HYPR Guard Enterprise service description

This Service Description defines the standard content and delivery model of HYPR Guard Enterprise. It applies where the Order Form identifies HYPR Guard with the Enterprise Protection Boundary. The HYPR Guard Service Agreement governs Protected Assets, Resource Classes, Credit-consumption mechanics, response authority and other service-family mechanics for the ordered Service.

1 Service purpose

1.1 Enterprise model. HYPR Guard Enterprise is the connected-enterprise Protection Boundary. It extends protection across active Protected Assets, people, identities and relevant security domains to support cross-domain detection, attack-chain understanding, threat hunting and coordinated response.

1.2 Service principle. HYPR Guard is technology-enabled and not technology-defined. The Service may use relevant Customer, Observata and third-party security technologies, but no individual platform, product or integration constitutes HYPR Guard by itself.

1.3 Responsibility principle. Observata owns delivery of HYPR Guard within the agreed Protection Scope and delegated authority. Customer retains enterprise security accountability, including risk ownership, strategic security policy, regulatory accountability and ultimate enterprise authority.

2 Standard service content

2.1 Continuous monitoring. Central Operations continuously monitors relevant signals across the active Protected Assets, associated identities and the security domains included in the agreed connected-enterprise scope.

2.2 Cross-domain detection and triage. Observata applies and maintains reasonable detection and correlation practices across asset, identity and security-domain signals to identify activity that may only become significant when viewed across multiple parts of the environment.

2.3 Attack-chain investigation. Observata investigates relevant Security Events and Security Incidents using cross-domain context to understand relationships, sequence, likely attack path, affected services and potential business impact where the available evidence supports that analysis.

2.4 Threat intelligence. Observata may use relevant threat intelligence across the connected-enterprise context to support detection, prioritisation, investigation, hunting and improvement.

2.5 Threat hunting. HYPR Guard Enterprise includes proactive threat-hunting activities across the active Protection Scope and relevant security domains, including cross-domain hypotheses and attack-chain-oriented analysis where supported by available telemetry.

2.6 Coordinated response. Observata coordinates response across multiple relevant domains and technologies and, where authorised, may perform agreed containment actions through the applicable controls and integrations.

2.7 Detection and coverage engineering. Observata may develop and tune reasonable cross-domain detections, correlations, enrichment, operational procedures and coverage patterns needed to sustain the Enterprise Protection Boundary.

2.8 Continuous improvement. Observata uses incident evidence, threat developments, hunting results and changes in the connected environment to improve coverage, detections, procedures, correlations and response readiness.

2.9 Evidence and reporting. Observata maintains reasonable evidence and reporting across the connected Protection Scope, including coverage, cross-domain signals, investigation, response, improvement and verified change.

3 Protection Boundary

3.1 Connected enterprise. Enterprise extends HYPR Guard protection across relationships and activity spanning Protected Assets, people, identities and the relevant security domains included in the agreed Protection Scope.

3.2 Cross-domain context. The Service is designed to correlate and investigate activity across multiple domains to support attack-chain understanding, broader impact assessment and coordinated response.

3.3 Coverage. Actual Enterprise coverage depends on the Protected Assets, relevant identity and security-domain sources, available telemetry, integrations, Operational Requirements and agreed exclusions. Enterprise does not imply that every possible source or control in the organisation is integrated.

3.4 Boundary governance. Enterprise includes the asset and people-and-identity perspectives and adds connected-enterprise correlation and coordinated response. Its broader Protection Boundary does not remove the need to agree specific scope, telemetry, integrations and authority.

4 Continuous security operations

4.1 Operating lifecycle. HYPR Guard operates through Protect → Detect → Understand → Respond → Learn → Improve. The lifecycle is continuous and is used to maintain and strengthen the Service as assets, identities, threats and dependencies change.

4.2 Central Operations. Central Operations provides the operational security capability for the Service, including continuous monitoring, detection, triage, investigation, escalation, threat intelligence, threat hunting, tuning and authorised response activities within the applicable Protection Boundary.

4.3 Service-generated events. Security Events identified by HYPR Guard monitoring do not require a Customer Support Request before operational triage begins. Relevant detected activity is assessed and handled in accordance with the Protection Scope, Operational Requirements and applicable Response Authority Record.

4.4 Escalation. Observata escalates material Security Incidents using the contacts, procedures and decision paths established for the Customer. Escalation may involve Customer representatives, Observata specialists or relevant Third-Party Services.

4.5 Operational continuity. Observata uses reasonable operational processes to maintain continuity of Central Operations and to manage handover, escalation and specialist engagement across the 24/7 service window.

5 Local Security Advisor and governance

5.1 Local Security Advisor. A Local Security Advisor or equivalent Observata service lead coordinates Customer context, governance, priorities, service ownership, improvement planning, service evolution and relevant specialist coordination.

5.2 Service reviews. The parties will conduct recurring service reviews at a reasonable cadence. Reviews may cover Protection Scope, coverage, material events and incidents, trends, risks, response authority, improvement actions, Credit consumption and planned changes.

5.3 Protection Scope governance. Observata and Customer maintain a shared view of active Protected Assets, relevant dependencies, coverage, contacts and agreed exclusions. Changes are handled through the operational and commercial processes defined in the HYPR Guard Service Agreement.

5.4 Improvement roadmap. Observata maintains a practical improvement view for the Service, using operational evidence and Customer priorities to identify reasonable changes to coverage, detections, procedures, integrations and service maturity.

6 Investigation and response

6.1 Governed response. Response activities are performed only within explicitly delegated and governed authority. HYPR Guard does not give Observata unrestricted authority over Customer systems or enterprise security decisions.

6.2 Response modes. Depending on the applicable Response Authority Record, Observata may Observe, Investigate, Recommend, Contain with approval or perform specifically Pre-authorised containment.

6.3 Containment. Containment actions may include measures such as isolating an endpoint, disabling an account, blocking traffic, quarantining a resource or changing a security control where the required authority, technical capability and agreed conditions exist.

6.4 Customer decisions. Customer remains responsible for material business-impact decisions, risk acceptance, legal or regulatory decisions and actions outside Observata's delegated operating authority.

6.5 Automation. Automation and AI may support analysis, prioritisation and operational speed. Any automated response action remains subject to the same agreed authority, restrictions and accountability as a human-executed action.

7 Service levels and coverage

7.1 Continuous operations coverage. Central Operations provides HYPR Guard monitoring, detection, security-event triage and incident-handling coverage 24 hours per day, 7 days per week, 365 days per year for the active Protection Scope.

7.2 Technical Support. Technical Support is available 24/7/365 in accordance with the Support and Operational Services Policy, including the applicable severity classification and Target Initial Response commitments for properly logged Customer Support Requests.

7.3 Operational Support. Local Security Advisor, service governance, planned improvement and other non-incident Operational Support activities are provided during Business Hours applicable to the Customer region unless the Order Form expressly states another coverage window.

7.4 No resolution guarantee. Continuous operations coverage and Target Initial Response commitments are commitments to availability of the relevant function, engagement and operational handling. They are not guarantees of prevention, containment, restoration, eradication, recovery or permanent resolution.

7.5 Availability boundary. HYPR Guard does not by itself create an availability or performance commitment for Customer-controlled security technologies, infrastructure, applications, networks or other systems. Any separate availability commitment must be expressly stated in the applicable Order Form or another governing Service document.

8 Customer responsibilities

8.1 Access and cooperation. Customer will provide timely access, information, permissions, logs, contacts, approvals and technical prerequisites reasonably required to establish and deliver HYPR Guard.

8.2 Enterprise accountability. Customer retains overall security risk ownership, strategic security policy, regulatory accountability, business-continuity decisions and ultimate enterprise authority.

8.3 Customer-controlled systems. Customer remains responsible for the operation, availability, maintenance and security of Customer-controlled systems and technologies except to the extent an applicable document expressly assigns a responsibility to Observata.

8.4 Accurate service information. Customer will reasonably cooperate in maintaining accurate information about Protected Assets, dependencies, contacts, operational restrictions and material environmental changes that may affect protection or response.

8.5 Authorised representatives. Customer will maintain representatives authorised to receive incident communications, approve response actions where required and make other operational decisions necessary for the Service.

9 Service boundaries

9.1 No absolute security guarantee. HYPR Guard does not guarantee prevention of breaches, elimination of cyber risk, detection of every threat or successful containment of every Security Incident.

9.2 Technology boundary. HYPR Guard is not an EDR service, SIEM service, Elastic Security product or other single-technology service, even where such technologies contribute to delivery.

9.3 Existing capabilities. HYPR Guard may work with and complement Customer security teams, SOC or MDR providers and existing technologies. It does not require replacement of those capabilities unless the parties expressly agree a transition.

9.4 Integration boundary. Available telemetry, control functions, correlation and response capability depend on the relevant technology and Customer environment. The Service does not promise universal integration, complete telemetry or control capability for every Protected Asset.

9.5 Bespoke work. Materially bespoke integrations, large-scale migrations, custom software development or work outside the standard Continuous Cyber Defense delivery model may require a Project Specification, additional commercial entitlement or another agreed service or commercial arrangement.

9.6 HYPR SecOps. HYPR SecOps is outside the scope of this Service Description. Nothing in this Service Description incorporates, retires, replaces or predicts any HYPR SecOps service.

10 Document governance

10.1 Relationship to other documents. The Governing Agreement controls general legal matters; the Order Form controls transaction-specific commercial terms and expressly agreed Customer-specific parameters; the HYPR Guard Service Agreement controls Guard service-family, Protection Boundary, Credit-consumption and response-authority mechanics; this Service Description controls the standard HYPR Guard Enterprise delivery model; and the Support and Operational Services Policy controls reusable support mechanics.

10.2 Version governance. A later version of this Service Description applies only to a new Order, Renewal Term or express amendment under the Governing Agreement. The current version continues during an active fixed term.

10.3 Published version. The current standard version is made available through Observata's Legal Center. Historical versions remain retrievable where required for active Customer terms.