BKA Phylax · 24x7 SOC · MDR
BKA Phylax is your cyber defense division: the 24x7 SOC and MDR from Backbone Area. A team of on-call analysts, day and night, powered by European AI. The moment a case opens, the AI is already reading it: it alerts the team and puts in front of them what is happening and what to do. People decide. And act.
SLA figures, not marketing averages. The clock starts when the SOC opens the incident, under the conditions set out in the contract.
Many attacks on companies do not come in through the computer: they come in through an email account. A stolen password, a rule forwarding mail outside, an app allowed to read the mailbox. Antivirus sees none of that.
And when someone does see it, it is usually an alert in an inbox nobody opens until Monday. By then the problem is no longer the alert: it is everything that happened in the meantime.
A SOC watches. An MDR also responds. BKA Phylax is both, with an on-call team and AI working together on every case, at any hour.
People who know your environment, on call day and night. They review every case, decide the response and carry it out within the policy you sign. Nothing important sits in an inbox until Monday.
The moment a case opens, the AI connects what happened on your devices, in your accounts and on your network, alerts the team and proposes what to do. It proposes, it does not command: your policy says what runs, and the team approves whatever affects people.
No need to change tools or providers. We connect what you already have and go on call.
01What you already have
The EDR on your devices, your Microsoft 365 or Google Workspace and your firewall logs.
02One case
The SentinelOne engine (mapped to MITRE ATT&CK) and our own rules bring devices, accounts and network together in a single case.
03European AI
The moment the case opens, the AI reads all of it, alerts the on-call team and proposes the response.
04According to your policy
The analyst decides and acts according to your policy. Every case is documented, and every month you get a report with all of it.
Each arc of the BKA Phylax symbol is a layer. You can take them separately, and together they read as one.
Computers and servers
24x7 monitoring of every device and containment according to your policy.
Microsoft 365 or Google Workspace accounts
What antivirus cannot see. It can be taken on its own.
The firewall at each site
From the firewall logs, whether or not we manage it.
And your website: Phylax Web watches each domain behind the Cloudflare web application firewall (scans, attack waves, and anyone who attacks your website and then tries to sign in to your accounts). Coming soon: your backups.
This is what it looks like when something real happens. The device encrypting files and the account someone used from outside do not arrive as two separate alerts: they arrive as one case, with the AI already on it and an on-call analyst deciding.
Illustrative case, with 24x7 coverage contracted.
Before we start, we sign a response policy with you: what happens on the spot, what an on-call person approves first and what is never touched.
Stopping a malicious program or quarantining a file. Done on the spot, at any hour, and logged in the case for the on-call team.
Isolating a device, blocking an account or ending its sessions leaves someone unable to work. The AI proposes it and an on-call person approves it.
Servers, critical devices and anything you flag are never isolated automatically: it is reviewed and decided with you.
Everything we do is logged and can be undone.
No list prices: every proposal is worked out from your devices, your accounts and your sites. And it works with your current IT provider, no switch needed.
Computers and servers
Runs on top of the EDR (SentinelOne) we deploy on your devices.
Request a proposalMicrosoft 365 or Google Workspace
Can be taken on its own, with nothing of ours on your devices.
Request a proposalEndpoint, Identity and Network
The whole picture: what happens on your devices, in your accounts and on your network.
Request a proposalWhat you sign is what we do.
Response times and response policy, in writing before we start.
Response time in the contract
An on-call analyst on your critical incident, with its conditions and remedy in writing. No marketing averages.
Signed response policy
You decide what happens on the spot, what needs a person to approve it and what is never touched.
Your data stays in the EU
EDR telemetry (SentinelOne) in Frankfurt. And the SOC’s AI is European: Mistral, in France, with zero data retention. It does not keep your data or train on it.
Monthly report
What happened, what we did and what we recommend. No jargon, with your month’s figures.
Live demo
We show you the SOC running, with sample incidents, before you sign anything.
Team in Spain
Based in Madrid. You deal with people who know your environment, not a ticket queue on the other side of the world.
Both. The 24x7 SOC watches: a team of on-call analysts with AI analysing every case. The MDR responds: managed detection and response, meaning that as well as alerting you, we contain the threat according to your policy.
No. BKA Phylax works with your current provider or your in-house IT: we watch and respond on security, and they carry on with the day to day. If you also want us to handle support, we do that too.
The same as by day. The AI analyses every case the moment it opens, and whatever your policy sets for on the spot happens on the spot. With 24x7 coverage contracted, the on-call analyst gets the alert with the AI’s proposal and responds within the contracted times, at any hour.
Everything we do is set out in the response policy you sign: what happens on the spot, what needs a person’s approval and what is alert only. Servers and any devices you flag are never isolated automatically.
No. The AI reads every case, alerts the team and proposes the response, but it does not decide what runs: the policy you sign does, and anything that affects people (isolating a device, blocking an account) is approved by an on-call analyst. And it can only choose from the actions the system allows for that case.
Nothing sits waiting for you. What your policy sets for on the spot happens anyway, and what needs approval is decided by our on-call analyst within what you have authorised.
Everything it does is logged and can be undone: an isolated device goes back on the network as soon as it is reviewed. That is why servers and the critical devices you flag are never isolated on their own.
Antivirus looks at the computer. Many attacks on companies come in through the email account (a stolen password, a hidden forwarding rule, an app with permissions), and antivirus cannot see that. Phylax Identity can, and it correlates it with what happens on your devices.
On the monitoring and response side, yes: continuous detection, a signed response procedure and a record of every incident, with its monthly report. It does not replace a full compliance programme; if you need one, we can look at it separately.
Your data never leaves the EU. EDR telemetry is hosted in Frankfurt and the SOC’s AI is Mistral, in France, with zero data retention: it does not keep your data or train on it.
No question matches your search. Ask us directly and we will answer.
With these five details we can prepare a proposal. If you would rather see it first, ask for a live demo or a free 30-minute assessment.
