BT says it blocks roughly four million attempted cyber-attacks every day. That number sets the scale for the telco's next move: a Security Operations Centre-as-a-Service built on Microsoft Sentinel and aimed squarely at UK businesses.

The service, announced October 13, packages Microsoft's cloud-native SIEM with BT's threat intelligence, SOC operations and domestic security know-how. BT frames it as a response to an attack landscape that has, in the operator's reading, shifted from human-paced to machine-paced.

The timing is not accidental. Microsoft's Digital Defense Report 2026 puts the average window from vulnerability discovery to weaponisation at well below 24 hours. That compresses the playbook for any security team that still meets weekly to triage alerts.

What's actually in the box?

SOCaaS bundles Sentinel with BT's managed operations, threat intelligence, and the operator's UK cyber expertise. BT says the package cuts the integration tax customers usually pay when they stitch Sentinel to an outside MDR partner.

The claim is not novel; several UK MSSPs already wrap Sentinel. What BT is selling is adjacency: a network operator that sees attack traffic at carrier scale, plus a Microsoft relationship that predates this announcement by several product cycles.

How fast is "fast"?

The four-million-attacks-a-day figure is the comparison worth holding onto. It makes the sub-24-hour weaponisation window cited in Microsoft's own report feel less like analyst hyperbole and more like an operational reality.

Jon James, CEO of BT Business, made the commercial case: "AI is transforming the cyber threat landscape at unprecedented speed, and our customers need protection that stays one step ahead. By extending our partnership with Microsoft, we're combining cutting-edge security technology with BT's cyber expertise and threat intelligence to deliver stronger, more proactive protection."

His Microsoft counterpart, Darren Hardman, CEO of Microsoft UK & Ireland, kept the framing short: "By combining Microsoft Sentinel with BT's managed security expertise and UK cyber operations, we can help organisations simplify security, strengthen resilience and respond with greater confidence."

What's the catch?

Pricing was not disclosed. The service is positioned as UK-managed, with customer telemetry sitting in BT's domestic SOC — a non-trivial data-residency question for any buyer with cross-border obligations.

BT also calls itself one of the UK's most trusted cyber defenders and claims to protect more businesses than any other UK network. That is a marketing line, not a measured claim, and worth treating as one.

What's next?

BT says SOCaaS for Microsoft Sentinel is available immediately to UK organisations. The operator has not given a date for international rollout, but the Microsoft relationship makes a European follow-on the obvious next step once data-residency questions settle.

That is the story to watch: a UK-first managed Sentinel, built by the country's biggest carrier, priced and packaged to absorb the AI-speed gap that Microsoft's own report has now named.