What a 24/7 NOC Actually Monitors — and What It Doesn't

Liam Roy — Sun, 15 Nov 2026 19:07:26 +0000

If you run a 30–80-person company, someone has probably tried to sell you "24/7 monitoring." It sounds like a person watching your network around the clock. Sometimes it is. Often it isn't — it's a dashboard that emails someone the next morning.

I work at Amen Security, a Winnipeg MSP that runs monitoring for small and mid-sized companies. This is the honest version of what a NOC (network operations centre) watches, what it can't watch, and the questions worth asking before you pay for it.

What a NOC actually monitors

1. Is it up?
The basics: servers, firewalls, switches, internet links, and key services (email, file shares, line-of-business apps). A ping or health check every minute or two. If something stops answering, an alert fires. This is the least glamorous part and the most valuable — most outages are found this way, not by a user phoning in.

2. Is it about to break?
Disk filling up, memory exhausted, a UPS battery degrading, a backup job that ran long or failed outright. Good monitoring watches trends, not just thresholds: a disk growing 2% a week will be full in a month, and that's a ticket today, not an outage later.

3. Is something behaving strangely?
A login at 3 a.m. from a country nobody on your team is in. A server suddenly talking to an address it has never contacted. A mailbox rule created that forwards everything externally. These are the signals that matter most — and the ones a threshold alert will never catch on its own. They need someone who knows what "normal" looks like for your company.

4. Are the safety nets intact?
Backups completed — and, more importantly, restorable. Patch levels current. Antivirus/EDR agents actually reporting in, not silently uninstalled or expired. Certificates not about to expire. The unglamorous checks are the ones that decide whether a bad day becomes a disaster.

What it doesn't monitor

It doesn't read your employees' minds — or their inboxes. A NOC sees that email is flowing; it doesn't know that the "invoice" your accounts person just opened was a phishing lure until the EDR or the user reports it. User awareness is still a layer no dashboard replaces.

It doesn't fix your business processes. Monitoring will tell you the CRM is down. It won't tell you that half the sales team has been working around a broken workflow for six months. It measures systems, not whether the systems serve the work.

It doesn't see inside encrypted traffic it has no business seeing. A NOC that promises to inspect everything is either breaking your privacy or overselling. The right scope is metadata and behaviour — what's connecting, how much, how often — not the contents of your team's work.

It doesn't prevent everything. Monitoring shortens the time between "something broke" and "someone is fixing it." It does not make hardware immortal or attackers polite. Anyone selling zero downtime is selling a feeling, not a service.

What to ask before you buy it

Who answers the alert at 2 a.m., and how fast? A dashboard that pages a human is different from one that sends an email nobody reads until 9 a.m. Ask for the actual response times in writing.
What's excluded? Printers, personal devices, that one server under someone's desk — the exclusions list is where surprises live.
How do you know the backup works? "Backup completed successfully" is not proof. A restore test is. Ask how often restores are tested and whether you get the report.
What does an alert look like to me? You should get a plain-language summary, not a raw log dump. If you can't understand the report, you can't judge the service.
What happens when you find something? Monitoring without a defined response — who calls whom, who can approve a shutdown, who talks to your team — is just a more expensive way to watch things break.

The short version

A real NOC watches uptime, capacity trends, strange behaviour, and the safety nets — and it has a human who acts on what it sees. It doesn't watch your people, fix your processes, or promise nothing will ever break. If a provider can't tell you plainly what they monitor, what they don't, and who responds at 2 a.m., you're not buying monitoring. You're buying the word "monitoring."

I'm Liam Roy, CMO at Amen Security — managed IT and web/app development for 30–80-person companies in Winnipeg and across Canada and the US. We start every engagement with a free assessment: we look, report what we find, and only then talk about a contract. https://amensecurity.ca

DEV Community: Liam Roy

What a 24/7 NOC Actually Monitors — and What It Doesn't

What a NOC actually monitors

What it doesn't monitor

What to ask before you buy it

The short version