What to write into a threat-monitoring contract
A threat-monitoring contract rests on the asset list, the alert channel and who may stop the site. Without that, the subscription turns into a chat.
A subscription breaks on a sentence, not on technology: "we thought you were watching that domain too". At night that is no longer an argument. It is a lost hour. A threat-monitoring contract is better read as a list of decisions you do not want to make at two in the morning. This is not a legal opinion and not a template for every court. It is what nobody can carry out if it stays unwritten.
Five lines worth seeing before payment
- The names of domains and services. Anything absent from the list is not watched.
- Where to write and who confirms they read it. A shared inbox opened in the morning does not count as a night channel.
- What is a reason to write at once: the site does not answer, the page changed, the certificate is about to lapse.
- Who may allow the site to be taken offline. The watch does not press that button by itself.
- What the subscription is not: not a pentest, not an audit and not a compliance certificate.
Once a message has already arrived, carrying out that list is described separately: a night alert. The service itself sits on the monitoring page.
Related Lexora services
The list can be assembled before the contract
We can walk the domains and the night contact so the subscription does not keep an "and everything else".