Rate Card
Priced to your estate.
Never to a template.
No two environments carry the same risk, so we do not publish one-size prices. Choose the engagement category that fits, and we will return a tailored proposal with clear scope and terms.
- UK-based analysts · delivered remotely from the UK
- Your logs stay in your own Microsoft tenant
- Microsoft-native · Sentinel, Defender XDR and Entra ID
Live today: Microsoft Sentinel automation for enrichment, de-duplication and prioritisation, with BeMa analysts leading investigations and response decisions. Agents recommend; analysts decide.
Microsoft Security Copilot agents, such as phishing triage, are rolling out from November 2026 where your tenant has Security Copilot capacity. BeMa’s own agent capabilities will be added over time.
Readiness Assessment
Teams that want an honest view of their detection and response posture before committing.
- Coverage and telemetry review
- Response process and escalation review
- Tabletop exercise option
- Prioritised findings report
Fixed-scope engagement
Tailored
Request proposalAgentic SOC: Managed
FLAGSHIP OFFERTeams that need a dedicated BeMa team to operate their Microsoft-native SOC within agreed coverage hours.
- Sentinel enrichment, de-duplication and prioritisation with analyst-led investigation
- Response approvals defined with your team
- Service ownership and review cadence agreed in scope
- Optional threat hunting and readiness
Tailored service proposal
Tailored
Request proposalAgentic SOC: Co-managed
Organisations with an in-house SOC that want added depth or capacity.
- Microsoft Sentinel, Defender XDR and Entra ID
- Shared case ownership with your analysts
- Coverage hours agreed around your operating model
- Detection engineering support, where required
Tailored coverage proposal
Tailored
Request proposalFocused Services
Specific gaps: identity, cloud and SaaS, threat hunting or incident readiness.
- Identity threat detection
- Cloud and SaaS monitoring
- Proactive threat hunting programmes
- Incident readiness and exercises
Modular, add to any engagement
Tailored
Request proposalHow proposals are shaped
What informs a proposal.
A tailored proposal can make the scope, assumptions and commercial basis clear before you decide how to proceed.
- Estate size
- Users, endpoints, cloud accounts and SaaS applications in scope.
- Telemetry sources
- Agreed log sources within Microsoft Sentinel, Defender XDR and Entra ID.
- Response tiers
- How much autonomy you grant and which actions require approval.
- Coverage hours
- The service windows and escalation model you need.
- Reporting depth
- Service review cadence and executive or regulatory reporting needs.
- Term
- Engagement length and any phased onboarding.
Get a proposal built around your estate.
Tell us what you need covered and your preferred operating model. We will use that context to shape a proposal for discussion.