Services overview
Implementation and lifecycle management. Not another licence conversation.
Partners sell and own the technology. Avertory deploys it, tunes it, and keeps it operating against the outcomes the customer bought.
Delivery infrastructure
The delivery engine behind your channel motion
We are the delivery infrastructure that lets cybersecurity channel partners sell, implement and operate SentinelOne, Orca and Qualys profitably—without hiring the specialists themselves.
Sell with confidence
Implement at scale
Operate profitably
Lifecycle
What ‘lifecycle’ means in practice
Too many security platforms are left in a default state after a hurried install. Detection quality drifts. Cloud posture findings pile up. Vulnerability scans run, but nobody owns remediation. Avertory stays on the engagement past go-live so the partner can evidence value at renewal.
- Design and deploy against a written scope, not a generic checklist.
- Integrate with the customer’s existing identity, logging, ticketing and cloud estate.
- Tune detections, policies and priorities against real environment noise.
- Run a defined operating rhythm: reviews, reporting packs, and agreed SLAs.
- Hand findings and expansion signals back to the partner, never around them.
Three service lines
Depth on three platforms
SIEM / XDR lifecycle management — SentinelOne
End-to-end deployment and operation of SentinelOne Singularity XDR/SIEM environments: agent rollout, policy, custom detections, integration and continuous fine-tuning.
Cloud security and posture management — Orca Security
Agentless onboarding across AWS, Azure and GCP. CSPM, workload protection, identity threat detection, contextual risk prioritisation and scheduled posture reviews.
Vulnerability management as a service — Qualys
Cloud Agent and scanner deployment, asset discovery, continuous assessment, risk-based prioritisation, remediation tracking and patch advisory aligned to the customer’s compliance needs.
Partner commercial pack
Packaged SKUs
Get an idea of what each product SKU offers. Reach out for more information on timelines and pricing.
SentinelOne — Singularity XDR / SIEM
| SKU | Envelope |
|---|---|
| S1-FND Foundation | Up to 1,000 endpoints. Console hardening, standard policy packs, agent rollout plan, two integrations, knowledge transfer. |
| S1-STD Standard | Up to 5,000 endpoints. Custom detection rules, identity / email / cloud connector set, role design, 10-day hypercare window. |
| S1-ENT Enterprise | Multi-site or multi-tenant estates, purple-team style detection work, SIEM use-cases, complex identity estates. |
Orca Security — agentless cloud security
| SKU | Envelope |
|---|---|
| ORC-FND Foundation | One cloud (AWS, Azure or GCP). Connectors, baseline posture, alert routing, handover. |
| ORC-STD Standard | Up to three accounts. Identity context, ticketing integration, 30-day priority plan. |
| ORC-ENT Enterprise | Multi-cloud or multi-org estates. Posture reviews sold as a retainer. |
Qualys — Vulnerability Management as a Service
| SKU | Envelope |
|---|---|
| QLY-FND Foundation | Cloud Agent design, scanner placement, asset inventory, first authenticated scan cycle, severity model, and a finding-tracking workflow for the customer’s IT owners. |
| QLY-STD Standard | Hybrid estate, custom option profiles, exception workflow, compliance-oriented evidence pack, 30-day operating cadence. |
| QLY-ENT Enterprise | Multi-entity, OT-adjacent, or heavy custom reporting. Ongoing VMaaS sold as a monthly retainer. |
Lifecycle and overflow SKUs
| SKU | Commitment | What you sell |
|---|---|---|
| LC-2 Lifecycle retainer | 2 days / month | Tuning, health checks, reporting pack you present. 10% retainer discount applied. |
| LC-4 Lifecycle retainer | 4 days / month | Operating cadence plus second-line queue. Preferred for mid-market estates. |
| HC-10 Hypercare | 10 working days | Post go-live cover. Engineer rate. Convert unused days to retainer by agreement. |
| OV-20E Overflow block | 20 hours | Prepaid Engineer hours for surge, agreed change windows and short platform tasks. 6-month validity. |
| OV-20S Overflow block | 20 hours | Prepaid Senior hours. Use where design decisions or customer-facing workshops sit with us. |
Boundaries
What we do not do
- We do not sell SentinelOne, Orca Security or Qualys licences. That commercial sits with the partner.
- We do not position against the reseller or distributor on the account.
- We do not offer generic ‘any-tool’ SOC outsourcing. Our depth is these platforms.
Offers
How partners buy delivery
Four packaged offers, each with a trigger, defined outputs and a typical duration. Partners with a live deal usually start at the readiness sprint and move into deployment.
Platform Readiness & Scope Sprint
Trigger: The customer needs an implementation answer and you need a partner-safe scope before you quote.
You get: Partner-safe scope, effort estimate, risks and a delivery window.
Duration: Short and fixed. Paid, and credited against deployment if you proceed.
Deployment & Go-Live Package
Trigger: The licence is won or imminent and the platform has to reach production.
You get: Design, rollout, integration, validation evidence, hypercare and a handover pack.
Duration: Scoped after brief, against the packaged SKUs.
Platform Health Check & Optimisation
Trigger: The platform is deployed but drifting: default policies, alert noise or incomplete coverage.
You get: Policy and coverage review, tuning, prioritised backlog, findings report and improvement plan.
Duration: Scoped after brief, sized against estate scale.
Lifecycle Operations Retainer
Trigger: You want to sell ‘keep it healthy’ as a recurring line item after go-live.
You get: Defined cadence within committed days, change control, reporting and a QBR pack.
Duration: Monthly commitment, reviewed quarterly with the partner.
Send the platform, customer scale and desired date. We return assumptions and a delivery window.
Brief a live opportunity