By the Always Beyond Team
Always Beyond is a Calgary-based, employee-owned managed IT services provider for growing businesses across Alberta.
Last updated: October 2026
It is 2:14 a.m. on a Saturday. Somewhere in your company’s systems, an account that normally logs in from the office is signing in from another country, creating mail forwarding rules, and quietly downloading files. Your security software notices. It does exactly what it was configured to do: it sends an email. That email lands in a shared inbox called something like alerts@, which nobody has opened since the person who set it up left the company.
I bring this up because “we have monitoring” is one of the most reassuring and least examined sentences in small business IT. Request proposals from cyber security companies in Calgary, or from firms in Ohio or Oregon, and the word “monitoring” will be on every one of them. Before you sign, the useful question is not whether something is watching. It is whether a human being is going to do anything about what it sees before Monday.
Detection is not the same as response
A lot of tools are very good at noticing things. That part has become almost cheap. The expensive part, the part that actually decides whether a bad night becomes a bad month, is what happens in the minutes after the alert fires.
Think of it like a smoke detector. A detector that beeps in an empty building is technically working. It is also not helping. The value of an alarm comes from the person who hears it and picks up the phone.
Alerts sent to an inbox are a smoke detector in an empty building. They create a lovely audit trail. After an incident, you can usually go back and find the exact moment the system knew something was wrong. That is a strange kind of comfort: proof that you were warned, delivered to a place nobody was looking.
The overnight gap is not an accident
Attackers are not unaware of business hours. If someone gets hold of a password on a Thursday, there are good reasons to wait until the weekend to use it. Fewer people are online. Nobody notices that their mailbox is behaving oddly. By the time someone in accounting says “hey, did anyone else get a weird email from me?” on Monday morning, the damage has had two full days to spread.
None of this requires a sophisticated adversary. It only requires patience and a calendar.
What real 24/7 coverage actually means
The phrase “24/7” gets stretched in sales conversations, so it is worth pinning down. Here is the difference as plainly as I can put it:
| Alerts to an inbox | Watched around the clock |
| Tool flags suspicious sign-in at 2 a.m. | Tool flags suspicious sign-in at 2 a.m. |
| Email waits until someone reads it | A person reviews it in minutes |
| Account keeps working all weekend | Account is disabled or session is cut off |
| Discovery on Monday, cleanup for weeks | A phone call Saturday morning explaining what happened |
The left column is not negligence, exactly. It is usually a tool someone set up in good faith and then stopped thinking about.
Questions worth asking before you sign anything
If you are evaluating a provider, skip the brochure and ask about a specific night. What happens if a suspicious login is detected at 3 a.m. on a holiday? Who sees it? Do they have the authority to lock the account, or do they need to wake you up first? If they need you, how do they reach you, and what happens if you do not answer?
Also ask what you get told afterward. A good provider explains what they saw, what they did, and what they recommend changing so it does not happen again. A weak one sends a monthly report full of charts showing a large number of “events,” which tells you very little about whether anyone acted on them.
And ask who tunes the alerts. A system that fires on everything trains people to ignore it, which is how the alerts@ inbox got abandoned in the first place.
The cheap test you can run this week
Find out where your current security alerts actually go. Not where they are supposed to go, where they go. Log in to that inbox or dashboard and look at the last month. If the most recent alert has been sitting unread for two weeks, you already have your answer about overnight coverage, and it did not cost you a sales meeting to get it.