The Take Note Group of Companies runs a 24/7 SOC and IoT Operations Centre from South Africa, protecting clients like Absa, Vodacom, and Eskom. Founder & CEO Mamela Luthuli explains their 30–60 second operator response, SOC-integrated active deterrence (LRAD talk-down, fog barriers), and how multi-sensor correlation cuts false alerts by up to 90%.
An award-winning cyber + IoT monitoring ecosystem in South Africa
Q: Tell us a bit about Take Note — who you serve and what your monitoring operation looks like today.
Take Note has officially transitioned into the Take Note Group of Companies, an award-winning ecosystem with over 17 years of experience in the Cyber and IoT space. Founded by CEO Mamela Luthuli, we are a 100% black female-owned, Level 1 B-BBEE company certified under ISO 27001, ISO 9001, PSIRA, SAIDSA, TAPSOSA, and ICASA.
We serve top-tier private and public sector organizations, including Absa, Vodacom, MTN, PRASA, Eskom, ArcelorMittal, Exxaro, SITA, NSFAS, and various government municipalities across South Africa, with an international footprint spanning South Africa, the USA, and Dubai.
Our monitoring operations center around a 24/7 Security Operations Centre (SOC) and IoT Operations Centre. Powered by a team of 20 highly skilled security consultants (including CISSP and Certified Ethical Hackers) alongside international partners like CrowdStrike and IBM, we provide continuous monitoring, penetration testing, threat hunting, and automated asset protection.
Q: What makes Take Note Group of Companies different from other monitoring stations? When a customer chooses you over a competitor, what's usually the deciding factor?
What sets us apart is our holistic convergence of Cybersecurity, physical IoT protection, and proprietary hardware/software technology. While traditional stations only handle video feeds or standard alarm logs, Take Note Group covers the entire defense spectrum under three key pillars:
- Cybersecurity Solutions: Provides 24/7 SIEM/SOC management, threat hunting, incident response, penetration testing, and vCISO services.
- IoT & Physical Security: Deploys cutting-edge perimeter sensors, cable theft protection, and OEM equipment like our RFID Asset Monitoring Tags.
- Excellence Academy: Drives job creation and trains South African youth through QCTO-accredited courses.
The deciding factor for customers is our proven track record, international vendor backing, B-BBEE Level 1 compliance, and ability to manufacture and deploy proprietary solutions directly tailored to African infrastructure risks.
Q: Who is your ideal customer, and what do you do best for them — the thing that keeps them with you?
Our ideal customers are enterprise organizations, critical infrastructure operators, telecommunications providers, financial institutions, and government departments that manage high-value digital and physical assets.
What keeps them with us is our proactive protection and complete operational visibility. We save them significant money by eliminating the expense of building an internal SOC. Our clients get real-time dashboards, drill-down analytics, and rapid threat mitigation without operational overhead.
Response and resolution
Q: From the moment an alarm is triggered, what's your typical response time — how fast does an operator actually start acting on the signal?
From the instant an alarm or threat is flagged by our sensors or SIEM systems, our 24/7 operators and automated systems begin acting within 30 to 60 seconds.
Q: And how about resolution — from alarm to a handled/closed incident, what does a typical timeline look like?
Standard alerts and false alarms are reviewed, verified, and closed within 5 to 15 minutes. For active intrusions or high-risk cyber threats, immediate automated and manual containment protocols (such as active deterrence, network isolation, or security dispatch) initiate within 1 to 5 minutes.
Video, deterrence and false alarms
Q: How easy is it for a customer to add active deterrence (e.g. audio talk-down / warnings) to their service? Is that something your operators can do directly?
Adding active deterrence is seamless. We integrate specialized physical deterrence systems directly into our SOC workflow, allowing operators to act immediately upon visual verification:
- Long Range Acoustic Device (LRAD): Projects clear voice warnings and deterrent tones over long distances.
- Bullseye Robotic Gunaz: A remote-controlled, CCTV-integrated system for precise intrusion prevention.
- Fog Security System: Generates a dense fog barrier upon alarm activation to instantly blind intruders.
- Ocular Interruption Device: A multi-spectrum optical system designed to disrupt and disorient unauthorized personnel.
Q: Do you work with multiple camera brands, or are customers tied to specific hardware? How do cameras typically connect to your monitoring centre?
We are completely hardware-agnostic and work with multiple camera brands, while also deploying Uniview IP Cameras via our SecuVue platform. Cameras connect securely to our SOC through cloud management, VPN tunnels, edge gateways, or cellular IoT relays. We also utilize our TNIT Aggregator platform to pull together video, sensor, and system data into one unified dashboard.
Q: How do you keep false alarms down, and how much does video verification help there?
We suppress false alarms by combining AI video analytics with advanced physical sensor technology. In addition to video verification (such as exception-based workflows in our Visual Verifier), we deploy:
- Distributed Acoustic Sensing (DAS): Fibre optic sensors that detect precise movement and vibrations along perimeters.
- Distributed Temperature Sensing (DTS): Monitors temperature variations along cables to catch fire or heat risks early.
- Multi-Sensor Correlation: Reduces false alerts by up to 90% by confirming sensor alerts with live video feeds before escalating.
How Take Note works with customers
Q: Can someone buy standalone 24/7 monitoring as a service? And how flexible is it — for example, could someone get monitoring just while they're away on holiday, or is it always a longer commitment?
Yes, customers can purchase fully managed or hybrid co-managed 24/7 SOC services as a standalone offering. We offer flexible deployment models ranging from custom short-term projects to long-term enterprise retainers. The onboarding process includes site assessment, system integration, alert rule configuration, signal testing, and 24/7 go-live handoff.
Advice to buyers
Q: If someone is shopping for a monitoring station, what should they look for, and what questions should they ask?
When evaluating a monitoring partner, buyers should ask the right questions:
- "Do you provide converged physical IoT and Cybersecurity protection under one roof?"
- "Are your analysts and facilities certified under ISO 27001, PSIRA, and SAIDSA?"
- "Can you integrate with my existing camera equipment and IT infrastructure without forcing proprietary lock-in?"
- "Do you offer proactive threat hunting and active deterrence, or just passive alert logging?"