Managed by us, by you — or anywhere in between.
Data Leakage Prevention and Data Risk can be run however suits your team: fully managed by ShadowSight, run entirely in-house, or shared — with us handling detection and validation and your team handling the rest, or the other way around. There's no fixed model, and you can change how it's managed as your team grows.
Pick the model that matches the team you have — not the one you'd need to build.
Every model runs on the same platform and the same behavioural detection. What changes is who reviews the findings first, not how accurate they are — detections are confidence-rated from the start, so whoever is watching sees real risk, not noise.
We run it, end to end
The most cost-effective option for organisations without a large internal security team. Our analysts validate every finding before anything reaches you — you only ever see confirmed risk, with evidence attached.
- No new headcount or SOC to build
- Every alert validated before it reaches you
- Best for mid-market teams without dedicated analysts
We share the work
For teams with some internal capability. Common splits: ShadowSight monitors and validates, forwarding only confirmed findings to your team — or ShadowSight starts the engagement and hands monitoring over to you once you're ready. The split is agreed with you, not fixed by the platform.
- ShadowSight validates, your team investigates — or vice versa
- A staged handover as your team scales up
- Best for teams building out their own capability
Your team runs it exclusively
For government, defence, and organisations with an existing SOC or analyst team who need to keep monitoring entirely in-house. ShadowSight provides the platform and the detection — your own cleared staff see every finding first, with no external analyst in the loop.
- No external analyst ever sees your findings
- Fits existing SOC and analyst workflows
- Best for highly secure or already well-resourced teams
The detection is the same. Only the reviewer changes.
ShadowSight's behavioural detection is confidence-rated and evidence-backed before it ever reaches a human — whoever that human is. Choosing to manage it yourself doesn't mean taking on a raw feed of unfiltered alerts, and choosing to have us manage it doesn't mean losing visibility into what we're seeing.
Confidence-rated from the start
Every finding carries a confidence rating and supporting evidence — not a raw rule match to be re-triaged.
Full visibility either way
Self-managed teams get the same dashboards and evidence trail our own analysts use — nothing is held back.
Switch models without switching platforms
Moving from ShadowSight-managed to in-house, or the reverse, doesn't mean a new deployment or a data migration.
Every decision is auditable
Whoever reviews a finding, the outcome — accepted, escalated or dismissed — carries who, when and why.
Most organisations know within a few minutes which one they are.
No dedicated security team
ShadowSight-managed is usually the most cost-effective option — you get full analyst coverage without hiring for it.
Some internal capability
A co-managed split lets your team focus on what they do best, while ShadowSight covers the rest — or hands over gradually.
Existing SOC, government or defence
Self-managed keeps every finding in-house, on a platform built for evidentiary rigour from the start.
Talk to us about the right model for your environment.
Tell us what your team looks like today and we'll recommend a starting point — you're not locked into it.