Generation 01
Traditional SOC
Human-dominated Tier 1, scaling by headcount
- Initial access
- Execution
- Lateral movement
- Impact on OT
The attack reached impact on OT before Tier 1 got to the right alert.
Cyber Defense Center: the Vortex NG-SOC Convergente
24x7x365 detection and response for IT, OT and AI, with hyperautomation. Automation absorbs the alert volume, and our specialists step in where your business context is decisive.
In short: The Cyber Defense Center is the Converged NG-SOC (NG-SOC Convergente) of Vortex Security, the MSSP leader in Brazil: a SOC and MDR (managed detection and response) service that monitors, detects and responds to threats 24x7x365 in IT, OT and AI environments, with hyperautomation, AI and dedicated specialists, for large companies. It is the most innovative approach to MDR, with the largest library of detection use cases (5,000+), 3,000+ playbooks and the fastest response time in the market: a reference SLA of 15 minutes to first response for high-severity incidents. Vortex is a Leader in the ISG Provider Lens 2026 for Next-Gen SOC/MDR Services (Midmarket) in Brazil.
The challenge
The traditional SOC cannot keep up with the attacker
Data breaches and operational disruptions do not only cause losses: they put business continuity and the company’s reputation at risk. And the SOC model that scales by hiring more analysts can no longer keep up with the pace of attacks.
- 01
Alert volume overwhelms the team
When triage depends on people, the queue grows faster than the team can analyze it.
- 02
False positives consume Tier 1
The analyst spends the shift discarding noise, and the alert that matters waits in the queue.
- 03
Response moves at the analyst’s pace
While someone investigates manually, the attacker keeps advancing through the environment.
A generational leap
From event volume to business risk
The Cyber Defense Center was born ahead of the traditional SOC, with automated alert enrichment and orchestrated response from the start. Today it operates as an NG-SOC Convergente: IT, OT and AI in the same detection context, focused on business risk.
Stage 01
Traditional SOC
Focus on event volume
Stage 02
Automation
Automated threat response
Stage 03
Convergence
Integrated capabilities and context across IT, OT and AI
Stage 04
Business-driven NG-SOC
Focus on business risk
Vortex
Generation 01
Traditional SOC
Correlation model, focus on detection
- Human-dominated Tier 1, scaling by headcount
- Alert volume overwhelms the team
- False positives consume Tier 1
- Response at the analyst’s pace
Generation 02
Cyber Defense Center
Automation and orchestration, focus on response time
- Orchestration in place of Tier 1
- Triage before the human
- Generative AI copilot for investigation
- More than 5,000 ready-made use cases
- Vortex MDR
Generation 03
NG-SOC Convergente
Business risk · IT + OT + AI
- Unified view of risk across multiple environments
- Cross-correlation between IT and OT
- AI context on the attack surface
- Executive decisions driven by exposure
What changes in practice, from generation 01 to 03
Generation 03
NG-SOC Convergente
Triage before the human and orchestrated response
- Initial access Contained
- Execution
- Lateral movement
- Impact on OT
Contained at Initial access. AI triage removed the noise before the analyst, and the automated response acted on its own.
Illustrative simulation: the alert volume, the timings and the attack do not represent measurements from a real case.
Inside the NG-SOC Convergente
How detection and response work
AI layer
AI-assisted intelligence and investigation
Smart AI triage
Classifies alerts and filters out false positives before the analyst
GenAI copilot
Summarizes IoCs, correlates threat intel and suggests hypotheses
1
Alert from any SIEM
Splunk, QRadar, RSA and others
The alert arrives from any SIEM. The model is agnostic and preserves the investment the client has already made.2 Orchestration and enrichment
Playbook
Workflow
Human analysis
Enrichment
Lookups in 150+ external sources
3 Threat and exposure intelligence
Dark and deep web
Leaked credentials
Sandbox
Attack surface
4
Autonomous response
Integration with the environment and automated containment
Containment is executed directly in the environment, autonomously, with playbooks approved by the client.Integration with the client’s technologies
Automated remediation and containment
Automated remediation and continuous learning: every incident fine-tunes rules, playbooks and use cases.Continuous feedback and learning
SIEM-agnostic · Click a step to pause and read
SIEM- and vendor-agnostic: we make use of the tools you already have, without forcing a replacement, and SOAR coordinates the response end to end.
Use cases
The NG-SOC Convergente in action
Each scenario, step by step: what the attacker does, what the CDC sees, what automation carries out and what the analyst decides, through to containment and post-incident.
From phishing in the office to the controller at the plant
The attack starts with an email and tries to reach the industrial process. Because plant telemetry and IT events are correlated on the same platform, the CDC sees the attack end to end.
Scenario map: in the office (IT), the attacker, the email and the employee’s workstation; at the boundary, the passage to the plant; at the plant (OT), the industrial network, the controller and the industrial process; at the bottom, the NG-SOC Convergente, with the radar that covers IT and OT. The full walkthrough is just below the scene.
Illustrative scenario
Case walkthrough
Agreed during preparation: An escalation matrix with IT and with plant operations, and industrial playbooks that respect operational constraints.
An employee opens the attachment of a phishing email, and the malicious code starts running on their workstation.
From the compromised workstation, the attacker looks for a path to the industrial network and crosses the boundary between IT and OT.
The workstation alert triggers the phishing investigation playbook: sender, links and attachment are checked against more than 150 intelligence sources, and the file goes to the sandbox.
- SOAR playbook
- Threat intelligence
- Sandbox
Industrial telemetry shows a new communication on the plant network. The CDC links that signal to the phishing in the office: it is a single attack, seen end to end.
- OT telemetry
- IT ↔ OT correlation
The attacker tries to send a change command to a controller. The attempt shows up in industrial telemetry, already linked to the open case.
The playbook quarantines the attachment by its hash and applies a time-bound block to the source IP, cutting off the path at the boundary. No plant equipment is shut down automatically.
- Hash quarantine
- IP blocking
Analysts trained in industrial security receive the case summarized by AI, open the virtual war room with IT and plant operations, and decide the next steps together, without stopping production.
- AI: case summary
- War room
On managed assets, the CDC acts directly. Outside the scope, it engages, advises and follows up with the company’s team as they clean the workstation and check the controller.
- Vortex Service Portal
IT and OT playbooks and runbooks are reviewed and, when needed, the detailed incident report records the path from the email to the controller.
A legitimate credential used anomalously
The attacker does not break in: they log in with a real username and password. To rules and signatures, everything looks normal. Behavioral analytics notices that the account has stopped acting as usual.
Scenario map: on the left, the attacker with a valid password; in the center, the employee’s identity, surrounded by the baseline of that account’s access; on the right, three servers; at the bottom, the NG-SOC Convergente with the radar. The full walkthrough is just below the scene.
Illustrative scenario
Case walkthrough
Agreed during preparation: Automatic blocking of compromised credentials and source IPs, and who is engaged in each case.
The attacker logs in with an employee’s real username and password. To rules and signatures, it is a login like any other.
Behavioral analytics compares the login with the account’s history and flags the deviation: a source and a time outside that employee’s usual pattern.
- UEBA
With the account, the attacker starts opening servers that user had never accessed. Behavioral analytics records the lateral movement.
- UEBA
A playbook adds the history of the user and of the servers to the alert, and threat intelligence finds the credential in a leaked credentials database.
- SOAR playbook
- Threat intelligence
The containment playbook approved during preparation applies a time-bound block to the compromised credential and the source IP. The attacker loses access.
- Credential blocking
- IP blocking
With the case summarized by AI, the analyst checks what the account accessed, confirms the compromise and engages the owner through the escalation matrix.
- AI: summary and hypotheses
- Escalation matrix
On managed assets, the CDC acts directly. Outside the scope, it advises and follows up with the company’s team until the employee is back at work with a new password.
- Vortex Service Portal
Playbooks and runbooks are reviewed and, when needed, a detailed incident report is issued. Every case fine-tunes rules and use cases.
Privileged account and data exfiltration
The account has permission for what it does, which is why ordinary rules do not stop it. The CDC looks at behavior: what this account usually accesses and how much data it usually moves.
Scenario map: inside the company, the administrator account and the sensitive data; at the exit to the internet, the gauge of the volume sent out compared with the account’s usual pattern; outside, the external destination; at the bottom, the NG-SOC Convergente with the radar. The full walkthrough is just below the scene.
Illustrative scenario
Case walkthrough
Agreed during preparation: What can be blocked automatically. Privileged accounts were left to an analyst’s decision.
An administrator account, in the hands of an insider or an attacker, starts reading a sensitive data repository that is not part of its routine.
Behavioral analytics flags the deviation: the account has permission, but it has never read this data at this volume. Having access is not the same as acting as usual.
- UEBA
The files are compressed and sent to an external destination.
The account’s outbound volume goes far beyond its usual pattern. Threat intelligence checks the destination against more than 150 sources, and a playbook adds the history of the account and of the assets to the alert.
- UEBA
- Threat intelligence
- SOAR playbook
The playbook applies a time-bound block to the destination IP, and the transfer stops midway. The account stays active: because it is privileged, it is only blocked on an analyst’s decision.
- IP blocking
AI summarizes what the account did and suggests hypotheses. Through the escalation matrix, the analyst confirms with the owner that there was no authorized task and triggers the credential block.
- AI: summary and hypotheses
- Escalation matrix
- Credential blocking
The CDC advises and follows up with the company’s team as they review the account’s access and the data involved, with everything recorded in the Vortex Service Portal.
- Vortex Service Portal
The detailed incident report is issued, and playbooks and runbooks are reviewed with what the case taught.
Illustrative scenarios: the steps show how the service works and do not describe a real client incident. Automated actions follow playbooks approved by the company during preparation.
Hyperautomation
Response at the attacker’s pace, not the analyst’s
AI agents handle triage, detection engineering, threat hunting, malware analysis and automated remediation before the human team needs to step in.
70% automation in data mining
<4% false positives
150+ threat intelligence sources
5,000+ detection use cases
Platform and automation
What underpins the operation
Engineering and AI
Continuous detection engineering
Use cases aligned with MITRE ATT&CK and with the threats to your sector, with proactive threat hunting on the collected telemetry.
AI with human oversight
Case summarization, natural-language investigation, creation and tuning of detection rules and decision support, with a specialist at every critical point.
Automation and intelligence
More than 3,000 playbooks
Triage, enrichment, investigation, containment and response across dozens of technologies. We were pioneers in Brazil with our own SOAR and, when a connector is missing, our development team builds it: all the technology needs is an API.
Behavioral analytics (UEBA)
Baselines of the normal behavior of users, devices and services reveal atypical access, lateral movement, anomalous use of credentials and abuse of privileged accounts, even with legitimate credentials.
Intelligence with Brazilian context
More than 150 IoC sources, a malware sandbox, our own MISP synchronized with the client’s, and curation of Latin American threats, applied automatically to detection and playbooks.
Platform
SecOps Enterprise edition
Native SIEM, SOAR, UEBA and threat intelligence on a cloud platform, with petabyte-scale correlation, longer data retention and advanced detection with rules at scale.
NG-SOC Convergente
IT and OT, a single attack surface
We pioneered the Converged IT and OT SOC, now in production for several clients. Industrial telemetry is correlated with IT events, and the attack becomes visible end to end: from phishing in the office to an attempt to manipulate a controller at the plant.
The Cyber Defense Center has dedicated OT cells, with analysts trained in industrial security, knowledge of the protocols and playbooks that respect the plant’s operational constraints. That way, the response protects the process without stopping production.
- Unified view of the IT and OT attack surface
- Correlation between IT and OT to detect lateral movement early
- Experience in energy, manufacturing, port logistics, sanitation, and oil and gas
Method
From the first signal to the lesson learned
NIST-based incident response, with the same process for IT, OT and AI. The initial steps are accelerated by automation and AI, and the human team steps in where the business context is decisive.
Preparation
During onboarding, we define with you the escalation matrix, the responsibility for each asset, the RACI matrix and the response plan.
Detection and analysis
Each alert is analyzed and receives the containment, remediation or notification instruction, automated or from the analyst.
Containment
Direct intervention on the technologies managed by the CDC and automated containment by SOAR.
Remediation
We act on the asset within the SLA. Outside the managed scope, we engage, advise and follow up with your team.
Post-incident
Playbooks and runbooks reviewed and, when needed, a detailed incident report.
Reviewed playbooks and runbooks feed back into preparation
When the incident involves several teams, we open a virtual war room, available 24 hours a day, with messages, files and audio and video calls for up to 20 participants, led by the Vortex team.
Full transparency
Vortex Cockpit: the same view as our analysts
No black box: the alerts you see in Cockpit are the same ones that reach the CDC team. Incidents, tickets, KPIs and reports in real time, with the attack techniques attempted against your environment mapped to MITRE ATT&CK.
And Cockpit goes beyond monitoring: Control Posture checks every day whether your tools are working, Vortex Score gives you a rating you can defend before the board, and the CTEM cycle turns each exposure into an action with an owner and a deadline.
- Dashboards for each audience, from the board to operations
- Requests to the CDC straight from the screen, with a ticket number
- Monthly meeting presentation generated from the data
Deliverables
Security operations in the language of the business
- MITRE ATT&CK coverage TierMap shows, technique by technique, what your use cases already cover and what is still a gap, and each gap becomes detection engineering backlog.
- Exposure along the critical path Vulnerabilities and threats cross-referenced with the business impact analysis (BIA), with priorities from P0 to P4 and EPSS and KEV to address first what is most likely to be exploited.
- Use cases for your sector Threat intelligence connected to the use cases the CDC operates for each segment, such as Open Finance, Pix (Brazil’s instant payment system), digital fraud and insider threats.
- Patching and hardening with governance Maintenance windows with roles and a RACI matrix, KPIs such as patch compliance and remediation MTTR, and compliance with the CIS benchmarks.
- Monthly results in one report Endpoint, MDR and SIEM, vulnerabilities, DRP, WAF and compliance consolidated into indicators, trends and an action plan with deadlines.
- Service management A designated service manager, a monthly meeting with KPIs and recommendations, and the Vortex Service Portal integrated with your ITSM, in both directions.
Contractual commitment
Reference SLA model
| Identified incident | MTTA | MTTR |
|---|---|---|
| High | 15 calendar minutes | 2 calendar hours |
| Medium | 30 calendar minutes | 8 business hours |
| Low | 1 calendar hour | 16 business hours |
| Contingency and disaster simulation | 30 business minutes | 4 calendar hours |
98% compliance target for SIEM incidents. MTTA is measured to the Vortex analyst’s first response; MTTR, to the resolved ticket. Final terms are defined in the proposal.
Defenses validated in practice
- Purple team and emulation Atomic Red Team to validate antivirus, firewalls and detection capability.
- Containment playbooks Blocking of compromised credentials, hash quarantine and time-bound IP blocking.
- Routines in the contract Annual pentest, semiannual firewall assessment and parsing of new log sources with an SLA.
- Advisory focal point A dedicated resource, including on-site allocation at the client when needed.
Certified operation
Why choose Vortex?
Security and privacy audited in our own processes: the way Vortex operates and handles client data follows international standards for information security, privacy and business continuity.
80+ active clients
1,000+ projects delivered
500,000+ assets protected
ISO/IEC 27001 Information security
ISO/IEC 27701 Data privacy
ISO 22301 Business continuity
ISG Provider Lens 2026 · Leader Next-Gen SOC/MDR Services · Midmarket
Continuity
Two active centers, no interruptions
The Cyber Defense Center operates from two facilities of the same size, in Rio de Janeiro and São Paulo, both active 24x7x365. There is no primary site and contingency site: both operate at the same time and, if one fails, the other takes over the entire operation without interrupting the service.
São Paulo Active
Rio de Janeiro Active
People who trust Vortex Security
Having Vortex as our information security partner gives us the peace of mind of knowing that, in the face of any threat, we are backed by one of the most effective and agile responses on the market. The excellence of the services provided and the team’s tireless commitment give us not only protection, but the confidence to move forward with security and strategy.
We have followed Vortex’s virtuous growth, as we were one of its first clients. This shows how much trust we have placed in its services and how well the results achieved have lived up to it.
Vortex is a genuinely close partner with an integrative approach. A company made up of people with strong technical skills, focused on the client and committed to long-term results.
Frequently asked questions
What is the Vortex Cyber Defense Center?
It is the Vortex Security NG-SOC Convergente: a SOC and MDR (managed detection and response) service that monitors, detects and responds to threats 24x7x365 in IT, OT and AI environments, with hyperautomation and dedicated specialists.
Is Vortex a leader in SOC and MDR in Brazil?
Yes. The ISG Provider Lens 2026 evaluated the main SOC and MDR providers in Brazil and positioned Vortex Security as a Leader for Next-Gen SOC/MDR Services (Midmarket) and a Market Challenger for Large Accounts. Vortex is the MSSP leader in Brazil, with 80+ active clients and 500,000+ protected assets, and the Cyber Defense Center is the most innovative approach to MDR: IT, OT and AI in the same operation, with hyperautomation and AI.
What is the difference between SOC, MDR and MSSP?
A SOC (Security Operations Center) is the operation that monitors the environment and detects, analyzes and responds to security incidents. MDR (Managed Detection and Response) is detection and response delivered as a managed service: the provider runs this function 24x7, with technology, specialists and response to threats, not just alert forwarding. An MSSP (Managed Security Services Provider) is a provider of managed security services that, beyond the SOC, implements, integrates and manages the client’s security technologies. Vortex does all three: the Cyber Defense Center is the Vortex SOC and MDR, and Security Integration handles the implementation, integration and management of the technologies.
How is artificial intelligence used in the Vortex SOC?
AI triages alerts and filters out false positives before the analyst, and AI agents handle detection engineering, threat hunting, malware analysis and automated remediation before the human team needs to step in. Generative AI features summarize cases, correlate threat intelligence, support investigation in natural language and help create and tune detection rules. The operation has 70% automation in data mining and less than 4% false positives. Only what requires human judgment reaches the analysts, already with context, and there is human oversight at every critical point: automatic containment follows playbooks approved by the client, and what can be remediated automatically is defined together with the company.
What is the response time of the Vortex SOC?
Vortex has the fastest response time in the market. In the Cyber Defense Center reference SLA model, a high-severity incident has an MTTA of 15 minutes, measured to the Vortex analyst’s first response, and an MTTR of 2 calendar hours, measured to the resolved ticket; for medium-severity incidents, 30 minutes and 8 business hours. The compliance target is 98% for SIEM incidents, and final terms are defined in the proposal. In the words of Josemar Fernandes, Information Security Manager at Bio-Manguinhos, having Vortex means being backed by “one of the most effective and agile responses on the market”.
Do I need to replace my SIEM to hire the service?
No. The Cyber Defense Center operates Google SecOps or the SIEM the company already has, such as Splunk, QRadar and RSA. The service is SIEM- and vendor-agnostic, and SOAR coordinates the response end to end.
Does the Cyber Defense Center monitor industrial (OT) environments?
Yes. Vortex pioneered the Converged IT and OT SOC. The CDC has dedicated OT cells, with analysts trained in industrial security and playbooks that respect the plant’s operational constraints, and experience in energy, manufacturing, port logistics, sanitation, and oil and gas.
How does incident response work?
It follows the NIST phases, with the same process for IT, OT and AI: preparation, detection and analysis, containment, remediation and post-incident. Containment can be carried out directly on the managed technologies or automated by SOAR, and incidents involving several teams get a virtual war room, available 24 hours a day.
How does the company follow the Cyber Defense Center’s work?
Through Vortex Cockpit, which shows the same alerts that reach the CDC team, with incidents, tickets, KPIs and reports in real time. There is also a designated service manager, a monthly meeting with KPIs and the Vortex Service Portal integrated with the client’s ITSM.
What happens if an operations center becomes unavailable?
The CDC operates from two active centers, in Rio de Janeiro and São Paulo, with no primary and contingency site: if one fails, the other takes over the entire operation. The infrastructure is replicated in data centers in Brazil and the US.
Ready to respond at the attacker’s pace?
Talk to an expert and see how the Cyber Defense Center can protect IT, OT and AI at your company, making use of the tools you already have.
- Free diagnostic
- Fast response
- Personalized service
Updated on