Human-Led Detection, Forensic Investigation, + Evidence

 Human-led MDR combines continuous detection technology with security analysts who investigate, hunt, contain, and document threats. Complete Security adds deeper forensic investigation to the monitoring and analyst validation available through Core Defense. Compass’s 100% U.S.-based security operations center reconstructs attack timelines, analyzes adversary behavior using resources such as MITRE ATT&CK, and documents findings to guide response and remediation. 

 Continuous forensics collects and preserves investigative data before an alert triggers, helping analysts reconstruct activity leading up to detection. That evidence supports investigations into data exfiltration, attacker persistence, and the scope of compromise. Compass includes continuous forensics as a standard component of Complete Security. Our article on closing the digital forensics and incident response gap explains why early evidence collection matters. 

 MDR services vary in investigative depth, response authority, and reporting. Complete Security builds on Core Defense’s monitoring and analyst validation with continuous forensics, proactive threat hunting, deeper investigation, and documented root-cause findings. Compass’s U.S.-based analysts connect those findings to remediation priorities. When Compass also manages your IT, operating teams implement agreed fixes through Closed-Loop Delivery. 

 Complete Security serves organizations that need deeper investigation and defensible incident documentation, including healthcare, financial services, legal, insurance, and manufacturing businesses. It also fits complex, multi-site environments where disruption or data exposure carries significant consequences. Compass’s Compliance & Risk Management practice helps identify the evidence and controls your organization needs based on its obligations and risk profile. 

 Consider upgrading when your organization holds more sensitive data, expands through growth or acquisition, faces greater regulatory scrutiny, or needs more detailed incident evidence. Core Defense and Complete Security share the Apex Security Platform and Compass’s U.S.-based security operations center. A Compass advisor can identify the additional investigative capabilities, integrations, and coverage your changing risk profile requires. 

 Evidence requests depend on the policy, incident, and insurer. Prepare to document the incident timeline, affected systems, suspected entry point, potential data exposure, and containment and recovery actions. Complete Security supports that work through forensic findings, preserved artifacts, and investigation records. NIST’s guide to integrating forensic techniques into incident response explains how forensic data supports investigations. Your insurer and legal counsel determine the documentation needed for your claim. 

Individual tools may capture only part of an attack. Complete Security correlates available telemetry across supported endpoint, identity, cloud, network, server, and application sources to help analysts connect suspicious activity across systems. That broader context supports investigations into compromised accounts, lateral movement, and potential data theft. Compass’s explanation of the digital forensics gap shows why investigating beyond the initial alert matters. 

Yes. Complete Security supports compliance work with monitoring records, investigation findings, containment documentation, and security reporting. These deliverables can contribute to evidence requirements across applicable regulations and frameworks; they do not independently establish compliance. Compass’s Compliance & Risk Management practice provides separately scoped readiness assessments and audit support, while frameworks such as NIST CSF help organize security priorities and measure progress. 

Yes. Compass’s 100% U.S.-based security operations center handles monitoring, investigation, and authorized containment while coordinating remediation with your IT team or existing MSP. Agreed responsibilities, escalation paths, and access permissions clarify who acts during an incident. For organizations seeking broader operational support, Co-Managed IT connects Compass specialists with your internal team. 

 Not necessarily. Complete Security can extend supported endpoint, identity, and cloud platforms through correlated telemetry and analyst investigation. Compass reviews your existing tools and integrations during scoping, identifies coverage gaps, and recommends changes where they improve protection or reduce unnecessary cost. Our guide to evaluating bundled cybersecurity services explains what to assess when comparing coverage and provider responsibilities. 

Complete Security analyzes authentication activity, privilege changes, and session behavior to identify suspicious use of legitimate accounts. Attackers can use stolen credentials to enter systems and maintain access; a technique documented in MITRE ATT&CK’s Valid Accounts guidance. Compass analysts correlate identity signals with activity elsewhere in the environment, investigate the context, and coordinate authorized containment actions when a threat is confirmed. 

Complete Security has a 10-minute acknowledgment target for incidents requiring immediate security action. Compass’s U.S.-based analysts then investigate and carry out authorized containment based on the findings. Acknowledgment, containment, and recovery are distinct stages of incident response; the acknowledgment target is not a promise of full resolution within ten minutes. Incidents requiring services beyond the agreed detection and response scope require a separate Incident Response retainer. 

The CompassMSP security operations center is 100% U.S.-based, including detection, triage, investigation, and containment. Compass’s managed IT service desk and engineering teams use a blended U.S. and Philippine follow-the-sun model. If your organization has specific requirements for personnel eligibility, data residency, or evidence handling, review those requirements with Compass during scoping so they are addressed explicitly in your agreement. 

 Enterprise adds a named analyst team, tailored coverage, board-level reporting, and enhanced response targets for large or complex environments. Targets include five-minute alert acknowledgment, fifteen-minute incident confirmation, and one-hour priority-one containment, subject to the agreed service scope and conditions. Discuss Enterprise coverage with Compass to define the investigative support, hunting cadence, integrations, and response commitments your organization needs.