Managed user security

Yes. ARC operates a co-managed model with a documented RACI. Your MSP continues to manage your infrastructure; ARC’s managed user security covers the user security layer, including user access, access control, and user access management where agreed. The two roles are distinct, documented, and non-overlapping. It’s also best practice to have an independent overview of security, so the same company isn’t effectively “marking their own homework” – ARC provides that additional layer of oversight and accountability.

Microsoft provides a strong platform and security tooling. ARC’s managed user security builds on that with around 20% more feature coverage than the Microsoft equivalent, at a fraction of the cost, with ARC managing it for you. You get monitoring, tuning, triage, clear recommendations and an independent backup and recovery path without adding complexity for your team.

ARC’s SOC operates 24/7 as part of our security operations centre and wider security operations. If something looks suspicious, we triage it and tell you  what to do next in plain English – what we’ve seen, what it could mean, and the safest next step.

Where it’s appropriate and pre-approved, we can also automate containment to reduce risk quickly (for example: isolating a user account, forcing a password reset, or isolating a device) as soon as indicators of compromise are detected. This helps reduce unauthorized access, limit malicious activity, and protect against data breaches. You’ll still get a clear summary of what happened and what user actions were taken.

Severity 1 (active compromise or ransomware): 2-hour response target. Severity 2 (malware, privilege escalation): 4 hours. Severity 3 (suspicious behavior): 1 business day. 95% of incidents are responded to within target – tracked quarterly.

Many modern incidents are malware-free and rely on stolen credentials, mailbox rules, OAuth app abuse and legitimate admin tools. In plain English: attackers often use real usernames and passwords rather than forcing their way in. That's why ARC’s managed user security focuses focuses on the user layer – monitoring suspicious sign-ins, protecting Microsoft 365, flagging compromised credentials, reducing credential theft, and helping staff recognise phishing attacks before they become an incident. We also help review user permissions, access rights, and user roles so people have the minimum access they need.

A common misconception is assuming that because emails and files live in Microsoft 365, they are permanently backed up and safe forever. Unfortunately, there is a catch: industry data shows the average cyber incident isn’t discovered for 211 days, while Microsoft’s standard service may delete removed data after 90 days. ARC’s independent backup helps remove this blind spot – backing up key M365 services up to three times a day in an independent location, with point-in-time restore and backups retained for as long as you have the service, supporting data protection and reducing the risk of data breaches.

By default, ARC operates a co-managed, advisory model – we detect, alert, and recommend. We do not seek to manage your day-to-day infrastructure. Your team (or your MSP) implements changes, and you retain change control. Optional containment actions can be discussed and are only activated with explicit authorisation, especially where user permissions, secure access, or user management changes are involved.

Remediation and recovery work, endpoint security – covered by ARC Managed Endpoint Total Security – configuration changes, vulnerability management, vulnerability scanning, penetration testing, and on-site services are outside scope of managed user security. If you'd like to talk through what's included, what sits outside the service, and which security services, security monitoring, security tools, or threat monitoring you need, we'll cover that clearly on the discovery call.