I completely agree that preventative/proactive measures are always going to be better than something retrospective such as my service (although I’d argue that t

I completely agree that preventative/proactive measures are always going to be better than something retrospective such as my service (although I’d argue that they complement each other nicely, of course). In terms of why a mid-sized SaaS should go this route - I would like to think that Breach Insider is a slightly more cost-effective option. To do detection and correlation properly, you’re looking at a SIEM with the right logs and hopefully some well formed rules. However at this stage, I’d argue that to get the absolute most out of this, you’re looking at supporting & monitoring this with at least one dedicated employee, else all those logs will be wasted.