BT launches Microsoft Sentinel managed security service

BT has launched a managed security operations service built around Microsoft Sentinel, extending its partnership with Microsoft to provide UK businesses and public-sector organisations with continuous cybersecurity monitoring and threat investigation.

The Security Operations Centre-as-a-Service offering, announced on 13 October, combines Microsoft’s security information and event management technology with BT’s operational capabilities, network intelligence and specialist security teams. It is intended to support organisations that need continuous monitoring without building or maintaining every element of a security operations centre internally.

Microsoft Sentinel collects and analyses security information from connected systems, applications and services. Such platforms can identify suspicious activity by bringing together events that may appear unrelated when examined individually, allowing investigators to assess whether they represent part of a wider security incident.

BT’s managed service adds personnel and operational processes responsible for reviewing the information, investigating potential threats and supporting customer responses. The combination is intended to reduce the demands placed on internal security teams while providing access to additional monitoring expertise.

Maintaining an effective security operations centre requires more than acquiring software. Organisations need staff able to interpret alerts, understand their technology environments, assess the severity of incidents and coordinate the actions necessary to contain an attack.

These requirements can be particularly demanding where monitoring must continue throughout the night, over weekends and across several different business systems. Managed services offer one way to supplement internal resources, although the responsibilities retained by the customer depend on the contract and operating arrangements.

BT says the new offering uses intelligence from its existing network and security operations to improve the identification of malicious activity. The company has not disclosed detailed service pricing or independently measured outcomes from customer deployments in its announcement.

The launch comes as organisations face increasingly complex attacks involving compromised accounts, vulnerabilities in widely used software and activity distributed across cloud platforms and conventional corporate networks.

Microsoft’s 2026 Digital Defense Report describes a security environment in which attackers are using artificial intelligence to accelerate activities including reconnaissance, vulnerability discovery, phishing and malware development.

The company reports that the median time between discovering a vulnerability in the wild and its weaponisation has fallen to well below 24 hours. Microsoft has not provided sufficient underlying methodological detail for that particular measurement to establish its applicability across all vulnerabilities or organisations.

Nevertheless, rapid exploitation presents operational difficulties where companies have extensive technology estates and complex approval processes for software updates. Identifying an exposed system is only the first stage of remediation, which may also require testing, maintenance windows and coordination with business operations.

Continuous monitoring can complement preventive controls by identifying suspicious behaviour after an attacker obtains access. A compromised account may initially appear to be conducting legitimate activity, while unusual data access, unexpected system changes or connections to unfamiliar infrastructure may reveal that further investigation is needed.

Combining security information across multiple systems can help analysts understand the sequence of an incident and identify the assets involved. The effectiveness of that approach depends on accurate data collection, appropriate alert rules and the availability of personnel who understand the organisation’s systems.

Outsourcing monitoring also creates questions about responsibility. Businesses need to establish who can authorise containment actions, how incidents are escalated and what information the provider can access. Data handling, audit records and contractual service levels remain important, particularly in regulated industries.

The division of work between internal teams and a managed provider can influence response times. A supplier may identify suspicious activity, but the customer may still need to approve changes affecting production systems, employee accounts or critical services.

BT’s existing relationship with Microsoft spans enterprise technology, cloud and security services. The latest launch extends that cooperation through an operating model combining Microsoft software with BT’s managed capabilities.

For customers, the value of the service will depend on its integration with existing systems, the quality of investigations and the effectiveness of responses when incidents occur. The launch establishes a new managed offering, while its operational performance will need to be assessed through customer deployments and measurable service outcomes.