What is a managed SOC and what does ACDC do?
A managed SOC is an external security operations centre that monitors your IT environment as a service and responds to attacks. To do this, ACDC analyses log data and events around the clock, detects anomalies automatically and manually, prioritises incidents by criticality and escalates critical incidents through paths agreed with you. ACDC also supports forensic analysis, containment and recovery and continuously optimises its detection rules. You do not need your own shift team for any of this.
Do we have to replace our existing security tools?
No. Existing SIEM, EDR or XDR systems can be connected to ACDC; alternatively, you use the ACDC platform, which brings security-relevant data together in one place. You and ACDC decide together which log sources make sense and which monitoring goals apply. The result is a monitoring and response model that fits your IT landscape, rather than a standard package that would force you to rebuild your environment.
What happens if ACDC detects a critical incident at night?
An analyst assesses the incident and reports it to your designated contacts along the agreed escalation path, including outside office hours. ACDC then works with you to contain the attack technically, supports the forensic analysis and recommends measures for containment, hardening and recovery of the affected systems. If you have your own incident response processes or playbooks, ACDC is integrated into them so that everyone knows who decides what when it matters.
Does ACDC help with implementing NIS2?
Yes, ACDC supports the technical requirements for detecting and handling security incidents that NIS2 sets out in Art. 21. For the reporting obligations under Art. 23 (early warning within 24 hours, notification within 72 hours, final report no later than one month after the notification), detection around the clock, agreed escalation paths and reports provide the basis. That alone does not make you compliant: your organisation has to report, and organisational measures remain your responsibility. This overview is not legal advice.
Does ACDC help with cyber insurance requirements?
Yes, if your insurer requires ongoing monitoring, detection and a defined response to incidents. ACDC provides building blocks for this, such as round-the-clock monitoring, agreed escalation paths, reports and regular review meetings. With these you can show how your organisation detects and handles attacks. Which requirements apply and whether they are met is determined by your insurance policy. We therefore recommend comparing your insurer's questionnaire with the agreed monitoring scope.
What is the difference between ACDC and managed SIEM?
With ACDC, analysts take over detection and response around the clock; with managed SIEM, snapSEC only runs the platform and your own team detects and responds. Managed SIEM & security data lake is a SIEM platform based on Elastic, operated by snapSEC, with retention from days to several years; you manage rules and alerts yourself. ACDC is the right fit if you lack your own 24/7 team. An existing SIEM can be connected to ACDC.
How do we stay informed about our security posture?
Through regular review meetings, clear reports and a named contact who knows your environment. In these meetings with security consultants, for example monthly or quarterly, you discuss incidents, the threat landscape and improvements to log sources, detection rules and use cases. You get more than data: concrete recommendations for action. If needed, ACDC can be extended with threat hunting, purple teaming or retainer models.
Which companies is ACDC suitable for?
ACDC suits companies in Austria, Germany and Switzerland that want protection around the clock but cannot or do not want to build their own 24/7 security team. Typical triggers are NIS2 obligations, cyber insurance requirements or an IT team that is not available at night and at weekends. According to acdc.onl, ACDC currently protects over 25,000 digital assets at more than 30 companies.
