Overnight Cloud Incident Response
Your 24/7 promise, kept, without a night shift.
Experienced AWS engineers on your overnight pager. Critical availability and security alerts are acknowledged and worked within an hour.
- 1 hour response deadline on Critical alerts
- 8pm–8am in your time zone, every night, holidays included
The overnight pager is a people problem.
Your best people carry it
Founders and senior engineers take the pager week after week. The work they were hired to do slips, and sleep goes with it.
Night hires don't last
Each departure means another search, a new hire to train, and a gap in coverage while you wait.
Your customers were promised 24/7
The contract says round-the-clock. A Critical alert at 3am still needs a named engineer who answers it.
What we respond to
We respond to the Critical alerts your own tools send. Two kinds.
Availability
- Outages
- Failed deployments
- Resource exhaustion
- Database and networking failures
Security
- High-severity findings from tools like GuardDuty or Security Hub
- Suspicious IAM activity
- Exposed credentials
- WAF and DDoS alerts
First response and containment per your runbook (for example: revoke a key, isolate an instance, block an IP), then escalation to your incident lead.
What this is not
Not a SOC or NOC. We don't watch dashboards or hunt for threats. When your tooling pages a Critical alert, an engineer works it within an hour and leaves a written summary by morning.
- No overnight ticket-queue work
- No shift reports for nights with no incidents
- No forensics or breach determination
How it works
Coverage window
8pm–8am in your time zone, every night, holidays included.
Need coverage to start when your team signs off? We can start earlier.
The escalation chain
- 0 minOn-call engineer paged
- 30 minWhole roster paged
- 45 minTCG leadership paged
- 60 minResponse deadline
How alerts reach us
By webhook, email or a forwarded phone queue. We run the paging at our cost.
What you get by morning
A written incident summary in your ticketing system, with every page timestamped.
- Alert
- GuardDuty, high severity: access key used from an unrecognized network
- Timeline
- 02:14 paged · 02:21 acknowledged · 02:26 key disabled per runbook step 3 · 02:40 incident lead notified
- Status
- Contained. Key disabled; no other changes made.
- Needs your decision
- Key rotation and whether to investigate further. Forensics and breach determination are outside our scope.
Sample only. Invented for illustration; not a real incident.
Runs under your name
Engineers respond under your MSP's name and follow your runbooks. Your customers see your team, your process and your ticketing system.
Three plans
Plans from $13,500/month on an annual agreement.
Every plan includes overnight on-call response to Critical alerts, the escalation chain and the written incident summary. The plans differ in the rows below.
Core
- Proactive hours per month
- 0
- Included incident hours per year
- 0
- Monthly report
- Not included
- Alert tuning and runbook work
- Not included
Standard
- Proactive hours per month
- 4
- Included incident hours per year
- 10
- Monthly report
- Included
- Alert tuning and runbook work
- Not included
Plus
- Proactive hours per month
- 10
- Included incident hours per year
- 10
- Monthly report
- Included
- Alert tuning and runbook work
- Included
Cost versus hiring
About a quarter less than hiring two engineers to cover your nights. Enter your own numbers to see what it costs to cover the overnight window yourself, next to That Cloud Group Standard.
Salary and benefits –
Recruiting to replace departures –
Total, per month –
Hiring cost counts salary with benefits load, plus recruiting cost for each expected departure. It leaves out equipment, management time and paid-time-off backfill, so real hiring cost is higher. Your numbers stay in your browser.
Onboarding and pilot
About 3 weeks
To go live. We connect your alert routing, set up access through your SSO and load your runbooks.
90-day pilot
Real pages, real summaries, at the pilot price.
Then annual
An annual agreement at the annual price.
Questions
We'll handle it internally.
You can. The question is who answers at 3am, every night including holidays, and what that costs you in salary, turnover and senior-engineer time. The calculator above puts numbers on hiring. The 90-day pilot lets you compare it with real pages.
I don't want outsiders in our customers' environments.
Engineers work only through your SSO with MFA, in roles you define and can revoke. You decide what they can reach, and you can take it away.
Our customers can't know we outsource.
They won't. This is white-label: engineers respond under your name and follow your runbooks.
We need someone watching alerts all night.
That's a staffed NOC, at a much higher price. We cover Critical response: when your tooling pages, an engineer works it within an hour.
What if your engineer doesn't answer?
The page escalates on a clock. At 30 minutes the whole roster is paged. At 45 minutes TCG leadership is paged. The response deadline is 60 minutes.
Are you SOC 2 certified?
Not today. Engineers work only inside your SSO, MFA and roles, so the audit trail stays in your systems.
THAT CLOUD GROUP
Put an engineer on your overnight pager.
Twenty minutes is enough to tell you whether this fits.