What percentage of tickets originate from proactive monitoring versus user-reported issues?
A mature provider should generate more internal alerts than it receives from frustrated employees.
How fast do you acknowledge and escalate critical alerts?
Look for response times measured in minutes, not hours.
Do you automate patching for both operating systems and third-party apps?
Gaps in non-Microsoft or non-Apple software are common breach vectors.
Which EDR platform do you deploy, and who handles incident response?
Verify that containment actions (quarantine, rollback) are included, not just alerting.
How often do you test backups and provide proof?
Quarterly restore tests with documented results should be standard.
Can you supply the documentation required for my cyber-insurance renewal?
If the provider can’t produce logs, screenshots, and policy statements on demand, insurers may question your risk posture.
Clear answers to these questions will reveal whether a vendor truly practices proactive support or merely rebrands reactive services.