HYPR Guard Core service description

This Service Description defines the standard content and delivery model of HYPR Guard Core. It applies where the Order Form identifies HYPR Guard with the Core Protection Boundary. The HYPR Guard Service Agreement governs Protected Assets, Resource Classes, Credit-consumption mechanics, response authority and other service-family mechanics for the ordered Service.

1 Service purpose

1.1 Core model. HYPR Guard Core is the asset-centric Protection Boundary. It provides continuous security operations around the digital resources the organisation depends on, with detection, investigation, threat hunting, governed response and continuous improvement focused on the active Protected Assets.

1.2 Service principle. HYPR Guard is technology-enabled and not technology-defined. The Service may use relevant Customer, Observata and third-party security technologies, but no individual platform, product or integration constitutes HYPR Guard by itself.

1.3 Responsibility principle. Observata owns delivery of HYPR Guard within the agreed Protection Scope and delegated authority. Customer retains enterprise security accountability, including risk ownership, strategic security policy, regulatory accountability and ultimate enterprise authority.

2 Standard service content

2.1 Continuous monitoring. Central Operations continuously monitors relevant signals available from active Protected Assets and applies security-event triage to identify activity that merits further analysis or investigation.

2.2 Detection and triage. Observata applies and maintains reasonable asset-centric detection practices, correlation, contextual analysis and triage appropriate to the active Protection Scope and available telemetry.

2.3 Investigation. Observata investigates relevant Security Events and Security Incidents affecting or materially related to Protected Assets using available security and operational context.

2.4 Threat intelligence. Observata may use relevant threat intelligence to support asset-focused detection, investigation, prioritisation and improvement activities.

2.5 Threat hunting. HYPR Guard Core includes proactive threat-hunting activities directed at the active Protected Assets and their relevant security context. Hunting depth, hypotheses, data availability and frequency are determined by available telemetry, current risk context and reasonable operational priorities.

2.6 Response coordination. Observata coordinates response actions relating to Protected Assets and, where authorised, may perform containment or other response activities in accordance with the applicable Response Authority Record.

2.7 Tuning and improvement. Observata may tune detections, coverage, integrations, procedures and operational priorities based on service evidence, lessons learned, threat developments and changes affecting the Protected Assets.

2.8 Evidence and reporting. Observata maintains reasonable evidence and reporting around the active Protection Scope, coverage, relevant signals, investigation, response, improvement and verified change.

3 Protection Boundary

3.1 Assets. Core establishes the Protection Boundary around the agreed Protected Assets. The primary security lens is the protected digital resource itself.

3.2 Context. Observata may use identities, infrastructure relationships, operational data and other context reasonably required to understand activity affecting Protected Assets, but Core does not by itself extend the Protection Scope to a dedicated people-and-identity protection model.

3.3 Coverage. Actual Core coverage depends on the Protected Assets, available telemetry, relevant integrations, Operational Requirements and agreed exclusions.

3.4 Boundary governance. Core is the asset-centric Guard Protection Boundary. A requirement for dedicated people-and-identity protection or cross-domain connected-enterprise protection requires Workforce or Enterprise respectively.

4 Continuous security operations

4.1 Operating lifecycle. HYPR Guard operates through Protect → Detect → Understand → Respond → Learn → Improve. The lifecycle is continuous and is used to maintain and strengthen the Service as assets, identities, threats and dependencies change.

4.2 Central Operations. Central Operations provides the operational security capability for the Service, including continuous monitoring, detection, triage, investigation, escalation, threat intelligence, threat hunting, tuning and authorised response activities within the applicable Protection Boundary.

4.3 Service-generated events. Security Events identified by HYPR Guard monitoring do not require a Customer Support Request before operational triage begins. Relevant detected activity is assessed and handled in accordance with the Protection Scope, Operational Requirements and applicable Response Authority Record.

4.4 Escalation. Observata escalates material Security Incidents using the contacts, procedures and decision paths established for the Customer. Escalation may involve Customer representatives, Observata specialists or relevant Third-Party Services.

4.5 Operational continuity. Observata uses reasonable operational processes to maintain continuity of Central Operations and to manage handover, escalation and specialist engagement across the 24/7 service window.

5 Local Security Advisor and governance

5.1 Local Security Advisor. A Local Security Advisor or equivalent Observata service lead coordinates Customer context, governance, priorities, service ownership, improvement planning, service evolution and relevant specialist coordination.

5.2 Service reviews. The parties will conduct recurring service reviews at a reasonable cadence. Reviews may cover Protection Scope, coverage, material events and incidents, trends, risks, response authority, improvement actions, Credit consumption and planned changes.

5.3 Protection Scope governance. Observata and Customer maintain a shared view of active Protected Assets, relevant dependencies, coverage, contacts and agreed exclusions. Changes are handled through the operational and commercial processes defined in the HYPR Guard Service Agreement.

5.4 Improvement roadmap. Observata maintains a practical improvement view for the Service, using operational evidence and Customer priorities to identify reasonable changes to coverage, detections, procedures, integrations and service maturity.

6 Investigation and response

6.1 Governed response. Response activities are performed only within explicitly delegated and governed authority. HYPR Guard does not give Observata unrestricted authority over Customer systems or enterprise security decisions.

6.2 Response modes. Depending on the applicable Response Authority Record, Observata may Observe, Investigate, Recommend, Contain with approval or perform specifically Pre-authorised containment.

6.3 Containment. Containment actions may include measures such as isolating an endpoint, disabling an account, blocking traffic, quarantining a resource or changing a security control where the required authority, technical capability and agreed conditions exist.

6.4 Customer decisions. Customer remains responsible for material business-impact decisions, risk acceptance, legal or regulatory decisions and actions outside Observata's delegated operating authority.

6.5 Automation. Automation and AI may support analysis, prioritisation and operational speed. Any automated response action remains subject to the same agreed authority, restrictions and accountability as a human-executed action.

7 Service levels and coverage

7.1 Continuous operations coverage. Central Operations provides HYPR Guard monitoring, detection, security-event triage and incident-handling coverage 24 hours per day, 7 days per week, 365 days per year for the active Protection Scope.

7.2 Technical Support. Technical Support is available 24/7/365 in accordance with the Support and Operational Services Policy, including the applicable severity classification and Target Initial Response commitments for properly logged Customer Support Requests.

7.3 Operational Support. Local Security Advisor, service governance, planned improvement and other non-incident Operational Support activities are provided during Business Hours applicable to the Customer region unless the Order Form expressly states another coverage window.

7.4 No resolution guarantee. Continuous operations coverage and Target Initial Response commitments are commitments to availability of the relevant function, engagement and operational handling. They are not guarantees of prevention, containment, restoration, eradication, recovery or permanent resolution.

7.5 Availability boundary. HYPR Guard does not by itself create an availability or performance commitment for Customer-controlled security technologies, infrastructure, applications, networks or other systems. Any separate availability commitment must be expressly stated in the applicable Order Form or another governing Service document.

8 Customer responsibilities

8.1 Access and cooperation. Customer will provide timely access, information, permissions, logs, contacts, approvals and technical prerequisites reasonably required to establish and deliver HYPR Guard.

8.2 Enterprise accountability. Customer retains overall security risk ownership, strategic security policy, regulatory accountability, business-continuity decisions and ultimate enterprise authority.

8.3 Customer-controlled systems. Customer remains responsible for the operation, availability, maintenance and security of Customer-controlled systems and technologies except to the extent an applicable document expressly assigns a responsibility to Observata.

8.4 Accurate service information. Customer will reasonably cooperate in maintaining accurate information about Protected Assets, dependencies, contacts, operational restrictions and material environmental changes that may affect protection or response.

8.5 Authorised representatives. Customer will maintain representatives authorised to receive incident communications, approve response actions where required and make other operational decisions necessary for the Service.

9 Service boundaries

9.1 No absolute security guarantee. HYPR Guard does not guarantee prevention of breaches, elimination of cyber risk, detection of every threat or successful containment of every Security Incident.

9.2 Technology boundary. HYPR Guard is not an EDR service, SIEM service, Elastic Security product or other single-technology service, even where such technologies contribute to delivery.

9.3 Existing capabilities. HYPR Guard may work with and complement Customer security teams, SOC or MDR providers and existing technologies. It does not require replacement of those capabilities unless the parties expressly agree a transition.

9.4 Integration boundary. Available telemetry, control functions, correlation and response capability depend on the relevant technology and Customer environment. The Service does not promise universal integration, complete telemetry or control capability for every Protected Asset.

9.5 Bespoke work. Materially bespoke integrations, large-scale migrations, custom software development or work outside the standard Continuous Cyber Defense delivery model may require a Project Specification, additional commercial entitlement or another agreed service or commercial arrangement.

9.6 HYPR SecOps. HYPR SecOps is outside the scope of this Service Description. Nothing in this Service Description incorporates, retires, replaces or predicts any HYPR SecOps service.

10 Document governance

10.1 Relationship to other documents. The Governing Agreement controls general legal matters; the Order Form controls transaction-specific commercial terms and expressly agreed Customer-specific parameters; the HYPR Guard Service Agreement controls Guard service-family, Protection Boundary, Credit-consumption and response-authority mechanics; this Service Description controls the standard HYPR Guard Core delivery model; and the Support and Operational Services Policy controls reusable support mechanics.

10.2 Version governance. A later version of this Service Description applies only to a new Order, Renewal Term or express amendment under the Governing Agreement. The current version continues during an active fixed term.

10.3 Published version. The current standard version is made available through Observata's Legal Center. Historical versions remain retrievable where required for active Customer terms.