, servers, cloud accounts, identity provider, network edge and the applications that matter to the business. We record what normal looks like before we start alerting on abnormal.
2. Log sources and retention. We connect the sources that carry real detection value and configure retention to meet the 180 day CERT-In requirement with data held in India. We tell you which sources are noise and are not worth ingesting.
3. Detection engineering. We tune detections to your environment rather than shipping a default rule set. Detections map to MITRE ATT&CK techniques so you can see which tactics you cover and which you do not.
4. Monitoring and triage. Alerts are reviewed by analysts, not just forwarded to your inbox. You receive alerts that have already been assessed, with the evidence and a recommended action attached.
5. Incident response. When something is real, we move to containment and eradication with you, and prepare the CERT-In notification inside the six hour window where the incident is reportable.
6. Review and improvement. Monthly reporting covers what we saw, what we suppressed and what changed. Detections that never fire get retired. Gaps found during incidents become new detections.
BFSI and fintech. Regulated entities carrying reporting obligations and card data, where an unmonitored environment is an audit finding on its own.
SaaS and technology companies. Firms working towards SOC 2 or already holding it, where continuous monitoring is a Trust Services Criteria expectation rather than an optional extra.
Healthcare and healthtech. Organisations handling patient data under the DPDP Act, where a breach carries both regulatory and reputational cost.
Manufacturing and logistics across NCR. Businesses running flat networks and legacy systems, where ransomware moves quickly once it lands.
Companies with no in-house security team. If your IT team owns security alongside everything else, monitoring is the first function worth handing to specialists.
We are a security practice, not a reseller with a dashboard. The people tuning your detections also run our penetration testing and red team engagements, so detection logic is written by people who know how the attacks actually work.
Our corporate office is in Greater Noida West and our head office is in Kanpur, so NCR clients get people in the same time zone and, when it matters, the same city. We work across ISO 27001, SOC 2, PCI DSS and the DPDP Act, so monitoring evidence feeds your audits instead of sitting in a separate system. You can see the full range on our services page.
We will also tell you when you do not need us. If your environment is small enough that monitoring is not yet the right spend, we will say so and point you at what to fix first.
Pricing depends on the number of log sources, endpoint count and retention period rather than a flat per seat rate. Most mid-sized engagements are priced monthly with a defined source list. We scope on a short call and give you a written figure before any commitment.
A SIEM is a tool that collects and correlates logs. MDR is the service around it: the people who tune detections, review alerts and respond when one is real. Buying a SIEM without staffing it usually produces alerts nobody reads.
Onboarding usually runs in phases. Priority sources such as endpoints, identity and cloud accounts come first, then the remaining sources once the baseline is stable. We agree the sequence during scoping so you get coverage on what matters most early.
Yes. Where an incident is reportable under the 28 April 2022 CERT-In Directions, we prepare the notification content and timeline within the six hour window. Reporting is submitted by your organisation as the accountable entity.
Yes, they answer different questions. Penetration testing tells you where you can be broken into. MDR tells you when somebody is trying. Clients commonly run both, and findings from testing feed new detections.
Yes. We serve Delhi NCR including Gurgaon, Ghaziabad and Greater Noida, and clients across India. On site attendance is easiest within NCR.
We contact your named escalation path immediately, provide containment guidance and stay engaged through eradication and recovery. Where the incident is reportable, we prepare the CERT-In notification in parallel.
Book a call to scope an MDR engagement for your Noida or Delhi NCR business. We will tell you what is worth monitoring, what it costs and whether you need it yet.
Call +91 73071 48874 or email info@secureroot.co. Book a free consultation
No obligation. Our senior consultants will walk through your environment and share where the gaps are. Whether you work with us or not.
Cybersecurity that helps enterprises worldwide move from “hope we’re safe” to “we’ve got this.”
Follow us
Copyright © 2026 Secureroot Risk Advisory LLP. All rights reserved.
