York law firm contains an out-of-hours ransomware attempt in 11 minutes

EDR provides the telemetry and the ability to isolate a device; MDR provides the humans who watch it around the clock and act. In this incident the technical detection fired at 22:47 on a Sunday. An unmonitored EDR console would have queued that alert until Monday morning, by which point encryption and exfiltration would have completed. The SOC analyst validated the alert against sign-in telemetry, confirmed it was not a false positive, and used pre-agreed containment authority to isolate two endpoints and disable the account. The technology found it; the staffed service is what stopped it.

Because the time lost seeking approval at night is the time an attacker uses to move laterally and reach a file server. Pre-agreed authority defines exactly what the SOC may do without calling you: typically isolate an endpoint from the network, disable a compromised user account, and kill a malicious process. It does not extend to deleting data, rebuilding machines or changing configuration. The trade-off is that a false positive can briefly isolate a working laptop, which is an inconvenience measured in minutes and reversible with one click. Weighed against a firm-wide encryption event, the trade is straightforward.

Attackers deliberately act outside business hours, and most SME ransomware detonates at night or over a weekend precisely because nobody is watching. For a law firm the calculation is sharper than headcount suggests: the value at risk is client confidentiality, professional obligations and the ability to keep working, not the replacement cost of hardware. Client due-diligence questionnaires and Lexcel assessments increasingly ask directly whether monitoring is continuous. At SME scale a shared, UK-staffed SOC costs a fraction of hiring even one in-house analyst, which is why it is now the normal answer rather than an enterprise one.