24/7 outsourced detection and triage. Useful when staffing a SOC isn't realistic, dangerous when it replaces internal IR ownership.